Smashing Security How a fake police officer nearly stole Graham's cryptocurrency
10 snips
Aug 5, 2026 
Danny Palmer, technology and cybersecurity journalist known for reporting on breaches and threats. He discusses a convincing fake police call aimed at stealing a 24‑word crypto seed. He outlines hotel Wi‑Fi DNS poisoning and malware campaigns targeting travelers. He also covers a major data theft from the UK education sector and why schools and universities are attractive targets.
AI Snips
Chapters
Books
Transcript
Episode notes
Fake Police Call Targeted My Crypto Seed
- Graham Cluley received a convincing call from someone claiming to be a detective saying hackers had his passport scan and a 24-word seed for his hardware wallet.
- The caller pressured Graham to visit a police station and implied they could compare his seed to a record, revealing an attempted social-engineering seed-extraction scheme.
Reporting The Scam Felt Frustratingly Ineffective
- Graham tried to report the fake police call and forged email to Action Fraud and Crime Stoppers but found Action Fraud's response unhelpful and couldn't get through to Crime Stoppers.
- He inspected email headers and found forged details, illustrating friction victims face when reporting social-engineering campaigns.
How Hotel Wi‑Fi Can Redirect Everyone At Once
- Microsoft and ReliaQuest found an SVR-linked campaign called Captive Crunch that poisons hotel captive-portal DNS to redirect all guests to attacker-controlled servers.
- By compromising hotel Wi‑Fi infrastructure they can intercept thousands of travellers at conferences, harvesting credentials and deploying phishing at scale.
