A polished seal, a familiar logo, and a web address that looks almost perfect. That’s all it takes to trick someone into handing over personal details meant for law enforcement or a federal agency.