Cybercriminals target older, rural Pa. residents as local police departments falter | #cybercrime | #infosec

Rosemary Grogan thought she was going crazy.

When the Lehigh County resident, 82, logged in online to her bank earlier this year, she noticed that $50,000 had vanished.

She didn’t even know how someone accessed her account. The financial loss was staggering, but then came the fear of judgment from others.

“I wasn’t sure that people would understand that it wasn’t my fault,” said Grogan, of Whitehall Township. “That really scared me.”

Grogan is among a growing number of Pennsylvanians, often elderly and living in rural areas, targeted by sophisticated scammers in crimes that can overwhelm small police departments. The situation has prompted some community leaders to ask for a coordinated national response.

The call comes as cyber crimes have quadrupled in recent years.

In 2020, U.S. residents lost $4.2 billion to cyber crime. In 2024, they lost a staggering $16.6 billion. That’s enough to buy the Philadelphia Eagles — twice.

Victims of cybercrime often struggle with guilt and shame, hiding their victimization and leaving thefts unreported. Grogan overcame her fears and contacted local police and her bank.

Police could not recover her money, but the bank refunded it because it was lost due to fraud. Most victims of cyber crimes, however, are left with no way to recover money stolen in complicated scams.

The problem is exacerbated in states like Pennsylvania, that have a lot of small police departments, which lack the training or technology to track down, much less arrest, members of international crime syndicates.

“We don’t have the resources to send someone to Nigeria, or Florida for that matter,” said Mechanicsburg Police Chief Robert Glenny.

The mayor of Grogan’s township, Whiteall Township Mayor Jim Nowalk, who is the president of the Pennsylvania State Mayor’s Association, recently wrote a an editorial published in PennLive calling for a federal solution for cybercrimes.

“Cybercriminals don’t stop at the state line, and neither should our response,” Nowalk wrote. “While Pennsylvania and other states are doing what they can, the truth is clear: state borders mean nothing to online scammers. It’s time for a federal solution.”

Nowalk called for better data sharing, uniform reporting standards and funding for local departments, proposing the idea of a national task force on cybercrime. He called on Pennsylvania’s senators, Dave McCormick and John Fetterman, to help form a comprehensive solution.

Until something like that happens, Nowalk said, local agencies, are “left chasing shadows” after inter-jurisdictional crimes.

Cybercrime experts and local law enforcement agencies agree a national approach is necessary, as criminals continue to become more advanced and responses become more outdated.

What about the FBI?

Why doesn’t the state or the FBI take care of cyber crime?

The state attorney general won’t step in for cases of cyber crime unless it’s a large-scale, patterned crime that is referred to them. The office can’t just pursue cyber crime in general. Individual cyber crimes can only be reported to the Governor’s Office of Homeland Security if it’s a clear scam or if it affects national or economic security or impacts public health or safety. Even if someone reports a cyber scam, the form on the attorney general’s website is more call-based than cyber-based.

The next step up is the Internet Crime Complaint Center, or IC3, the FBI’s hub for cyber crime. The organization celebrated its 25th anniversary last year. Crime reported to the IC3 is analyzed to determine where the U.S. can put resources, and identify hacking groups and patterns. Its job is to help America understand the problem so policies can address the problem.

If they identify a hacking group, that’s when the FBI could potentially step in to pursue them. But again, not an individual crime.

Who are cyber criminals?

Cyber criminals fall into several different categories, according to Associate Professor Adam Wandt at John Jay College of Criminal Justice, who has researched cyber crimes and internet crimes for nearly two decades.

First, there are large, organized scam centers, typically run internationally, that generally target Americans. The U.S. has tried to target the call centers that run fairly sophisticated attacks. But the criminals can now use artificial intelligence (AI) to write professional-sounding emails based on personal information they can find on the web.

The second group of cyber criminals are “a bit more malicious,” Wandt says. These criminals scour dark web data breaches and try to “socially engineer” their way into people’s lives. This category includes romance scams, extorting people with the threat of reputational damage and ransomware on computers. This type of criminal is good at remaining hidden, because even after someone is scammed, they may be reluctant to report the crime.

The third category is the “worst of the worst,” Wandt says: Pedophiles only interested in exploiting and grooming children. Even if parents think they have good rapport with their children and monitor their screens, children can still get attacked.

“On the other side of that screen is not a child but a highly manipulative sophisticated adult that very often compromise the child’s ability to go to their parents before the child realizes something’s wrong,” Wandt said.

Finally, there are criminals involved in cyber stalking, cyber harassment and invasion of privacy. These criminals aren’t overseas faceless scammers, but people Americans know, like ex partners. Many people walk right up to the line of crime, creating fake Instagram or TikTok accounts to check up on someone. It’s most dangerous when it crosses into cyberbullying and online harassment.

Local law enforcement hampered

People can report cybercrimes to their local police department, but often these agencies are helpless.

For centuries, law enforcement involved mostly physical activity, like officers walking a beat or chasing suspects. As policing evolved to embrace emerging technologies, so did the criminals.

When cybercrimes began, it didn’t seem like a problem for everyday Americans.

But cyber crimes slowly started entering the public consciousness: Cases like high school students dying by suicide after experiencing cyber bullying. Now, hardly a week goes by that people don’t get a suspicious email or text “phishing” for secrets and passcodes.

“As we see specific cyber crimes pop up that really upset us, we are reactively trying to figure out how to reduce those specific crimes, but we don’t have the resources, education, training or personnel in law enforcement to attack everything,” Wandt said. “We know how to put a cop on a street corner, but we can’t put a cop in every computer and America does not want a cop in every computer.”

So, local municipalities are, for the most part, out of the game through no fault of their own. That’s why Nowalk called for a national and statewide response.

“As president of the Pennsylvania State Mayors’ Association, I speak regularly with community leaders across the state,” Nowalk wrote. “We all share the same frustration: we’re fighting a national threat with local tools.”

Swatara Township Police Lieutenant Timothy Shatto said cybercrimes are “absolutely a significant problem,” and that cyber criminals typically use tactics like enhanced electronic and the manipulation of what appear to be official documents.

In order to combat cyber crime, two Swatara Township detectives received enhanced training in electronic and cyber crime investigations. The department has invested in advanced technology and also collaborates with various state and federal agencies, Shatto said. It also collaborates with the private sector, like financial institutions.

District attorneys are another local agency that pursues cyber criminals. Travis Anderson, first assistant district attorney with the Lancaster District Attorney’s Office, said the investigation has to progress to a certain level for the office to even become aware of it. A few times a week, the office will get information from law enforcement, and the on-call assistant district attorney will field requests for wiretap orders.

If a scammer uses an IP address, a cellphone number, email address or social media handle, law enforcement can request electronic communication information through the Pennsylvania’s wiretapping laws. It’s still hard to investigate the crimes.

“It’s very difficult because the schemes that are the most successful and the schemes that tend to actually dupe people out of their money tend to be fairly sophisticated and have multiple levels and layers that serve to obfuscate who the actual actor is,” Anderson said.

Schemes often run through multiple layers of intermediaries. Sometimes complicated romance scams lead to an unwitting victim acting as a middle man between a scammer and another victim.

“That [middle] person gets caught and their criminal culpability is not exactly clear,” Anderson said. “They may be reckless but certainly didn’t have the intent to defraud the people they were defrauding.”

Another complication is the fact many cyber criminals are overseas. Anderson said any crime that crosses jurisdictional boundaries becomes more complicated to both investigate and prosecute.

“It sets you up to be dependent on another agency. It becomes greatly compounded when you’re going across an international boundary,” Anderson said.

It’s unlikely that the office will be able to get victim’s money back, Anderson said.

“The most effective way to deal with these types of scams is to try to prevent them from happening,” he said.

While law enforcement does what they can, they feel powerless. And the calls for national intervention don’t feel answered by the IC3.

“I’m happy it’s being done, but the average citizen does not feel heard,” Wandt said. “They don’t feel like the government took their crime seriously even though everyone’s doing the best they can to try to make it better. The government can only do so much to protect us.”

‘Going to get worse’

Law enforcement agencies face an extremely hard task, and state and federal government have to go through the time-consuming process of researching and writing bills and finding money in already-tight budgets. That’s part of why Wandt puts some of the blame on corporations.

“It’s clear to me that social media companies have the technology and capability to stop most of this behavior but they choose not to employ it for various reasons including profit,” Wandt said.

Multiple congressional hearings have been held for social media companies especially focusing on cyber crimes against children. It hasn’t resulted in any miraculous changes.

“We know there’s a problem, we just don’t know what to do about it,” Wandt said. “We’re stuck until a younger generation figures out how to reengineer parts of our legal system.”

That younger generation is aware of AI capabilities, as deepfakes and AI images become more real. Someone recently used AI-generated content impersonating Secretary of State Marco Rubio to contact foreign officials.

Anderson said new ways of transferring money, like cryptocurrency, have added layers of difficulty, but at its core the crime remains the same.

“I would hazard to say that even if the means of perpetrating the scam utilizes new or unfamiliar technology, the nature of the con is probably pretty much the same,” Anderson said. “The ways you con a person into giving up money remains a universal thing, and it hasn’t changed in hundreds of years.”

It seems that there’s danger on every front when it comes to the internet, but Wandt is very hopeful about the future.

Wandt is an optimist by nature, but he’s especially optimistic about cyber crime because of his position at John Jay. The college is plugged into the information security and law enforcement community, and he’s seen many proposals that he described as “brilliant and promising.”

“I think the problem is going to get worse as we figure out how to make it better. You can’t wave a magic wand and make it go away,” Wandt said. “We can treat specific symptoms but ultimate healing will mean a lot of growth and change with how we deal with things in our society.

Many of the issues that need to be resolved push the delicate balance of government intervention and American freedom. How much private data are Americans okay with the government peeking into?

It’s not black and white, Wandt said. Every expert will have a different shade of gray answer.

Wandt thinks in the future, the world might see globalization of reporting mechanism and better information sharing. Local police department may be able to explore issues using massive data sets they would never be able to compile themselves.

“No one is ignoring the problem. Everyone is funding it,” Wandt said. “On the other side of that, people are constantly trying to figure out new ways to hurt other people with technology. It’s the unfortunate world we live in today.”

Prevention tips

There are several steps people can take to protect themselves. Never give out your personal information online or over the phone to someone you don’t recognize.

If someone online is asking for money and demanding it urgently, even if it’s someone who appears trustworthy, don’t send payments. Instead, verify through another method of communication that the person is who they say they are. Also, make sure to set up multi-factor authentication accounts to enhance security.

“When you receive any type of electronic communication or unsolicited phone calls, hang up and call that agency directly on a phone number you found on through an open source like Google,” Shatto said.

Getting information on preventing cyber crime out to the public is a responsibility local police departments take seriously. Swatara Township Police regularly posts scam warnings on their website. Residents can check their local police department’s website for cyber scams near them.

Anderson said it’s important for people to ask questions about their loved one’s lives, especially if someone says the IRS is contacting them or they have an online love interest.

“Stepping in to prevent money from being transferred in the first place is really the only effective way to make sure they’re not getting scammed,” Anderson said.

The FBI has a full list of preventative measures on their website.