Deepfake FBI Videos Push Victims to Fake IC3 Sites

How the attack worked

The scheme relies on impersonating a trusted authority, the FBI and its Internet Crime Complaint Center (IC3), to re-victimize people who had already filed or discussed a fraud complaint. In one variant, a fraud victim who mentioned filing an IC3 complaint was contacted on Facebook Messenger by someone posing as an FBI agent, who supplied a link to update the report. The link either carried malicious code or collected further financial details.

A second variant used AI-generated videos of a senior FBI leader urging users to file complaints on a spoofed IC3 site. The fake portal mimicked the real ic3.gov but stripped the complaint workflow down to a single form requesting name, phone number, email, scam type and estimated financial loss. After submission, the site issued a reference number and promised follow-up, at which point the operators harvested further data. A third variant involved live video calls using AI to impersonate executives or officials, aiming to extract credentials or financial records directly.

Why it succeeded

Messages appearing to come from the FBI carried disproportionate weight in a phishing context, making targets less likely to question the request. Prior fraud victims were especially vulnerable because they were already expecting follow-up communication about their case, and the promise of recovering lost funds added emotional pressure. The use of deepfake video added a layer of visual credibility that text-based phishing lacks, making authority claims feel more legitimate at a glance.

What to watch for

• Outreach claiming to be from the FBI or IC3 that arrives via social media messaging rather than official channels
• Links asking you to "update" a complaint instead of directing you to navigate to a known official site yourself
• Deepfake video indicators such as distorted hands, unrealistic accessories, inaccurate shadows and voice-call lag
• Forms requesting sensitive personal or financial details beyond what a normal complaint process would need
• Any request for payment to "recover" previously lost funds

How to build resistance

Organizations should treat law enforcement outreach as a high-risk impersonation scenario and train employees to verify independently through known official channels rather than links supplied in messages. IC3 said it does not maintain a social media presence and never requests payment to recover lost funds, so staff should be reminded that recovery offers are a common follow-on fraud tactic. The Bureau urged users to type ic3.gov directly into the address bar, avoid sponsored search results and verify that any IC3 URL ends in a .gov domain. Finally, awareness training should include deepfake indicators so employees pause and verify before acting on video-based authority cues, particularly in finance, HR, and executive roles where credential or financial requests are more consequential.

How are scammers using deepfake videos in this IC3 impersonation scheme?

Scammers create AI-generated videos of a senior FBI leader urging people to file complaints on a spoofed IC3 site, and also use AI video in live calls to impersonate executives or officials.

What happens on the fake IC3 portals?

The fake portal mimics the real ic3.gov but reduces the process to a single form collecting name, phone number, email, scam type and estimated financial loss, then issues a reference number and promises follow-up while harvesting more data.

Does the FBI or IC3 ever contact victims through social media?

No, IC3 said it does not maintain a social media presence and never requests payment to recover lost funds, so any outreach via Facebook, Telegram or phone claiming otherwise should be treated as fraudulent.

What should someone do instead of clicking a link claiming to be from IC3?

The FBI urged users to type ic3.gov directly into the address bar, avoid sponsored search results, and verify that any IC3 URL ends in a .gov domain.