Fake Met Police Detective Called Me: How the Scam Works
It was the end of my working day when my phone rang with “No Caller ID”. The man on the other end said he was Detective Michael Docherty from the Metropolitan Police.
I asked for a number to call him back on. He said his department didn’t have an incoming phone line. I’ve forgotten exactly what he called his department, but it was something like the “Cyber Fraud Investigation Unit”. He told me I was right to be suspicious and that he would never ask for my usernames or passwords.
He offered to send me an email confirming his details and a crime reference number. I said I wouldn’t give out my email address. He said that was fine because he already had it, and he read it back to me. So I told him to go ahead and send it.
“I’ve heard this before”
While we waited for the email, he started to explain the “situation”. That’s when something clicked. Graham Cluley had talked about a call just like this on his Smashing Security podcast. I quickly looked up the episode. His caller claimed to be from Crimestoppers rather than the Met, but the story was very similar.
How a fake police officer nearly stole Graham’s cryptocurrency
The “detective” told me the police had made an arrest. While searching the suspects’ laptops, they’d found my details, which were being used for identity theft.
The email that never arrived
The promised email never reached my inbox. My email security (Sophos Email) had blocked it as spam. When I told him, he said that can happen, and that I should ignore the warning and just look at the details, because I’d see it was from the Met Police.
I ran the email through a header analysis tool, which looks at the hidden information that travels with every email showing where it really came from. It confirmed what I already suspected: the email had nothing to do with the Met Police.
I then asked him if he knew who I worked for. He said no. I told him I work for a cyber security company. He wanted to know which one, and I didn’t say. But when I mentioned that his email had actually come from a website called support.sophiawestfall.com, he hung up.
What the email said
The email had no links and no attachments. Its only job was to make the phone call feel real. Here’s what it said:
Representative Confirmation
Your Crime Reference number matches an account investigation that has been opened by the Metropolitan Police. Please confirm the details below during any contact.
Crime Reference: MP69168
Officer: Detective Michael Docherty
Badge No.: 56764
Call Date: 23-10-26
Please have your reference number to hand if an officer contacts you. This email is a copy of an ongoing investigation.
Fake Scam Email Screenshot
It sounds official, but read it again and it doesn’t actually say anything. “Your crime reference number matches an account investigation” is meaningless. The police don’t send emails from no-reply addresses to “confirm” a phone call, and they don’t email out badge numbers.
How I could tell it was fake
Every email carries a hidden “envelope”, a bit like the postmark and return address on a letter. You don’t normally see it, but it shows where the email really came from.
The name on the email said “Metropolitan Police”, but the address behind it was just “noreply@metpolice”. There’s no “.police.uk” or “.com” on the end, so it isn’t a real web address at all. The genuine Met Police address ends in met.police.uk, and that appeared nowhere in the email. The real sender was a website called sophiawestfall.com, using a bulk email service called Mailgun.
| Header | Value | What it means |
|---|---|---|
| From | Metropolitan Police <noreply@metpolice> | Display name spoof. The address has no top-level domain, so it isn't a real domain at all. |
| Reply-To | noreply@metpolice | A dead end, so you can't reply to check. |
| Envelope sender | bounce+00b1e8.f44eaf5-[redacted]@support.sophiawestfall.com | The real sending domain. |
| Sender | noreply=metpolice@support.sophiawestfall.com | Mailgun-style sender rewrite. |
| Genuine Met domain | met.police.uk | Doesn't appear anywhere in the message. |
Email has three main checks to prove a message really comes from who it says it’s from. Think of them as ID checks at the door. This email failed or skipped all three.
SPF checks whether the sending server is allowed to send for that website. The scammers’ website hadn’t set this up.
DKIM is a digital signature, like a wax seal on a letter. The seal was there, but there was no way to verify it.
DMARC tells receiving email systems what to do if the other checks fail. Because “metpolice” isn’t a real web address, this check couldn’t run at all. That was almost certainly deliberate.
| Check | Result | Detail |
|---|---|---|
| SPF | none | support.sophiawestfall.com publishes no SPF record. |
| DKIM | fail | "No key for signature". The selector smtp on support.sophiawestfall.com has no public key in DNS. |
| DMARC | none | The From domain metpolice has no TLD, so DMARC can't be evaluated. Very likely deliberate. |
The scammers had also added hidden labels to make the email look like a normal newsletter, such as an “unsubscribe” option. Microsoft’s own filter treated it as ordinary spam rather than a phishing attack. That’s the clever part: with no links or attachments, there’s nothing obviously dangerous for security software to catch. The danger is all in the phone call.
Where was this going?
I’m curious where the scam would have gone next. My guess is he would have said they’d found my credit card details. He’d read out the last four digits, which scammers can often get from data leaks, and ask me to read out the rest “to confirm they were correct”.
Other common next steps in police impersonation scams include:
Telling you your bank account has been compromised, or that staff at your bank are involved
Asking you to move your money to a “safe account”
Asking you to withdraw cash or buy gold or gift cards as “evidence”, which a courier then collects
Asking you to hand your bank card and PIN to a courier
Asking you to install software that lets them control your computer, or to read out a code sent to your phone
Telling you to keep it secret because it’s an “ongoing investigation”
Why this one worried me
This is a scary scam. It wasn’t a badly scripted call centre pretending to be Amazon or your bank. The caller sounded calm, professional and British, and I don’t believe it was an AI voice. He even praised me for being suspicious, which is a clever way to lower your guard.
If I hadn’t heard Graham’s podcast, I think I’d have been more helpful. The story wasn’t unlikely, and it sounded like the police were trying to help me. I’m sure I’d have spotted it once he asked for something, but this isn’t the kind of scam you hear about all the time.
If you get a call like this
Hang up. The police and your bank will never ask you to move money, hand over your card or cash, or buy anything.
Call 101 from a different phone to check whether the officer is real. Scammers can keep a landline connected after you hang up, so you might end up talking to them again.
If bank details came up, call 159. This connects you safely to your bank.
Report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040.
Forward any scam email to report@phishing.gov.uk.
Worth watching
I’d also recommend BBC Scam Interceptors. The team monitors scammers’ calls as they happen and steps in to stop victims losing money. It’s a great one to share with family and friends who might be likely to fall for these scams.
For the technically minded
If you look after email security, here are the details from this message that you can use to block or search for it.
| Type | Indicator |
|---|---|
| Sending IP | 159.135.228.57 (US) |
| PTR | v557.v524e8ec4.use4.send.mailgun.net |
| Envelope / DKIM domain | support.sophiawestfall.com (parent sophiawestfall.com) |
| From address | noreply@metpolice |
| Subject | Representative Confirmation |
| X-Mailer | DbgMail/1.0 |
| Message-ID suffix | @metpolice |
| Feedback-ID | 0943f19e9a0660aa:campaign:metpolice |
| Mailgun Sid (decoded) | ["25442","[redacted]","f44eaf5"] |
| Lure values | Crime ref MP69168, "Detective Michael Docherty", badge 56764 |
