Harassing texts. Unwanted deliveries. Fake bomb threats that bring police to the door. Inside the tactics cybercriminals use to get social media users to surrender their accounts
Online handles have become valuable status symbols — and some cybercriminals are going to frightening lengths to bully, harass and extort users into giving them up.
Federal officials tell CBS News they are concerned about the rise in attempts to get innocent social media users to surrender their accounts.
Cybercriminals turn around and sell the ill-gotten usernames — from sites like Instagram, Minecraft, Twitter, and Snapchat — through online marketplaces to the highest bidder, according to the officials. A CBS News review of transactions saw handles apparently being sold for as much as $25,000. But victims often pay a high price.
CBS News found half a dozen instances where first responders arrived at the homes of innocent social media users or their families after cybercriminals called in a fake emergency--a tactic known as "swatting"--as part of an effort to extort victims for their usernames. Heavily armed police, or in one case, child protective services, often arrived late at night, surprising unsuspecting victims.
"The schemes are actually resulting in violence and loss of life," says Assistant Attorney General Kenneth Polite, who leads the criminal division at the Department of Justice. Polite says online extortion is a "growing issue" that "has the full attention of the department."
"The internet makes this type of criminality much easier to commit, but it also makes it much more difficult to investigate," Pilote said.
The grandfather
Mark Herring signed up for his Twitter handle "@Tennessee" in 2007, less than a year after the platform launched. By 2020, the retired software developer was turning down offers from strangers asking to buy the username, his family said.
"He loved his handle," Herring's daughter Cori Fitch told lead national correspondent David Begnaud.
The grandfather of six and father of three was at home in his cabin in a remote area of central Tennessee watching TV with his girlfriend when the first police vehicle rolled up to his house the night of April 27, 2020. Eighteen minutes earlier, his local sheriff had received a chilling call from a man claiming to be Herring.
"I just shot someone," the voice on the call said in audio obtained by CBS News.
The man provided Herring's address and went on to describe how he had murdered a woman he met on a dating app, and was holed up in his house, which he had armed with pipe bombs.
The call was a hoax, part of an elaborate campaign to scare Herring into turning over his Twitter handle — but police believed they were responding to a real emergency.
His girlfriend, Ann Billings, said dozens of police cruisers arrived at his house, lining the rural road leading to the cabin. She said when officers came down the driveway, Herring walked onto his back porch. He was ordered to put his hands up and approach police by climbing under a gate separating the porch from his front yard. After he came under the gate, officers told him to stand up.
"So he did," Billings told CBS News lead national correspondent David Begnaud. "And I guess the stress was too much."
Herring collapsed, suffering a fatal heart attack. He was 60 years old.
"He was scared to death," Herring's daughter Cori Fitch said. "I believe that's what killed him, just being scared to death."
The harasser
In May 2020, a week after Mark Herring's death, the FBI arrested Shane Sonderman, then 19 and living with his mother outside of Memphis. Prosecutors told the court he was part of a criminal ring that would "annoy, harass, and intimidate victims into giving up their social media account names" so they could "sell them online to the highest bidder."
In July, Sonderman was sentenced to five years in prison after pleading guilty to one count of conspiracy. Court documents allege Sonderman posted Herring's address and phone number to Discord, a social messaging app, shortly before the call. The fake emergency call itself was made by one of Sonderman's co-conspirators— a 17-year-old living in the U.K. — in a tactic known as "swatting."
"What was shocking to me was that the perpetrators, and certainly the perpetrator that's at the center of this prosecution out of Tennessee was so young," said Polite. "These are young people who are, at very early ages, beginning to engage in this type of criminality."
CBS News has learned the FBI first visited Sonderman in August 2018, when he was a minor — just 17 years old. Sources say at the time, Sonderman acknowledged he had engaged in as many as 90 swatting type events within the prior 10 months.
By the time he was arrested, Sonderman had been on the FBI's radar "for a period of time," said Assistant U.S. Attorney Deb Ireland, who prosecuted Sonderland. The swatting call against Herring and the fact that Sonderman was no longer a minor "gave it a sense of urgency," she said.
"He and others would go online and look for Instagram, Twitter — any kind of account handle that's especially catchy," Ireland said. Sonderman and his associates would first ask for the handle, and when owners declined, the harassment campaign would begin.
"He would order food to be delivered to someone's residence," said Ireland. "Food deliveries would begin to their family members who may live in other cities or other states, so that they feel increasingly watched. Emergency services would be called to their homes or the homes of other family members. And then a text message would follow up, for example, to say, 'Hey, did your family enjoy having the fire trucks arrive at their house?' It's almost as though you're being watched by someone invisible that you don't know who it is, and you don't know how far they'll go."
CBS News reached out to the prison where Sonderman is incarcerated with a request to speak with him, but did not receive a response.
