Extortion payment diversion is a ransomware-era fraud tactic in which a criminal group, affiliate, or impersonator tries to steer ransom money away from the original attacker. The diverter may pose as a recovery specialist, negotiator, or cleanup service and promise to restore encrypted files, delete stolen data, or speed up incident resolution.
This matters because it adds a second layer of victimization during an already high-pressure incident. Even if the promise is fake, the tactic can exploit urgency, confusion, and lack of trusted contacts to capture payment or collect sensitive information. In real attacks, it appears as unsolicited “help” messages, alternate payment instructions, or claims that a new party can settle the case more safely. Defenders should verify every recovery contact through known incident-response channels, preserve evidence, and treat any unexpected payment request as potentially adversarial.