CONSUMER ALERT - FBI / IC3 IMPERSONATION

The "FBI agent" in your DMs offering to recover your stolen money is a scammer, every time

On July 20, 2026 the FBI's Internet Crime Complaint Center (IC3) published public service announcement I-072026-PSA warning that criminals are posing as FBI personnel to re-target people who have already lost money to fraud. They slide into Facebook Messenger and Telegram, steer victims toward fake IC3 complaint portals, and now stage AI deepfake videos of senior FBI officials to sell the lie. Their pitch is the one promise the real FBI never makes: pay a fee, and we will get your funds back.

SB

SafeBrowz Threat Research Security ResearchJuly 23, 20269 min read

Why the FBI put out this warning

The alert, IC3 public service announcement I-072026-PSA, describes a "recovery scam." The victims are not random. They are people who have already been defrauded once, often through investment or crypto schemes, and who are desperate to claw the money back. That desperation is the opening.

Attackers pose as FBI personnel or affiliated "recovery agents" and claim they can trace and return the stolen funds. What they actually want is a second hit: more personally identifiable information, or a fresh payment dressed up as a processing fee, a tax, a bond, or an unlock charge. It is the same predatory loop that circles pig-butchering victims after the first loss, which we break down in our guide to how pig-butchering crypto scams work. The FBI's own word for it is blunt: revictimization.

If that describes you, the useful thing to know is that no legitimate agency operates this way, and the real steps never involve paying anyone; we keep them in our pillar guide, I got scammed, what to do now. This post is about the specific July 2026 FBI-impersonation wave and how to spot it before it costs you a second time.

How the fake FBI agent finds you

The first contact almost always arrives in a place the real FBI would never use: a direct message. The PSA names Facebook Messenger and Telegram specifically, though the same script travels to any chat app. Someone with a badge photo, an official-sounding title, and a case number tells you they have been assigned to your fraud complaint and can help recover what you lost.

The details are convincing on purpose: the type of scam you fell for, a real-sounding division of the Bureau, a "case ID" that looks like paperwork. Some victims are approached inside the very forums and support groups where people gather to talk about being scammed, because that is where the target audience is. Posing as an authority to force action is the oldest lever in fraud, the same one behind the Social Security "SSN suspended" calls and the fake law-enforcement arrest threats we have documented. The badge is the bait.

The deepfake videos and the fake IC3 portals

Two upgrades make the 2026 version harder to shrug off. First, the FBI warns that scammers are producing AI-generated deepfake videos of senior FBI officials appearing to endorse a particular complaint or fund-recovery process. A short clip of a face you half-recognize, saying the words you want to hear, does a lot of work on someone who has already lost their savings. We have covered how far this tooling has come in our look at the deepfake video fraud that moved 25 million dollars; the same technology now wears an FBI seal.

Second, the link. Once you engage, you are pushed toward a spoofed website dressed up as an IC3 complaint portal or a "case status" page. It asks you to confirm your identity, enter complaint details, or provide banking information so the "recovered" money can be returned. There is no recovery. The form is a harvester, collecting exactly the identity and financial data needed to defraud you again.

These portals hide behind lookalike addresses assembled from familiar fragments, names built to read as official at a glance, things like ic3-complaint-portal[.]com, ic3-case-update[.]org, or fbi-fundrecovery[.]net (shown here as plain text, not links, and defanged so they cannot be clicked). The words look right. The domain is the lie. The real complaint center is only ever at ic3.gov, a .gov address the FBI controls, and the PSA stresses that you should type it in yourself rather than trust a search result, because sponsored links and lookalikes routinely rank above or beside the genuine one.

The four things IC3 will never do

You do not need to verify a badge or trace a video. You just need to know what the real IC3 never does. The PSA spells it out, and any single one of these is enough to end the conversation.

• It has no social media presence. IC3 does not maintain accounts on Facebook, Telegram, X, or anywhere else. A profile messaging you as "IC3" or "FBI IC3" is fake by definition.
• It never messages you first. IC3 will not directly reach out to individuals by phone, email, social media, phone apps, online chat, or public forums. Real contact about a complaint comes through the process you started at ic3.gov, not an inbound DM.
• It never asks for payment to recover funds. There is no fee, tax, bond, or "unlock" charge to get your money back. The moment anyone asks you to pay to be repaid, you are being scammed.
• It never refers you to a company that wants payment. IC3 does not hand you off to a private "recovery firm" or "asset-recovery service" that charges for its help. That referral is the scam continuing under a new name.

Deepfake videos and forged case numbers cannot change any of these facts. A video of an FBI director cannot make IC3 message you on Telegram, and it cannot make a recovery fee real.

If a "recovery agent" has already contacted you

Stop the conversation and send nothing: no money, no documents, no codes. Then take three plain steps.

Verify by going to the source yourself. Open a browser and type ic3.gov into the address bar by hand. Confirm the address ends in .gov before you enter anything. Do not use a link from the message, and do not trust a search result, sponsored or not.

