For responding officers, the threat creates a difficult operational environment. Swatting calls are designed to generate an immediate law enforcement response to fabricated reports of high-risk crimes. Common scenarios include active shooters, armed suspects, bomb threats and hostage situations.

Private residences were identified as the most frequent targets, followed by schools and campuses, businesses and hospitals, and homes of public officials. The report noted that officers responding to a swatting call at a residence may arrive expecting a violent crime in progress, creating a risk of an unnecessary escalation involving an innocent resident.

Technology is adding complexity to the verification process. The survey identified caller ID spoofing as the most frequently reported verification barrier, with 549 respondents citing it. Another 466 respondents identified challenges involving VoIP services, while 262 reported encountering artificial intelligence-generated voice tactics.

The report also describes the use of open-source information to make fraudulent calls appear credible. Threat actors can use publicly available information about victims, family members, workplaces and residences to construct detailed narratives that may appear to indicate firsthand knowledge of an incident.

According to the report, the combination of these tactics places public safety telecommunicators (PSTs) in a position where they must assess potentially manipulated information while maintaining the rapid response expected during legitimate emergencies. The report characterizes swatting as a cyber-physical threat because digital deception can produce immediate consequences for officers, residents and other members of the public.

The survey identified training as one area where agencies can improve preparedness. ECCs with swatting-specific training or recurring exercises reported greater confidence among PSTs in identifying inconsistencies, using analytical questioning and escalating concerns through supervisory and verification channels.

Written policies also remain inconsistent. A significant number of ECCs reported having no swatting-specific standard operating procedures covering call handling, verification, supervisory notification or coordination with responding agencies. The report said reliance on individual experience or shift-level practices can produce inconsistent responses and complicate post-incident analysis.

The report recommends that ECCs develop standardized policies and procedures, provide scenario-based training for PSTs and supervisors, and strengthen call-handling and verification processes. It also calls for established coordination channels among emergency communications centers, law enforcement agencies, schools, corporate security teams and intelligence partners.

Improved reporting and information sharing are another priority. The survey found that 277 respondents said no centralized authority or external agency tracks their ECC's swatting data. Although 598 respondents reported incidents to local investigators, the report identified no mandatory, uniform national platform for collecting and analyzing swatting incidents. A total of 445 respondents identified a unified national threat database as a strategic need.

For law enforcement agencies, the findings underscore the importance of integrating emergency communications personnel into swatting preparedness and response planning. The report concludes that treating swatting as a cyber-physical threat can help agencies strengthen procedures, training, verification capabilities and interagency coordination while reducing the potential for dangerous real-world consequences.