THE FBI’s Internet Crime Complaint Center has issued a warning that criminals are using deepfake technology to impersonate its agents on social media and messaging apps, targeting individuals who have previously reported cybercrime according to its latest public service announcement. These fake profiles promise to help recover lost funds in exchange for upfront payments or personal data.
The scammers create AI‑generated video clips that appear to show IC3 officials speaking directly to the victim, often accompanied by spoofed websites that mimic the look of the official IC3 portal. Malwarebytes reported that the fake agents often appear in direct messages offering recovery services for a fee as detailed in their analysis.
Victims receive unsolicited direct messages that include a link to a fraudulent site where they are urged to file a new complaint or provide banking details to facilitate restitution. The deepfake lends credibility to the request, making it harder for recipients to discern the scam from legitimate communication.
The IC3 alert notes that the activity is currently underway and has already led to several reported losses, although no specific threat actor group has been named. Infosecurity Magazine noted that the deepfake clips are paired with spoofed IC3 domains designed to harvest credentials in its coverage.
Users should treat any unsolicited contact claiming to be from the FBI or IC3 with suspicion and never transfer money or share passwords based on such messages. Instead, they should independently visit the official IC3 website by typing the address directly into their browser and use the contact information published there to verify any claims. Reporting the encounter to IC3 helps the centre track and disrupt the operation.
Organisations can reinforce defence by running regular awareness programmes that highlight the signs of deepfake impersonation and by monitoring social media for brand‑abuse accounts. Implementing email authentication controls such as DMARC and encouraging staff to use verified channels for sensitive requests further reduces the risk of successful fraud.