Loading story…
The FBI's Internet Crime Complaint Center (IC3) has warned that scammers are posing as FBI personnel and IC3 representatives to target people who have already lost money to cybercrime and fraud. The operation uses fake social media profiles, direct messages, phone calls, emails, online forums, spoofed IC3 websites, and AI-generated videos of senior FBI officials to falsely claim that stolen funds have been recovered or can be recovered, with the goal of stealing additional personal and financial information.
The FBI said the fraudsters often contact victims on platforms such as Facebook Messenger before moving conversations to apps like Telegram, where they may send links that harvest data or contain malicious code. Deepfake videos have also been used to steer victims to fake complaint portals designed to mimic ic3.gov and collect sensitive details about prior losses. IC3 stressed that it has no social media presence, does not initiate contact through social media, chat apps, phone, or email to recover money, and never asks victims to pay fees for fund recovery; legitimate follow-up would come from an FBI employee or another law enforcement official.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
In a July 20, 2026 IC3 update, the FBI warned that scammers were posing as FBI personnel and IC3 through spoofed websites, social media, phone, email, forums, and AI-generated videos to deceive prior cybercrime victims. The agency said the scheme aims to steal additional personal and financial information by falsely claiming funds had been or could be recovered.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceinfosecurity-magazine.com
Open sourcehelpnetsecurity.com
Open sourceic3.gov
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals have created fake versions of the FBI’s Internet Crime Complaint Center (IC3) website to steal personal information from individuals attempting to report cybercrimes. The FBI issued a public warning that these spoofed sites use typosquatting and similar domain tricks to deceive users into entering sensitive data, including names, addresses, emails, and banking details. Victims may also be targeted by scammers impersonating IC3 staff, who promise to recover lost funds in exchange for payment. The FBI advises the public to verify the IC3 website’s URL and avoid using search engines or sponsored links to access the site, as these may lead to fraudulent portals. This campaign follows a broader trend of law enforcement impersonation and secondary attacks on cybercrime victims.
Jun 29, 2026
The FBI warned that criminals behind cryptocurrency investment scams are increasingly sending in-person couriers to collect cash from victims when banks or financial institutions block suspicious transfers. In these schemes, fraudsters typically contact targets through social media, dating platforms, or messaging apps, build trust through so-called **pig butchering** or **romance baiting**, and then direct them to fake investment platforms where money is stolen instead of invested. According to the FBI, scammers may claim a victim’s account has been flagged and arrange a cash handoff authenticated with a pre-arranged password or a specific U.S. dollar bill serial number. After the pickup, victims are shown fabricated gains in virtual wallets and pressured to send more money for bogus taxes or penalties. The bureau urged people to research crypto platforms, avoid sharing home addresses or meeting unknown individuals, watch for **love bombing** behavior, and report incidents with detailed evidence; the FBI’s 2025 Internet Crime Report said U.S. victims lost nearly **$21 billion** to cyber-enabled crime in 2025, including **$8.6 billion** tied to investment scams.
Jun 29, 2026
The FBI has issued a warning about a significant increase in account takeover (ATO) fraud schemes, with cybercriminals impersonating financial institutions to steal money and sensitive information. Since the beginning of the year, over $262 million in losses have been reported from more than 5,100 complaints. Attackers use social engineering tactics—including texts, calls, and emails—to trick victims into revealing login credentials, multi-factor authentication codes, or one-time passcodes. Once access is gained, criminals reset passwords, lock out account owners, and quickly transfer funds, often to cryptocurrency wallets, making recovery difficult. The FBI highlighted that these schemes are becoming more sophisticated, with tactics such as search engine optimization (SEO) poisoning, where fraudulent ads mimic legitimate e-commerce or financial sites to lure victims. The warning comes ahead of the holiday season, a period when such scams typically increase. The agency urges heightened vigilance, especially as cybercriminals exploit fears of fraudulent transactions and use impersonation of both financial institution staff and law enforcement to manipulate victims into providing sensitive account information.
Jun 29, 2026