The Fake FBI Agent in Your DMs: The IC3 Impersonation Recovery Scam

The message usually lands within a few weeks of the worst day. The money is gone, the bank has said the thing banks say, and then a stranger appears with the one sentence you have been aching to hear: we found it, and we can get it back. Sometimes it is a warm note in a Facebook group for fraud victims. Sometimes it is a phone call. Lately it is a short video of a familiar-looking FBI official, looking straight into the camera, telling you to file at a website that looks exactly like the government's.

None of it is real. On July 20, 2026, the FBI issued a public service announcement updating an earlier warning about scammers impersonating the IC3. The update is blunt about what changed: the crooks now stitch together three tricks at once — they hunt people who were already defrauded, they generate deepfake videos of FBI leadership, and they stand up spoofed complaint sites that harvest whatever you type in. Each piece exists to hand you a false sense of safety at the exact moment you are desperate for one.

If you have read our guide to recovery scams, the second con that hunts people who were already scammed, this is that playbook with an AI upgrade. The bones are the same. The face on the screen is new.

Six signs the “FBI agent” who contacted you is a scammer

Before the deep dive, here is the fast version. Any one of these is enough to walk away. Two or more, and you are certainly being worked.

1. They contacted you first — by DM, text, phone, or a video that showed up in your feed. The real IC3 does not reach out on social media or messaging apps at all.
2. They already know you were scammed. That detail came from a resold victim list or a support group they quietly joined, not from a case file.
3. They promise to recover your money, especially in exchange for a fee, a “tax,” a “retainer,” or a “release” payment.
4. They “prove” themselves with a video call, a photo of a badge, or an official-looking reference number. All three are cheap to fake.
5. They move you to Telegram, WhatsApp, or Messenger and send a link to “update your IC3 report.”
6. They manufacture urgency — act now or the recovered funds are lost forever. Real investigations do not run on a countdown clock.

What the FBI actually described on July 20

The new alert is an update to a warning the IC3 first published in April 2025, and it lays out two concrete variants investigators are seeing. They are worth reading closely, because the details are the tells.

Variant one: the handoff from “I’ll report you” to “I’m the FBI”

In the first pattern, the timing is the weapon. A victim mid-scam finally catches on and tells the original scammer, in so many words, that they are going to report this to the FBI and file an IC3 complaint. Shortly after, an “FBI agent” reaches out on Facebook Messenger. The conversation shifts to Telegram, and the agent sends a link to “update” the report that was supposedly filed. That link, in the FBI’s words, “may contain malicious code or may be used to collect more financial data to revictimize the person.”

Sit with how tight that loop is. The same crew that took your money is listening when you threaten to report them, and they use your own threat as the cue to introduce the next character. You think you are escalating to the authorities. You are being handed from one desk of the same operation to another. It is the same choreography behind the jury-duty and arrest-warrant scams, where the “officer” on the line is the whole show.

Variant two: the deepfake video and the near-perfect fake site

The second pattern is the one that makes this story a 2026 story. Scammers post AI-generated videos on social platforms showing a senior FBI official urging viewers to submit complaints at an IC3 site. The site looks right. It borrows the structure and content of the real one closely enough that a shaken person will not notice the difference.

But there is a giveaway baked into how it behaves. The FBI notes that on the spoofed site, only the complaint form works — click any other link and you bounce back to the home page. And the intake is wrong in a specific way: instead of the real IC3’s detailed process, the fake form is a single step asking for just your name, phone number, email, scam type, and estimated loss. Submit it and you get a reference number and a promise that someone will be in touch. What you actually did was hand a criminal a tidy profile of a fresh, hopeful, already-verified victim.

Why it works on people who “know better”

It is tempting to read all this and think you would never fall for a fake badge. Most of the people who do fall for it thought the same thing a month earlier. The recovery scam is not aimed at gullibility. It is aimed at hope, and hope is not a character flaw.

Three levers do the work. The first is authority: a badge, a government seal, a video of someone who looks like a real official. We are trained from childhood to comply with law enforcement, and scammers rent that reflex. The second is timing. Grief from a fresh loss narrows your thinking, and a person who is still raw will extend trust they would normally hold back. The third is the sunk cost of the money already gone — the more you lost, the more a shot at getting it back is worth, and the more a “small” release fee feels like a rational bet. We break these levers down in detail in our piece on the psychology scammers use to persuade you.

Add convincing AI to that mix and the last practical defense — “it looked fake” — stops being reliable. The FBI’s own guidance now leans less on spotting a bad video and more on refusing the premise: the real agency does not work this way, so the channel is the tell, not the face. That is the same lesson from AI voice-cloning scams, where a cloned voice of your own child is close enough to real that the only safe move is to hang up and call back on a number you already trust.

