A few points about this chat. Firstly, I’m pretty certain the initial person I spoke to was Ross. If so, he originally sent me the wrong link (unfortunately I didn’t save my first web chat).

At one point I accidentally pasted a link to a forum dedicated to selling stolen cards into the chat! Not something you want to do while talking to the police 😂. Some information in the code had lead me to this forum where I suspect the attacker has an account.

Ross was quick to try the old “its not me, its your browser” line. I’m a web developer and I hear this line all the time, I’ve probably used it myself more than once. It definitely wasn’t my browser!

The corrected link Ross sent me lead me right back to the form I have previously mentioned (pictured above) and now I was more than a little annoyed. I explained to Ross that the form doesn’t actually collect any specific information, he then directed me to another link: http://actionfraud.police.uk/report­-fraud-­about-­you

What a wild goose chase!

I had actually seen this link earlier on, but had decided it wasn’t the correct place to file a report since it was titled “Report fraud about you”. This entire service is extremely confusing and hard to navigate. I make websites for a living and can usually find my way around even poorly designed sites, but this one had me stumped!

Anyway, for the umpteenth time I began to fill out another form. As you can see in the chat I was worried that it wasn’t going to let me give enough detail again. The first steps weren’t really relevant, it was asking very specific details of the attacker that I didn’t have and wanted to know things like exactly how much money had been stolen.

A simple email address would have been more than enough for me to provide the police with the details I had, instead I was forced to fudge the first pages of a form just so I could get to the free text field at the end 😤.

I spent over an hour detailing everything I knew in the summary box. Well, almost everything. This box had a 2000 character limit, so after writing the report I had to then go back and prune it to fit within the limit. As if this process couldn’t get any more painful!

Finally I was done. I had already used most of my evening but at least the police would have my report and I could rest happy knowing I had done my bit. I pressed submit on the form and……

FUCKKKK….😡

This really was beyond a joke now. I had spent so long trying to report this I didn’t want to give up, but I could see I wasn’t going to have any luck reporting it with Action Fraud.

Next up I rang 101, the non emergency police number. I waited on hold for almost another hour before someone answered. They really aren’t joking about it being non emergency.

I finally got through and began trying to describe my evening to a cheerful police woman working for Sussex police force. I started to appreciate that this was a pretty hard situation to explain over the phone, especially when you are speaking to someone with nothing more than basic computer knowledge. She was very surprised I had told Action Fraud that I had access to stolen credit card details and all they did was repeatedly get me to fill out a form.

Having described everything the best I could in layman's terms, the police officer admitted she needed to get technical advice before knowing what to do next. Five minutes later she returned and said that the “technical advice” had told her I needed to be transferred to Merseyside police as that was where the domain was registered.

What had I gotten myself into? It was like I had entered some sort of never ending alternate reality wormhole, falling deeper and deeper into the void.

I explained that it didn’t really matter where the domain was registered, and that localised internet policing didn’t make much sense. She didn’t agree, so reluctantly I accepted the offer to be transferred and was put on hold again. Ten minutes later I get through to Merseyside police.

None of the information I had given Sussex police was passed on, so I had to explain everything again from scratch. This time the police officer I spoke to said he would take a report and we spent the next hour painstakingly going over everything I knew from the beginning.

Phonetically spelling out URLs over the phone is not my idea of a fun Monday evening.

The police officer I had spoke to was very helpful and I was satisfied he had done a good job of creating the report. He said something along the lines of “Holy shit, this is pretty juicy isn’t it” and promised me that I would receive a follow up call once they had looked into it.

I stressed to him, that it needed to be acted upon quickly. The attacker could realise at any moment that they have left their scam insecure and fix their mistake. All the evidence would disappear and we would no longer know who the victims were.