Impersonators are (still) targeting companies with fake TechCrunch outreach

Hey, thanks as always for reading TechCrunch. We want to talk to you quickly about something important.

There are a growing number of scammers posing as TechCrunch reporters and event leaders and reaching out to companies, pretending to be our employees when they’re not at all. These bad actors use our name and reputation to try to scam unsuspecting businesses. It drives us crazy and infuriates us on your behalf. It ebbs and flows. Judging by the increasing number of emails we receive, we wonder: “Is this person really for you?” It seems to be happening more actively at the moment.

Anecdotally, this doesn’t just happen to us; Fraudsters are exploiting the trust that comes with established news brands to get their foot in the door with companies across the media industry.

Here’s an example of the most common scheme we’ve tracked: Scammers impersonate our reporters to extract sensitive business information from unexpected targets. In several cases we know of, scammers have adopted the identity of actual employees, formulating what looks like a standard informational inquiry about the company’s products and requesting an introductory call.

Occasionally, eagle-eyed recipients will spot inconsistencies in email addresses that don’t match our employees’ real credentials (see list of bogus email addresses below). But these schemes are evolving rapidly; Bad actors continue to refine their tactics, imitate reporters’ writing styles, and point to startup trends to make their pitches increasingly convincing. Equally worrying is that victims who agree to phone interviews tell us that scammers use those exchanges to look up more property details. A PR representative told Axios that someone posing as a TechCrunch reporter raised suspicions when he shared a scheduling link.

Why are they doing this? We don’t know, although a reasonable guess is that these groups are looking for initial access to a network or other sensitive information. In fact, former Yahoo colleagues say these attempts are consistent with a persistent threat actor they have been tracking that has historically engaged in impersonating TechCrunch to facilitate account takeover (ATO) and data theft, and targeting crypto, cloud, and other tech companies using various pretexts.

As for what to do about it, if someone reaches out claiming to be from TechCrunch and you’re in any doubt about whether they’re legitimate, please don’t take their word for it. We’ve made it easy for you to check.

Start by checking out our TechCrunch staff page. It’s the quickest way to find out if the person calling you actually works here. If the individual’s name is not on our list, you have your answer right there.

If you see someone’s name on our People page, but our employee’s job description doesn’t match the application you receive (for example, a TechCrunch copy editor is suddenly very interested in learning about your work!), there may be a bad actor trying to scam you.

If it sounds like a legitimate request but you want to be double sure, also feel free to contact us directly and just ask. You can find out how to reach every writer, editor, sales manager, marketing expert, and events team member in our bio.

We know it’s frustrating to have to double-check media inquiries, but these groups are counting on you not taking that extra step. By being careful about verification, you’re not only protecting your company — you’re also helping to maintain the trust that legitimate journalists rely on to do their work.

Thank you. For future reference, here’s a list of some TechCrunch impersonation domains we’ve seen created over the past few months:

Email-techcrunch[.]com
hr-techcrunch[.]com
interview-techcrunch[.]com
mail-techcrunch[.]com
media-techcrunch[.]com
noreply-tc-techcrunch[.]com
noreply-techcrunch[.]com
pr-techcrunch[.]com
techcrunch-awareness[.]com
techcrunch-startups[.]information
techcrunch-team[.]com
com. techcrunch[.]on behalf of
com. techcrunch[.]Biz[.]Identification card
com. techcrunch[.]BZ
com. techcrunch[.]copy
com. techcrunch[.]the chapter
com. techcrunch[.]com[.]pl
com. techcrunch[.]gl
com. techcrunch[.]A
com. techcrunch[.]Identification card
com. techcrunch[.]He – she
com. techcrunch[.]no
com. techcrunch[.]liter
com. techcrunch[.]network[.]cn
techcrunch1[.]com