FBI warns of IC3 impersonation fraud via deepfakes

20 July 2026 routine vulnerability government-nationalfinancial-services

Scammers impersonate FBI and IC3 personnel using AI-generated deepfake videos, spoofed websites, and social media to revictimize fraud victims and steal personal or financial data.

The FBI's IC3 warns of an active fraud scheme targeting previous victims of scams. Criminal actors create fake social media profiles impersonating FBI personnel and IC3 officials, initiating contact via email, phone calls, social media advertisements, and forums with false claims of fund recovery. The scheme employs multiple tactics: fraudulent Facebook and Telegram profiles directing victims to malicious links or spoofed IC3 websites, AI-generated deepfake videos depicting senior FBI leaders promoting fake IC3 complaint portals, and social engineering combining urgency and authority to harvest personally identifiable information and financial data.

In Scheme 1, victims who threaten to report scammers to the FBI are subsequently contacted by impersonators via Facebook Messenger and Telegram, directed to links claiming to update their IC3 reports but designed to collect additional financial information. In Scheme 2, AI-generated videos on social platforms show senior FBI officials promoting spoofed IC3 websites that mimic the legitimate ic3.gov site but lack full functionality, requesting only basic information before issuing false reference numbers.

Defenders and victims should verify direct contact only through official FBI field offices, access ic3.gov by typing the URL directly, avoid sponsored search results, and scrutinize communications for subtle imperfections in deepfakes (distorted features, unnatural movements, voice lag), spelling inconsistencies, and domain spoofing. Victims should report to the legitimate IC3 site and provide detailed transaction and communication records.

Detection guidance

Suspicious Domain Access Mimicking Legitimate FBI IC3 Portal

ATT&CK T1036.005

Detects network connections to domains that closely resemble ic3.gov but deviate in structure—typical of spoofed IC3 portals used in fraud schemes. Matches subdomains or typosquatted variants while excluding the legitimate ic3.gov domain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Domain Access Mimicking Legitimate FBI IC3 Portal
description: Detects connections to domains impersonating the legitimate ic3.gov portal.
  Spoofed IC3 sites are core to this fraud scheme, directing victims to credential/PII
  harvest pages. Rule targets domain lookalikes and typosquats while whitelisting
  the legitimate ic3.gov.
tags:
- attack.defense-evasion
- attack.t1036.005
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
    - ic3
    - ic4
    - 1c3
    - i3c
    DestinationHostname|endswith:
    - .net
    - .org
    - .site
    - .top
    - .info
    - .biz
  filter_legitimate:
    DestinationHostname: ic3.gov
  condition: selection and not filter_legitimate
falsepositives:
- Typos or misremembered URLs by legitimate users
- Older cached DNS entries pointing to deregistered domains
level: medium
id: 2c5fe6f4-add1-5e38-9127-40e9199ff70e
status: experimental
author: Vorant

Social Engineering via Spoofed Messaging Platform Links to Credential Harvesting

ATT&CK T1598.003

Detects browser or email access patterns where Facebook/Telegram links redirect to credential or PII collection forms, typical of IC3 impersonation spearphishing. Identifies redirect chains from social platforms to harvesting pages. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Social Engineering via Spoofed Messaging Platform Links
description: Detects HTTP requests where Referer headers originate from social platforms
  (Facebook Messenger, Telegram) and redirect to suspicious credential/PII collection
  domains. This pattern reflects the IC3 fraud scheme's use of fake social profiles
  linking to harvesting portals.
tags:
- attack.t1598.003
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    HttpReferer|contains:
    - facebook.com
    - m.facebook.com
    - messenger
    - telegram
    DestinationHostname|contains:
    - form
    - verify
    - update
    - confirm
    - validate
    - report
    - claim
  filter_legitimate:
    DestinationHostname|startswith:
    - facebook.com
    - telegram.org
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate social platform app updates or security redirects
- User surveys or feedback forms linked from social platforms
level: medium
id: 5ce10f33-d247-5822-b01e-93a3de96fa06
status: experimental
author: Vorant

Deepfake Video Hosting Redirect via Social Platform Advertisements

ATT&CK T1608.005

Detects HTTP requests initiated from social media advertisement clicks that lead to video hosting or media domains, correlating with deepfake video distribution in this fraud scheme. Targets the pattern of sponsored ads leading to malicious media. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Deepfake Video Hosting Redirect via Social Platform Advertisements
description: Detects network connections where social media ad platforms (Facebook
  ads, sponsored posts) redirect users to video hosting or streaming domains. This
  pattern matches the IC3 fraud scheme's use of AI-generated deepfake videos hosted
  on accessible media platforms and promoted via fake social profiles.
tags:
- attack.resource-development
- attack.t1608.005
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    HttpReferer|contains:
    - ads.facebook
    - facebook.com/ads
    - instagram.com/ads
    - platform.instagram.com
    DestinationHostname|contains:
    - youtube
    - vimeo
    - dailymotion
    - rumble
    - bitchute
    - stream
    - video
  filter_legitimate:
    DestinationHostname|startswith:
    - youtube.com
    - m.youtube.com
    - vimeo.com
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate social ad campaigns linking to official corporate video channels
- Marketing agencies running lawful video promotions on social platforms
level: low
id: be691a4f-2276-5220-94fc-7e9a4174b962
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ic3.gov/PSA/2026/PSA260720

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free