What should support do with an emergency request for customer data?
Escalate it immediately through the established emergency-disclosure route, preserve the original request, and confirm that an authorized owner has accepted it. That owner evaluates the request and any disclosure; an urgent message does not give the first recipient release authority.
A caller says they are a police officer and need a customer’s details immediately. A matching email arrives with a case number and an official-looking signature. The support agent can see the requested information. The caller says there is no time to involve anyone else.
The agent needs a fast route to the people authorized to handle the request. Escalate the claimed emergency promptly, preserve its context, and obtain an acknowledged handoff. Looking up customer records or sending them back to the caller should not become the default response simply because the first recipient has access.
The authorized emergency-response team determines the request’s validity and any disclosure permitted by law and policy. Support owns the urgent handoff.
A genuine-looking address can still be part of the attack
The FBI’s November 2024 advisory described compromised US and foreign government email accounts being used for fraudulent emergency data requests. It also described criminals using threats of imminent harm to pressure recipients. The advisory names Lapsus$ as an earlier example of actors using the technique; it does not attribute every such request to that group. FBI: fraudulent emergency data requests, pages 1–3
A real government account may be compromised. Recognizing its domain is not enough to authorize a disclosure; the specialist team still needs to check the request. Keep the logo, signature, and case number for that review.
The FBI recommends scrutinizing inconsistencies and contacting the sender and originating authority when validation is needed. Have the specialist team use the organization’s established verification route. Our callback guide explains why: a telephone number copied from the disputed request cannot independently establish its source. FBI mitigation guidance, pages 3–4
This is pretexting: a story supplies a reason to perform an action. Here, the story seeks urgent disclosure. Recognizing the pattern should accelerate the right escalation, not cause an employee to dismiss a possible emergency.
Support routes the request; specialists decide on release
For an example of a published specialist process, Microsoft says its compliance team evaluates emergency requests before disclosure and limits any disclosure to information it believes would address the emergency. This is Microsoft’s stated practice, not a universal procedure for every business. Microsoft: practices for emergency requests
Your organization needs its own named route and backup owner. The first recipient should be able to find them from an internal source without relying on the requester. If the request is misrouted, use the urgent escalation procedure immediately rather than returning it to an ordinary queue or asking the sender to wait for the next business day.
Route urgency to its owner
Proposed support handoff
- First recipient
Preserve the request and receipt time. Invoke the urgent internal route.
Request
- Authorized team
Acknowledge receipt and ownership. Use the urgent backup if no owner responds.
Accepted case
- Specialist review
Check source, scope, and requirements. Decide any permitted disclosure.
Routing a case does not authorize sending customer records. No frontline data release.
Keep the intake record small and useful: when and where the request arrived, what the sender claims, what information they seek, where the original is preserved, and which authorized owner accepted the handoff. Use references to protected material rather than copying customer details into a broadly visible ticket.
The first recipient can say: “I am routing this urgently to the team authorized to handle emergency requests.” They should not promise a release, decide the legal basis, or send a preliminary sample to prove that the account exists.
A sent message is not an accepted handoff
If the primary owner does not acknowledge the request, use the documented urgent backup route and preserve the original receipt time. Record who accepted responsibility and when. A message in an outbox only establishes that escalation was attempted.
While waiting for acknowledgment, frontline staff should not open customer records or send a sample. Keep using the urgent escalation route so a genuine emergency reaches the authorized team.
An internal rehearsal can check reachability and acknowledgment using fictional material, with no real customer records, emergency-service calls, or actual agency contacts. Its purpose is to find gaps in the handoff, not to reward employees for diagnosing fraud themselves.
Make the emergency contacts reachable
If the urgent contact is missing, assign an owner to publish it and a backup. If the receiving queue has no acknowledgment practice, agree on how receipt and responsibility are recorded. If staff can find the route but default to answering from customer records, clarify who owns disclosure and rehearse the handoff again.
For suspected data already released, activate the established incident process and preserve what was sent, when, and to which destination. Our extortion-intake guide offers a related reporting habit: keep statements from the sender separate from facts the organization has established.
Publish the primary contact and backup where frontline staff can find them during a call. The optional handoff card provides space for both, along with the acknowledgment record.
