Fake “FBI Agents” Target Scam Victims in DMs

Malwarebytes · Medium sophistication
Last updated July 30, 2026

The FBI’s IC3 warns that scammers are impersonating FBI/IC3 staff on social media and messaging apps, especially targeting people who have already been scammed. The criminals use convincing branding (logos, fake reviews) and may even use AI-generated deepfake videos to pressure victims into clicking a link or paying money to “recover” funds.

How the attack works

According to the FBI's Internet Crime Complaint Center (IC3), scammers are impersonating FBI agents and IC3 employees on social media and messaging apps. The primary targets are people who have already been victims of a scam, since they're actively looking for a way to recover their losses and are emotionally primed to trust anyone who claims they can help.

Attackers set up fake IC3 accounts and recovery-service pages that use FBI logos, official-looking branding, and fake reviews to appear legitimate. They also monitor social media for posts where victims mention being scammed or planning to report to the FBI, then reach out directly, posing as an FBI follow-up contact. In some cases, criminals go further and produce AI-generated deepfake audio or video of senior FBI officials or recognizable public figures, urging the victim to submit their case through a specific link to speed up recovery.

Why this pretext succeeds

This works because it targets people at a moment of high stress and low judgment: they've already lost money and want resolution fast. The scam layers multiple credibility signals, official branding, fake reviews, urgent follow-up timed right after a public post, and now deepfake video, to overcome healthy skepticism. Victims may not know that IC3 has no official social media presence and never contacts people directly to recover funds, so the impersonation isn't obviously implausible to them.

What to watch for

  • An unsolicited DM from an "agent" appearing shortly after you post publicly about being scammed or reporting to the FBI
  • Recovery pages or messages using FBI/IC3 logos and branding to appear official
  • Pressure to act quickly, especially through phrases about "speeding up recovery"
  • Requests for upfront payment to recover stolen funds
  • Video or audio messages claiming to be from senior officials directing you to a specific link

Building resistance

  • Treat any FBI or IC3 contact made through social media or DMs as suspicious, and verify independently through official channels rather than replying in the DM
  • Never pay upfront fees to anyone claiming they can recover stolen money; legitimate agencies do not ask for advance payment
  • Don't hand over passwords, recovery phrases, IDs, or financial details to unsolicited "recovery" contacts, and don't grant remote device access
  • Be skeptical of AI-generated video or audio pushing you toward a specific link, especially when it invokes urgency around "recovery"
  • Remember that IC3 does not investigate crimes via social media, so any agency claiming otherwise should be treated as a scam until proven legitimate

Key findings

  • Scammers impersonate FBI agents and IC3 employees on social media and messaging apps, targeting people who have already been victims of cybercrime.
  • Recovery-scam pages use FBI logos/branding and fake reviews to look legitimate and pressure victims into paying for “recovery assistance.”
  • Attackers monitor social media for posts from victims who say they reported a scam to the FBI, then contact them posing as FBI follow-up.
  • Criminals may use AI-generated deepfake audio/video of senior FBI officials or public figures to push victims to submit a case through a specific link.
  • IC3 states it has no official social media presence and will not contact victims directly to recover funds or request money.

Who’s being targeted

  • Commonly targeted roles: All Employees, Finance, Executives, Customer Support, Social Media/Communications.
  • Affected industries: General public/consumers, Finance/crypto investors (victim population).
  • Attack channels: website, email, facebook.
  • Impersonated: IC3 / FBI-affiliated ‘recovery’ team (e.g., “Reliable Scam Recovery Inc / Ic3 Scam Recovery Inc”), FBI agent / IC3 employee, Senior FBI officials or other recognizable public figures.

Red flags to watch for

  • Promises of fund recovery with no verifiable case details (“experienced recovery team”, “trace transactions”)
  • Uses government-style branding/logos to appear official
  • Urgency/pressure to take action to ‘reclaim losses’
  • Unsolicited outreach immediately after a public post about being scammed
  • Claims to be law enforcement contacting you via social media
  • Attempts to move the conversation to providing sensitive info or payment
  • A video claiming to be a senior official asking you to use a specific link
  • Pressure/urgency language like “to speed up recovery”
  • Unexpected channel for law-enforcement instructions (social media/video link)
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo

Frequently asked questions

How do scammers impersonate the FBI or IC3 online?

They set up fake IC3 accounts and recovery-service pages using FBI logos and branding, and monitor social media for people who post about being scammed, then contact them directly claiming to be FBI follow-up agents.

Does the FBI or IC3 ever contact victims through social media?

No. IC3 has no official social media presence, does not investigate crimes via social media, and will never contact victims directly to recover funds.

What are the warning signs of a fake recovery scam?

Watch for unsolicited DMs right after posting about being scammed, promises to recover stolen funds, requests for upfront payment, and pressure to click a specific link, sometimes reinforced by AI-generated deepfake videos of officials.

Should I ever pay someone claiming they can recover my stolen money?

No. Legitimate government agencies never ask for advance payment to recover stolen money, so any such request is a red flag.

Read the video transcript

You post on Facebook that you got scammed… minutes later, a “FBI agent” slides into your DMs offering to get your money back. They send a slick “Ic3 Scam Recovery Inc” page with FBI logos, five‑star reviews, and maybe even a deepfake video of a senior FBI official telling you, “Have you been scammed or defrauded? We’re here to help. Click our link.” Here’s the catch: IC3 has zero official social media. They will not DM you, they will not ask for upfront “recovery” fees, and they will not push you to a special link to get your money back. If anyone claiming to be FBI or IC3 contacts you on social media about “recovery,” don’t engage, go to ic3.gov or your usual internal channels and verify it yourself.

Similar attacks

TikTok Resin Art “DM to Order” Scam

TikTok Resin Art “DM to Order” Scam

Scammers on TikTok are impersonating resin artists by reposting stolen videos and telling viewers to “DM to order.” After moving the conversation into direct…

July 24, 2026
Fake FIFA Ticket Sites Steal Cards and OTPs

Fake FIFA Ticket Sites Steal Cards and OTPs

Researchers and the FBI warn that criminals are luring World Cup fans to convincing fake FIFA ticket websites, often via social media ads and shared links. The…

July 16, 2026