> That sounds like straight up scammer behavior. "

Microsoft reached out to the police department, then the person went to the local police department to verify who they were. I don't see how this could be a scam.

Then again: how does the local police department verify they are indeed talking to Microsoft?

It’s been done before: https://krebsonsecurity.com/2022/03/hackers-gaining-power-of...