Swatting is the criminal act of deceiving emergency services into sending heavily armed response teams to an unsuspecting victim’s address by falsely reporting a serious emergency situation, such as a hostage situation, bomb threat, or active shooter.
Swatting originated as a prank within the gaming community. In recent years, it has expanded to target individuals across other aspects of society with goals of fear, intimidation, harassment, or diversion of law enforcement resources in preparation for a larger event in the community. Swatting calls may also be a lead-in to cyberattacks.
Some key points to consider:
- Any incoming call should be treated as legitimate until proven otherwise
- Always follow locally defined policy and procedures for information gathering, dispatch of responders, incident escalation, and information sharing
- Reported situations may vary, but are often reported to be serious incidents (e.g., hostage situations, murder, active violence/active shooter) to prompt a larger response to the victim
- The caller’s story or provided information may change or escalate during the call. Note inconsistencies in provided information, following up with additional questions
If you receive a call:
Information gathering plays a key role in the identification of a potential swatting incident.
Additional questions may be added to the call-taking process to aid in identification of these
incidents. Repetition of questions may identify inconsistencies in the caller’s story, leading
to higher confidence of a hoax call. Some of these may include:
- What is your full name?
- Where are you calling from?
- Why didn’t you call 911 directly? (for calls received on non-911 lines)
- Why is there no noise in the background? (or other questions about noises that may be inconsistent with the information being provided)
Signs of a potential swatting call may include, but are not limited to:
- The call is received on a non-emergency administrative phone line
- The call may arrive with no Caller ID information, or appear as all zeros, ones, or nines
- The call being processed is the only call received about the potential incident
- The caller’s demeanor is inconsistent with the reported incident
- The caller may initially provide a large amount of information as if reading from a script
Contacts to keep in mind:
- CO Emergency Operations Line: 303-279-8855
- CO Fusion Center: 877-509-2422
- FBI Field Office: 303-629-7171
- Internet Crime Complaint Center (IC3): www.ic3.gov
- Cybersecurity and Infrastructure Security Agency (CISA): (888) 282-0870 or www.cisa.gov
- Multi-State Information Sharing and Analysis Center® (MS-ISAC®): (866) 787-4722