In addition to the U.K. minor who called the police to Herring's cabin, CBS News has learned two additional individuals were under FBI investigation as recently as March for co-conspiring with Sonderman.
Polite said he's seeing more and more cases of swatting tied to online extortion, including the buying and selling of social media handles. He said the cases are hard for federal prosecutors to investigate because perpetrators cover their tracks using temporary phone numbers and emails and masking their IP addresses.
"Individuals are essentially calling in fake emergencies that result in local and state law enforcement having to marshal their resources to respond to a false situation," Polite said.
A 2008 FBI bulletin warned of swatting as "a new, much, more serious twist" on a scheme called "phone phreaking" from the 1970s, in which people hacked phone companies' systems and made free long distance calls. The bulletin cited swatting incidents going as far back as 2002. Still, Polite said the cases are hard for federal officials to prosecute because there are no statutes they can rely on that explicitly outlaw swatting.
"Right now our division is part of a process of evaluating a number of proposals that would help address both swatting at large, as well as the larger spectrum of online extortion schemes that we're seeing," Polite said.
The market
Social media handles like Herring's @Tennessee have become valuable status symbols, bought and sold on sites like OGUsers.com. The website advertises all sorts of usernames, from Instagram, Twitter and TikTok to gaming handles for Minecraft and Fortnite. Sellers familiar with the market said "clean" single words like @heart, @paranoia or @miracle without any numbers have price tags in the thousands of dollars. Rare single-letter or double-letter handles such as @d or @mk command five-figure sums and payments are generally made in cryptocurrencies, the sellers said.
CBS News has learned the market has spawned a growing criminal enterprise. Innocent social media users across the country said they are being threatened for their handles.
"When it started, I thought it was a prank," said Tyler Burrow, an Arkansas man who owned the Instagram handle @TB. Burrow was bombarded with texts from anonymous numbers requesting his account. He says he received unwanted food deliveries, and so did his sister in California. A tow truck came to his house ready to take his vehicle away. Then came a text message from an anonymous number telling Burrow, if he didn't surrender his username, his harasser would call child protective services. Burrow had a one-year-old daughter.
"I felt quite a bit of anxiety for a long time," Burrow said. "I was stressed about how much farther it would go. I was scared to leave the house."
Burrow said he could no longer take the harassment and sold the handle to a neutral party who had repeatedly made offers to buy it, a Beverly Hills-based entrepreneur with the same initials.
"He had contacted me many times prior but I never wanted to sell the account," Burrow said. According to Burrow, the buyer never engaged in harassment and the transaction was "professional."
A spokesperson for Facebook, which owns Instagram, said the company shut down about 400 Instagram accounts last February connected to cybercriminals that they believe could have been obtained through harassment and extortion. The company also said they sent out 10 cease-and-desist letters.
"They harass, extort and cause harm to the Instagram community, and we will continue to do all we can to make it difficult for them to profit from Instagram usernames," the Facebook spokesperson said.
Still, victims told us they believe social media companies are not doing enough to crack down on the marketplace and eliminate the incentive for cybercriminals to harass users. Burrow has been in contact with other social media users who have been targeted, and together they have started an advocacy group called Alley. The group aims to "monitor, legislate, and enforce new terms of service for and with these platforms to ensure that no criminal activity of any kind is slipping through the cracks."
The holdout
Marie, who agreed to speak on condition CBS News not use her real name, said she received a phone call from an unknown number around October 2019. A stranger asked her to give up her Instagram account with its two-letter handle.
She said she declined, and that's when the harassment started. Her tormentors mined her phone number and address to harass her, she said, calling it "digital extortion" and "robbing people of their own security."
She said she started getting pizzas sent to her house "at all times," and the deliveries weren't pre-paid, so the drivers would ask for payment upon arrival.
"There would be four to five pizzas or food deliveries in a row," Marie said, who told us the harassment continued for about six months. "It was just relentless."
Then, one night last year, she had just finished dinner with her kids when she opened her front door to find six police vehicles.
"They started screaming at me that they wanted to know what was going on in my house," said Marie. "I told them nothing, nothing was going on at my house."
Someone had called in a bomb threat. She said detectives and bomb-sniffing dogs searched her house. According to a police report, the threat was fake, called in by "an offender…who wants the victim's Instagram username."
Sonderman and his co-conspirators targeted Marie as well as Herring, Ireland said.
While Sonderman was out on bail in June of 2020, Marie received this text message from an anonymous number:
"I felt like I was being watched." Marie said. "I didn't know what they knew about me."
Ireland said she does not know who sent the text to Marie. She said Sonderman's bail was revoked because he was engaging in further harassment while he was awaiting sentencing.
Marie said apart from answering that first unknown phone call, she didn't engage with her harassers and did not consider turning over her Instagram account to them.
"It's mine," she told Begnaud. "Imagine if that was the norm, just to say, 'Hey, I want something that you have. Give it to me' — and you do."
