Impostors keep building fake FTC websites, and the real ones always end in .gov

The quickest way to spot a counterfeit Federal Trade Commission page is to read the last few characters of the web address. A site that ends in .com, .org, .online or the U.S. country-code ending is not the agency, the FTC says, while its real sites end in .gov, ReportFraud.ftc.gov among them. The point comes from a consumer alert by the Bureau of Consumer Protection staff, listed on Nov. 12.

Read next on Morning Overview: New FCC rules on how people can stop robocalls and texts take effect Nov. 25

The warning exists because the agency’s own name is a lure. Callers claim to be FTC “agents,” clone the agency’s logo and design, and push people toward pages meant to harvest personal information. Imposters of every kind were reported more than a million times last year.

The .gov test and the endings scammers prefer

In the FTC’s alert on fake FTC websites, the advice is to confirm an official .gov address before typing any personal details or filing a report. Fakes copy the agency’s name, logo, layout or wording, so every visual cue can be reproduced by a forger. The address ending is the one element that a private party cannot register, since the .gov space is reserved for government bodies.

The alert names the endings seen on lookalikes: .com, .org, .online and the U.S. country-code ending. It also notes that scammers do not stay on the web. Contact can arrive by text, email, social media or phone, each time carrying the FTC’s name, so a link sent in a message deserves the same address check as a page found through search.

Fake badges, invented names and the rule about moving money

The impersonators are not all anonymous. Per the alert, some use the names of real FTC employees and others invent names, and many present fake credentials. Last June, a separate FTC alert about photo IDs sent by text explained that a genuine employee will not contact someone by text or messaging app, will not send a picture of an ID to prove identity and will not offer to recover scam losses in exchange for payment.

The November alert condenses the danger into a single rule about money. A real FTC employee will never tell anyone to “protect” funds by transferring them or handing over cash. Any caller who frames a transfer as protection is, by the agency’s definition, not from the FTC.

Takedowns since April 2024 and the Impersonation Rule

The agency says it is pushing back. Since its Impersonation Rule took effect in April 2024, the FTC has demanded the removal of more than 30 imposter websites. The rule’s own page on the government and business impersonation rule gives April 1, 2024 as the effective date and records the first enforcement case, against a student loan debt relief scheme, on June 28, 2024.

A counting difference appears in the agency’s own documents. An Oct. 29 press release on imposter scam efforts says the FTC removed 19 websites impersonating the agency after sending letters to domain registrars and other third parties, a narrower count than the alert’s figure for imposter sites generally. Christopher Mufarrige, director of the Bureau of Consumer Protection, said in that release: “Imposter scams have been the top reported fraud category over the past several years.”

The same release says the FTC has completed 14 enforcement actions since the rule took effect, producing more than $80 million in consumer redress, and sought public comment in September on whether to update the rule to cover platforms’ role in promoting impersonation scams.

The release also gives a sense of what the agency is chasing in court. It describes an alleged sham credit repair operation, Credit Glory, that impersonated debt collectors and creditors and took about $200 million from American consumers, servicemembers among them. A federal court halted it and froze its assets in August at the FTC’s request. For violations of the rule, civil penalties can reach $53,088 per violation, a figure meant to make impersonation expensive for operators who can be found. The educational side runs in parallel. In June the FTC led a public-private campaign called “Never Ever,” run through the Elder Justice Coordinating Council with the Department of Justice and the Department of Health and Human Services, and more than 140 participants helped spread its message.

The 2025 report totals behind the alert

The alert gives the scale in one sentence: more than 1 million imposter scam reports last year, with reported losses of $3.5 billion. The figure covers imposter scams as a whole, not only those using the FTC’s name, so it frames the problem rather than counting fake FTC sites. Mufarrige’s remark that imposter scams have been the top reported fraud category for several years is the context in which the agency keeps issuing alerts that sound repetitive. The repetition is deliberate, because each new variant, from a cloned site to a text carrying a photo of a badge, reaches people who never saw the previous warning.

Anyone who spots a suspected FTC impersonator or another scam is asked to file a report at ReportFraud.ftc.gov, the very address the alert holds up as an example of a genuine .gov destination.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.