FBI warns of IC3 impersonation fraud via deepfakes
Scammers impersonate FBI and IC3 personnel using AI-generated deepfake videos, spoofed websites, and social media to revictimize fraud victims and steal personal or financial data.
Sourceic3.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The FBI's IC3 warns of an active fraud scheme targeting previous victims of scams. Criminal actors create fake social media profiles impersonating FBI personnel and IC3 officials, initiating contact via email, phone calls, social media advertisements, and forums with false claims of fund recovery. The scheme employs multiple tactics: fraudulent Facebook and Telegram profiles directing victims to malicious links or spoofed IC3 websites, AI-generated deepfake videos depicting senior FBI leaders promoting fake IC3 complaint portals, and social engineering combining urgency and authority to harvest personally identifiable information and financial data.
In Scheme 1, victims who threaten to report scammers to the FBI are subsequently contacted by impersonators via Facebook Messenger and Telegram, directed to links claiming to update their IC3 reports but designed to collect additional financial information. In Scheme 2, AI-generated videos on social platforms show senior FBI officials promoting spoofed IC3 websites that mimic the legitimate ic3.gov site but lack full functionality, requesting only basic information before issuing false reference numbers.
Defenders and victims should verify direct contact only through official FBI field offices, access ic3.gov by typing the URL directly, avoid sponsored search results, and scrutinize communications for subtle imperfections in deepfakes (distorted features, unnatural movements, voice lag), spelling inconsistencies, and domain spoofing. Victims should report to the legitimate IC3 site and provide detailed transaction and communication records.
Detection guidance
Suspicious Domain Access Mimicking Legitimate FBI IC3 Portal
A behavioural hunt for the technique in general.
Detects network connections to domains that closely resemble ic3.gov but deviate in structure—typical of spoofed IC3 portals used in fraud schemes. Matches subdomains or typosquatted variants while excluding the legitimate ic3.gov domain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Domain Access Mimicking Legitimate FBI IC3 Portal
description: Detects connections to domains impersonating the legitimate ic3.gov portal.
Spoofed IC3 sites are core to this fraud scheme, directing victims to credential/PII
harvest pages. Rule targets domain lookalikes and typosquats while whitelisting
the legitimate ic3.gov.
tags:
- attack.stealth
- attack.t1036.005
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains:
- ic3
- ic4
- 1c3
- i3c
DestinationHostname|endswith:
- .net
- .org
- .site
- .top
- .info
- .biz
filter_legitimate:
DestinationHostname: ic3.gov
condition: selection and not filter_legitimate
falsepositives:
- Typos or misremembered URLs by legitimate users
- Older cached DNS entries pointing to deregistered domains
level: medium
id: 2c5fe6f4-add1-5e38-9127-40e9199ff70e
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ic3.gov/PSA/2026/PSA260720
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs