If you've just stumbled across this blog as a social engineer who's been In the game for decades, you'd be well acquainted with the old-school type of attack vectors, such as (but not limited to) "pretexting", "tailgating", "spear phishing", "quid pro quo", "phishing" and the rest of the names that someone happened to somehow manifest with their fanciful Imagination. Each of those "quoted" terms, are simply a gateway to access the target and regardless of their meaning, they all pertain to one thing: "manipulate the victim to perform an action that they're not supposed to do", such as handing over confidential Information against their wishes.
Be It pretending to be someone In the accounts department of a Fortune 500 company, and calling an employee to verify his bank account details for taxation purposes, or being the good old tech support guy who's doing a routine security update on the network and asking the receptionist for her username & password In order to Install the latest patch on her computer, It's all done over the phone within a few minutes and "with minimal risk Involved". If It doesn't go according to plan while the SE Is still In motion, It's not a problem whatsoever - the phone call Is simply terminated without leaving any trace of who was on the other end of the line.
However, the same cannot be said for a more sophisticated type of social engineering named "company manipulation and exploitation", whereby representatives are deceived Into generating refunds Into the SE'ers account, or sending replacement Items at no extra cost. Of course, this relates to (online) stores on every level to the likes of Zalando, SteelSeries, Walmart, Currys PC World, etc - all of which have their fair share of complexities when "reps follow protocol every step of the way when evaluating claims". Unlike old-school SEing (as mentioned above) that's mostly completed In a single session, social engineering companies can take days, weeks and sometimes up to a couple of months to finalize.
For Instance, things like an "Investigation opened", a statutory declaration to be signed and returned, and asked to put pen to paper on an affidavit, can significantly delay and complicate the claim and If you have very little to no Idea of how to handle such events, your SE may prematurely come to an end. As a result, It's paramount to familiarize yourself with the Ins and outs of every obstacle that comes your way. Now given It's beyond the scope of this guide to cover each and every Incident, I'll be focusing on a very common occurrence being a "police report" ("PR"), Inclusive of the traditional methods and events that tend to trigger Its request.
For one reason or another, a lot of SE'ers of all shapes and sizes are confused about what they should do when a company decides to Issue them a PR - many of whom believe there's a huge risk Involved, thus avoid It altogether and move onto a new SE. That's what prompted me to write this article. I will clear all doubts, by discussing why a police report Is generated, the event and methods that trigger It, as well as what happens after the report Is filed by you - the social engineer. When you've finished reading this entire tutorial, you will comprehend everything relative to a police report, and how & why It's used In the assessment of your claim. So without further ado, let's rip Into It.
What Is A Police Report?
If you've just started your career In the art of company exploitation, and received an email from the representative of the store you're currently SEing asking you (for the very first time) to file a police report, you'd be at a loss as to what you should do about It. It's also common for Intermediate and a minority of advanced SE'ers to feel the same way - all because they read the word "police", and automatically predict that they're In some sort of trouble, or perhaps the Feds will bust down their door at 5:30 am and start reading out their rights. I can assure you, that nothing could be further from the truth.
Law enforcement agencies have better things to do, than to waste their time and valuable resources on a "one-off Incident" that's simply claiming (for example) a package didn't arrive at a particular address. So why do companies request a police report? I'll be more than happy to answer your concerns and put your mind at ease. A PR Is nothing more than a bit of paperwork to say that what you have said pertaining to your SE, Is true and correct to the best of your knowledge, hence "Is only needed for administration purposes". To give you a better understanding, here's an analogy that you can relate to.
If you've been Involved In a minor motor vehicle accident, you'd contact the police and when they attend, they'll ask you a series of questions about the events that took place. To claim the cost on Insurance, you'd "file a police report" and the cops will put It on record, thereby the Insurer will use It (with other bits & pieces) to process your claim and fix the repairs on your car. Given there wasn't anything to suggest acts of unlawful behavior, everything went smoothly and you were back on the road In no time at all. That Is no different to filing a police report when SEing - as long as the SE appears legit, there's no cause for concern. It's perfectly fine to go ahead and file one.
The Event That Triggers A Request For A Police Report:
Every SE you perform, will trigger one or more events that will either work to your advantage, or significantly complicate matters to the point of having to put your SEing skill set Into action by using an array of manipulative tactics to ensure a successful outcome. And one event that's solely responsible for triggering a police report, Is what's called an "Investigation", which (where applicable) Is opened by the company at some stage during your claim. Rarely, If ever, will a PR be requested without an Investigation - they both work closely together and are needed by reps/agents to continue assessing your claim.
Now I'm not saying that an Investigation will always be accompanied with a police report, but rather that It's the only occurrence/Incident that warrants a company's request to file and return a PR. So what Is an "Investigation", and what happens when It's up and running? Here's what generally takes place In a typical evaluation scenario. When companies process claims from customers who ask for refunds or replacements, they have certain protocols and guidelines that must be followed - which ultimately determines If the claim will be approved or declined.
While some claims are pretty straightforward and finalized with almost no questions asked, there are times when reps need to collect specific details from both Internal (company) and external (carrier) sources, and that's when an "Investigation Is opened". What this means, Is that the representative looks Into the claim, and attempts to clarify why things don't add up with what the social engineer has said against their very own records. For example, If the carrier driver left the package unattended at the doorstep and the SE'er says that It didn't arrive, although their tracking has marked the consignment delivered, the rep/agent will assume It was stolen.
As a result, the most likely course of action, Is to ask the SE'er to "file a police report" by attending his local police station, or (where available) submitting It online. As you can see In this case, the "Investigation triggered the PR" for the reason that the rep believed a crime was Involved, thus the report was purely needed for that purpose alone. So when you're asked to grab a police report and on the grounds that you've been SEing with common sense and good judgement, there's absolutely nothing to worry about - simply comply with their request and await for the Investigation to conclude - which you'll find the majority will work In your favor.
Methods That Trigger A Police Report:
Every method has Its pros and cons, and whilst you're well aware of where It's heading when you're formulating It In your local environment, the moment It's executed and Is In the hands of the company's customer service rep, It's Impossible to predict the steps taken as your claim moves from one stage to the next, hence a PR may come your way when you least expect It. Sure, methods like the sealed box, the wrong Item received, the faulty Item, the broken glass, the corrupted file and many others, have no relevance to a police report, but what about those that're known to trigger one a lot more often than not? That's what I'll be discussing In this topic.
Even though you well and truly know that a police report Is only required to move forward with your claim, you may be the type of social engineer who's not comfortable and lacks confidence In dealing with an officer of the law, therefore you'd rather avoid It altogether. On the other hand, you're an SE'er who doesn't mind filing a report - Irrespective of the circumstances surrounding your claim. Whatever the case may be, It's vital to Identify "methods that predominantly trigger a police report" and to help you along the way, I've listed four below - three of which are almost guaranteed to send you to your local police station! At the end of each subtopic, I've also outlined why the method triggered a police report. Okay, let's begin with the good old "DNA method".
The DNA Method
Before I make a start, I'd like you to make a mental note of why a PR Is requested with every method mentioned from this point onwards. If you haven't worked It out yet, It's because "there's a theft-related Incident Involved", thus you'll be Instructed by the representative to report the event(s) to a law enforcement agency. Evidently, nothing of the sort (theft) has happened, you're just pretending It did for the purpose of your SE. Makes sense? Good! Now that you understand It, the "DNA" (Did Not Arrive) method Is used to say that the package that was scheduled for delivery by the carrier, did not arrive at Its Intended destination - being your home, drop address or any other location used to accept deliveries.
Because the DNA Is a "universal carrier based method", It's compatible with just about any Item, Inclusive of any company who uses a carrier service to send goods to their customers. What this means, Is that unless you're SEing a family home (so to speak!), the DNA Is not specifically tied to any Items, hence weights and dimensions are Immaterial. That being said, be realistic with your SE. For example, If It's a huge 1,000 L fridge that costs over $2,000, then some form of verification will be required - either a signature or If the company Is Amazon, an "OTP" (One-Time Password).
Now there are many occasions when the driver simply "leaves the package at the doorstep" and Immediately exits thereafter, particularly when he's running late for his delivery run. When this happens, the DNA method has an extremely high success rate - for reason that "you did not personally receive your package", your "address" did! As such, anyone could've taken It In your absence - a passerby, your neighbor or maybe the carrier driver. Under these circumstances, It's Ideal to hit the DNA for the fact that "the package was not personally handed to you", therefore "you" did not receive It. And If the company tries to use Tracking/GPS Info to confirm the consignment, It's useless - It only marks goods delivered to an "address", and not to a "person".
Why a police report will be triggered: The package was left unattended at the doorstep and (seemingly) stolen, which justifies the Incident be reported to the police.
The Missing Item Tampered Method
If this Is the first time you've visited this blog, I'd say It's very safe to assume that you have never heard of the "missing Item tampered method", correct? I thought as much. That's because I'm the author by naming It as such, and I can confidently say that It's one of the most effective methods that you'll have the pleasure of using. So what exactly Is It, and how do you formulate It? Well, It's based on the same principle as the missing Item method, but with a slight variation In how It's executed and If you've delved Into my guide, you'll be able to follow this tutorial with Incredible ease, so be sure to read It! Okay, this Is how the missing Item tampered method works.
Instead of a warehouse or manufacturer error being responsible for not receiving your product, the Intention of this method Is to make It seem as though "the carrier or whoever else handled your package", tampered with It In transit and stole your Item "just before" It was dropped off at your home (or drop house). Essentially, you'd tell the rep that the seal on the box was broken and/or the package was torn - which Is consistent with tampering. Unlike the missing Item method, the weight Is not as Important (but still relevant) when solely using the missing Item tampered method - namely because you're giving the Impression that someone opened your package and took your Item "while It was on Its way to your address/drop house".
So even If the company cross-checks the weight recorded at the carrier's depot and deems that your product was Inside the package, It's pretty much useless. Why? Because "your Item was (apparently) stolen during shipment AFTER It left the depot while It was being delivered to you". But to play It safe, especially If an Investigation Is opened, keep the weight < 120 grams, preferably around 40 grams. That way, It will not register at any weighing facility, thus the company and their carrier partner will not have evidence that your Item was dispatched - which almost solidifies your claim that you did not receive your product.
Why a police report will be triggered: Given you've said the package/box was damaged on arrival, It appears to be theft-related, so a police report Is warranted.
The Boxing Method
There are many ways that this method can be applied, but for the purpose of this guide, I'll only focus on one approach as follows. Also referred to as "box" on Its own, the "boxing method" Is used when you buy something (such as Apple AirPods), and then contact the company saying that they're not working. The rep/agent will then go through a few troubleshooting steps to try and establish why It's not functioning as It should, and you'd obviously remain adamant that It's broken. When he's satisfied that It's (seemingly) defective, he'll ask to return It for a refund or replacement and given the AirPods are so light, you'd "send the box with nothing Inside".
Now If your Item Is quite heavy, you will substitute the weight with dry Ice so by the time It's delivered, the dry Ice would've sublimated (turn from Its solid form to gas), hence they'll only receive an empty box. The objective of the boxing method Is similar to the missing Item tampered method that you've just read above, but the scenario Is reversed - In this case, you'd give the Impression that your Item was stolen In transit "before the company received It". Naturally, your package must appear as though It was tampered with and the way you do It, Is to "tear It on one side and seal It with different colored tape".
Don't overdo It, though! The last thing you need, Is for the carrier driver to notice the extra tape at the collection point, thereby he'll raise a damage report and It will release him from liability. As a result, "you" will be held responsible for tampering with It. What I recommend, Is to cut the package to a length that's just enough for your Item to slide out, and use tape that's slightly different In color. The chance of It being Immediately noticed on pickup will be significantly reduced, yet It will still serve Its purpose - as If someone ripped the package, grabbed the product, and (to cover their tracks) tapped It thereafter. All In all, you've complied with what was asked of you, however a thief (apparently) Interfered with your consignment.
Why a police report will be triggered: This Is the least likely method to trigger a PR, and It will only be requested to state that "you" didn't tamper with the package.
The Double Dip Method
Typically, when social engineering online retailers to obtain a refund or replacement by using any of the traditional methods discussed and linked In this article, It's performed against one particular Item and "only done once". For Instance, you've chosen the wrong Item received method, contacted the store, and told them that another Item was In the package/box to what you originally ordered. Of course, this didn't happen - you're just saying It did to SE the company. The rep then asked you to return the wrong Item and when he received It, your funds were reimbursed Into your credit card. That's how a standard SE Is done - "one Item Is SEd and one refund or replacement Is Issued".
The "double dip method", on the other hand, requires an exceptional set of skills and a great degree of confidence to succeed - due to fact that "the same Item will be social engineered twice" from the same company where It was purchased. In simple terms, you're "repeating the SE" on the one claim to get a refund/replacement twice. Confused? Don't worry, It'll make perfect sense In a minute or so. Now because you're SEing the company "two times In a row", to avoid raising suspicion, I strongly recommend using "two different methods" when double dipping. Okay, let's take a look at the double dip method In action. I'll be referencing the SE'er from a third-person point of view, and not yourself.
The social engineer wants to SE "two AirPods" from the "same company", without paying a single dime for either of them. Firstly, he orders just the one pair, and uses the DNA method. After satisfying the company that the package was (seemingly) not received, they decided to send out a "replacement" - meaning another set of AirPods. For your Information, It's absolutely crucial that a "replacement Item" Is dispatched on the first SE, otherwise you won't have a product to double dip! Back on-topic, the social engineer now has two AirPods, but only paid for one. That Is how a standard SE Is performed. Next comes the double dip.
The SE'er then calls the company and says that the replacement AirPods (that they just sent) are defective, and the rep/agent asks to send them back. To circumvent It, the SE'er uses the boxing method, thus returns the box without the AirPods. Remember: So far, the social engineer still has two AirPods, but only paid for one. The representative thinks that the AirPods (In the return) were stolen during transit, so he "generates a refund". As a result of every event, the SE'er has SEd "two AirPods" - one using the DNA method and the other using the boxing method. In other words, he's "double dipped!". Because he was given a refund, he has both AirPods that didn't cost him a single penny!
Why a police report will be triggered: The nature of the DNA and boxing method are theft-related, so the Incidents that took place, need to be addressed with a police report.
In Conclusion:
This article has exceeded Its reading time by a lot more than what I anticipated, for the reason that In order to understand why a police report Is needed during the evaluation of a claim, you must know the events and methods that trigger It. Evidently, It's not possible to discuss each and every method used In today's world of company manipulation and exploitation and even If It can be done, It's not what this article Is all about.
Its objective Is to make you fully aware that methods Involving stealing Items, are almost certain to trigger a PR and of paramount Importance, Is for you, the SE'er, to know that a police report Is only required to move forward with your claim, so make sure to always keep this In mind every time you're asked to file a report.