The tells, when you still want to look

You should not have to grade a video to protect yourself, and the channel rule below is stronger than any visual check. But the FBI does list what to watch for, and it is useful to know, because you may be helping a relative who has already engaged.

• Hands, feet, and edges. Deepfakes still struggle with distorted hands, warped accessories like glasses or jewelry, and shadows that fall the wrong way.
• Sound that lags the mouth. On a live “video call,” watch for a delay between the lips and the audio, or a voice that is a shade too smooth. AI voice cloning can sound nearly identical to a real person, so trust the lag, not the timbre.
• A URL that is almost right. Scammers rely on small alterations — an extra word, a different ending, a look-alike domain. The real site is exactly www.ic3.gov and ends in .gov.
• Anything that spikes your pulse. The FBI’s advice is to be wary of content built to trigger anger, fear, or disbelief, and to verify through official channels before you react.

What to do if an “FBI agent” contacts you

Whether it is happening to you or to someone you are trying to help, the moves are the same, and none of them require confronting the scammer.

1. Do not pay, and do not click. No fee, no “tax,” no gift cards, no crypto, no bank details, and no link they sent. Everything they need from you happens through one of those.
2. Break contact without a fight. You do not owe a scammer an explanation. Stop replying, and do not try to bait or expose them — it just confirms you are engaged.
3. Reach the real IC3 yourself. Open a new browser tab and type www.ic3.gov by hand. If you search instead, skip any result labeled “sponsored,” which the FBI warns are often paid imitators.
4. Verify anyone claiming to be an agent independently. Real FBI contact comes from a local field office, not a Facebook profile. Look up that field office’s public number and call it. Never use a number the contact gave you.
5. Screenshot everything first. Before you block, save the profile name, phone numbers, URLs, payment requests, and any reference number. That detail is exactly what the IC3 asks for in a report.
6. Tell one other person. Saying it out loud to a trusted friend or family member breaks the private, pressured bubble the scammer depends on — and a second set of eyes catches what stress hides.

Not sure which of these applies to your situation? Our free “I’ve been scammed — what now?” tool walks you to a tailored next-step plan in a couple of minutes, and you can report what the “agent” sent you to help warn the next person.

How to report fraud for free — and get a human

Reporting is always free, and you never need a middleman to do it. If a “recovery” contact insists on filing on your behalf for a fee, that is the scam confirming itself.

• FBI IC3: type www.ic3.gov into your browser and file directly. Include as much detail as you can — who contacted you, how, what they asked for, and any payment or account information.
• FTC: report at reportfraud.ftc.gov. If your Social Security number or identity was exposed, use identitytheft.gov for a recovery plan. (Our guide on what to do if you gave your SSN to a scammer walks through that.)
• Talk to a real person: the AARP Fraud Watch Network Helpline is 877-908-3360, and it is open to people of any age, not just AARP members.
• Help for older victims: if the person targeted is 60 or older and needs help filing an IC3 complaint, the Department of Justice Elder Justice Hotline is 833-372-8311 (833-FRAUD-11).

One caution worth repeating, because it is where the second loss usually happens: private “fund recovery” and “crypto tracing” firms that find you online are, with very few exceptions, the scam wearing a suit. Real recovery, when it happens at all, runs through your bank, the courts, and law enforcement — not a company in your DMs. The same warning applies to the in-person twist we covered in crypto courier cash-pickup scams, where the “agent” sends someone to your door.

Protect the person most likely to get the call

Here is the uncomfortable part. The people at highest risk for the recovery scam are, almost by definition, people who were recently scammed — which may include someone in your family right now, whether or not they have told you. Anyone who lost money to a pig-butchering crypto scam, a romance scam, or an investment con is already on a list, and the follow-up call is coming.

Reading an article is not the same as being ready. The gap between “I know these exist” and “I caught it while my pulse was pounding” is a gap you close by practicing, not by knowing. Workplaces learned this years ago: people reliably spot a phish only after they have safely failed one in a low-stakes drill. The same trick works at the kitchen table. A few gentle, realistic simulations — including the “we can recover your funds” pitch — build the half-second pause that no headline can. We make the full case in our family simulation guide.

The whole thing in one line

If anyone contacts you first and offers to recover money you lost — a badge photo, a video of an FBI official, a link to “update your report,” a small fee to release your funds — it is the second scam, every time. The real IC3 has no DMs and no fees. Save that one rule, send this to the person in your life most likely to get the call, and the deepfake loses the only thing it was ever running on.