Report the impersonation. File a complaint about this contact at ic3.gov, including how they reached you, any usernames or numbers, and screenshots. In the US you can also report to the FTC at reportfraud.ftc.gov. If the person targeted is 60 or older, the Department of Justice runs the National Elder Fraud Hotline at 1-833-372-8311 (1-833-FRAUD-11), which the FBI points people to in this PSA.

Assume the first loss makes you a target for the next. Recovery scams exist because the same lists of prior victims get worked over and over. If you have already lost money once, our step-by-step pillar, I got scammed, what to do now, walks through freezing the damage, reporting to the right agencies, and spotting the follow-on "we can get it back" pitch, which is often the same crew or one they sold your details to. The FBI has warned about how physical this can get, too, in schemes where couriers are sent to collect cash in person.

How SafeBrowz flags the spoofed IC3 portal

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. The DM lands in a chat app. The deepfake plays in a video. Neither is something a browser extension can see or judge. What SafeBrowz sits in front of is the one moment the scam has to move into your browser: the fake IC3 or FBI portal link.

• Layer 1 - Local detection: 60+ URL patterns and a 550+ brand database run inside the extension before the page renders. A government-agency name like IC3 or FBI appearing in a hostname that is not a real .gov address trips the impersonation signal at once, with no network call needed.
• Layer 2 - API checks: the domain is cross-referenced server-side against Google Safe Browsing, PhishTank, URLhaus, ScamAdviser feeds, and a 30+ scam-TLD watchlist. Freshly registered "complaint portal" domains asking for identity and banking data surface as high-risk on those feeds fast.
• Layer 3 - AI deep scan (Premium): AI content analysis via our proxy reads the page the way an investigator would. A government-branded complaint or fund-recovery form, urgency about a case, and fields for personal and banking details, all on a domain with no relationship to the FBI, is exactly the combination that earns a danger verdict in seconds, even for a portal put up this morning that no blocklist has seen.

The honest limit: SafeBrowz cannot read a Telegram message, and it cannot tell you a video is a deepfake. Those arrive in apps a browser extension never touches. What it does catch is the spoofed portal link, the second you open it, before you type a name, a case number, or a bank detail into a page the FBI does not run. That, plus the four "IC3 never does this" rules above, is the pair that stops the second loss.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Bottom line: the FBI does not slide into your DMs, does not post recovery videos, and never charges a fee to return your money. Verify only by typing ic3.gov yourself, and put SafeBrowz on your browser so that if a "recovery portal" link ever loads, the fake page is flagged before you fill it in.

Frequently asked questions

Is the FBI agent messaging me about my scam complaint real?

No. The FBI's Internet Crime Complaint Center (IC3) has no social media accounts and never contacts individuals directly by phone, email, social media, phone apps, online chat, or public forums. If someone messages you on Facebook Messenger, Telegram, or any app claiming to be an FBI agent or IC3 recovery specialist assigned to your case, it is a scam, as the FBI warned in public service announcement I-072026-PSA on July 20, 2026. Genuine follow-up on a complaint happens through the process you began yourself at ic3.gov, not through an inbound direct message.

Can the FBI or IC3 help me recover money I already lost, for a fee?

IC3 never charges a fee to recover funds and never refers you to a company that asks for payment. Any request to pay a processing fee, tax, bond, or unlock charge in order to get your money back is a scam. Real fund recovery, where it is possible at all, works through your bank, the payment provider, and law-enforcement reporting, none of which involve paying a stranger who contacted you. Treat every "pay to be repaid" offer as fraud, no matter how official it looks.

What about the video of an FBI official endorsing the recovery process?

The FBI warned in July 2026 that scammers are creating AI-generated deepfake videos of senior FBI officials to make fake IC3 complaint and fund-recovery schemes look legitimate. A convincing video does not change the underlying rules: IC3 does not message you first, has no social media, and never charges to recover funds. A deepfake can copy a face and a voice, but it cannot make a fee real or make an inbound DM genuine. Judge the request, not the footage.

How do I file a real IC3 complaint safely?

Open a browser and type ic3.gov into the address bar yourself, and confirm the address ends in .gov before entering anything. Do not use a link someone sent you, and do not click a search result, because sponsored ads and lookalike domains often appear alongside the real one. Illustrative fakes read like ic3-complaint-portal or fbi-fundrecovery on ordinary domains, not .gov. Once on the genuine site, you can file or update a complaint with your details. If you are 60 or older, you can also call the Department of Justice National Elder Fraud Hotline at 1-833-372-8311.

Why am I being targeted again after I was already scammed once?

Because prior victims are the whole point of a recovery scam. Lists of people who have already lost money circulate among fraud crews, sometimes the same group that scammed you the first time, sometimes buyers of your details. They approach you at your most vulnerable moment, posing as law enforcement or a recovery agent who can undo the loss. Simply expecting the follow-on pitch is itself a defense.

Last updated 2026-07-23