Opportunities

How the Scam Works

Scammers falsely claiming to be employees of NCPC use such addresses to solicit fraudulent Requests for Quotations (RFQs). The fraudsters generally seek RFQs for electronic equipment (cell phones, laptops, tablets, and other electronic devices). These “spoofed” emails appear to originate from government email domains, including “.gov” but have non-government domain extensions, such as “.net” or “.com.”

When a business responds to the RFQ, the fraudster replies using an email address that is similar to a legitimate government email address but has a non-government email domain extension. The fraudulent RFQs also appear nearly identical to legitimate RFQs used by federal government agencies, often using the names of real agency officials. However, the fraudulent RFQs have illegitimate contact information, including email addresses and phone numbers that send any correspondence back to the fraudsters and not to any legitimate government entity.

If a business entity responds to the RFQ, the fraudster will accept the quote, provide a fraudulent Purchase Order (PO) and the business is provided with an address to which they can ship the devices. The PO will usually include the “signature” of the federal official, likely copied and photoshopped from publicly available contract files. Payment is usually guaranteed within 30 calendar days of the goods having been received ("Net 30"). The shipping addresses vary, but are typically commercial addresses accessible by the public, such as short-term storage companies, warehouses or freight forwarders. When the U.S.-based business submits an invoice for payment to the affected government agency, the invoice is rejected, or no response is provided to the business because the government agency has no records of the fraudulent procurement. At this stage, the business realizes it has been defrauded.

Preventing and Reporting Fraud

To prevent being victimized, government vendors should consider verifying RFQs and shipping addresses with agency officials by using publicly available contact information. This information can be found here: https://www.ncpc.gov/about/staff/. Government vendors can also carefully review email header information and confirm it is from a valid government domain, such as ncpc.gov.

If you have information about fraud, waste, abuse, mismanagement, or other crimes or violations of federal laws, rules, and regulations relating to NCPC, please report it to info@ncpc.gov and/or to the FBI’s Internet Crime Complaint Center (IC3) at https://www.ic3.gov/default.aspx.