The FBI warns scammers are now posing as its own IC3 agents to hit fraud victims a second time

Criminals are impersonating the very federal service fraud victims use to seek help. A July FBI warning says scammers pose as agents or Internet Crime Complaint Center personnel, offer recovery assistance and direct targets to fake websites or private messaging channels. The approach can steal more money and personal information from someone already harmed once.

The updated scheme uses official-looking profiles, spoofed pages and AI-generated videos to manufacture authority. Its defense begins with independently reaching the real government site rather than following a link supplied by a stranger.

Recovery offers target a moment of vulnerability

After a financial loss, victims may search social media, forums and advertisements for help. Criminals enter those spaces pretending to be fellow victims, investigators, lawyers or recovery specialists.

Their message promises that funds have been located or that a complaint can be advanced for a fee. The fraud works because it offers hope and insider access when normal recovery channels feel slow or uncertain.

Fake IC3 pages collect a second set of secrets

The FBI.s July 20 public-service announcement records the July 20 warning about IC3 impersonation. Spoofed pages can request a name, address, account information, complaint number or identity documents under the appearance of a federal form.

Some links may also deliver malicious software. Even a page that forwards visitors to a real government site can collect information first or use the legitimate destination to strengthen its disguise.

Deepfake videos borrow authority at low cost

Scammers can generate a video resembling a senior official and place it in an advertisement or social post. Matching logos, captions and a cloned voice make the content feel more deliberate than a simple phishing email.

Visual polish is not authentication. A government message should be verified through an independently typed federal domain, and a purported official’s identity should be checked through a known field-office number.

IC3 is a reporting portal, not a fund-recovery service

The real IC3 website accepts internet-crime complaints and helps the FBI analyze patterns and refer cases. It does not charge a fee to recover stolen funds or operate social-media support accounts that solicit victims.

A local FBI office or another investigator may contact a complainant for more information. That possibility does not make an unexpected message genuine. Independent callback through a published number separates verification from the channel controlled by the caller.

Private messaging is a warning sign

Impostors often move conversations to Telegram, WhatsApp or direct messages, where profiles are easy to create and oversight is limited. They may demand cryptocurrency, gift cards, wire transfers or a “release fee.”

No legitimate recovery becomes more credible because payment is urgent or irreversible. Pressure to keep the process secret, avoid a bank or stop speaking with family is designed to isolate the target from a second opinion.

Evidence from the first scam can protect the second report

Victims can preserve emails, profile names, phone numbers, wallet addresses, transaction records and screenshots. Banks or payment services should be contacted quickly because some transfers can be frozen or recalled.

A new complaint should identify the recovery approach as a separate incident and link it to the original fraud. Repeated contact may show that criminals share victim lists or that the original group is attempting another extraction.

Verification should happen outside the conversation

Typing the federal address directly, avoiding sponsored search results and checking that the domain ends in .gov reduce spoofing risk. Contact information inside a suspicious email, video or website should not be used to verify itself.

The scam’s psychological trick is to make authority appear to arrive without being sought. Real protection reverses that flow: the victim selects the official channel, initiates contact and refuses payment demanded by an unverified helper.

Search advertising can place an impostor first

A sponsored result may appear above the genuine government page. Criminals can buy ads for recovery terms or build addresses that differ from the real domain by one letter, an added word or a different ending.

Bookmarks and direct typing reduce that risk. A browser’s lock icon shows that a connection is encrypted; it does not prove the organization behind a deceptive domain is legitimate.

Banks and investigators play different recovery roles

IC3 collects and analyzes complaints, while a bank, card issuer or payment platform may have the fastest ability to stop a transfer. Local police can create a report needed by an insurer or financial institution. No single channel replaces the others.

Speed matters most for recent payments. A wire recall or account freeze becomes harder after funds move through additional accounts or convert to cryptocurrency. A victim should not delay contacting a financial provider while waiting for an online “agent” to reply.

Shame helps the second scammer

Fraud victims may avoid family or authorities because the first loss feels embarrassing. Recovery scammers exploit that isolation by promising discretion and portraying skepticism as a threat to reimbursement.

Involving a trusted person can interrupt urgency and catch contradictions. The first loss does not imply poor judgment; professional operations test scripts on thousands of targets and use information from earlier fraud to personalize the next approach.

Reporting the second attempt remains useful even when no additional money was sent. Profiles, domains and payment instructions can connect cases, support takedowns and warn other victims before they engage.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview