The FBI Says Scammers Are Deepfaking Its Own Agents to Rob People Twice

The people getting scammed twice are the ones who already reported it

On July 20, 2026, the FBI issued a warning about a scam that finds people at their lowest moment, right after they have lost money to fraud. The approach arrives as a lifeline. Someone claiming to be an FBI agent offers to help recover the stolen funds, or a video of a senior FBI official appears online urging victims to file a complaint through an official-looking site. The agent is invented. The video is a deepfake. The recovery site is a forgery.

The alert, catalogued as IC3 Public Service Announcement I-072026-PSA, matters less for any single dollar figure than for what it signals. Cloning the one institution people turn to after being robbed used to take real effort. It is now cheap, fast, and convincing. What follows is how the scheme actually works, and the single habit that defeats every version of it.

How the scam works

The warning comes from the FBI's Internet Crime Complaint Center (IC3, the bureau's official website for reporting online fraud) and updates an earlier notice from April 2025. The targets are chosen with care: people who have already been defrauded, or who have said out loud, often on a public forum, that they plan to file an IC3 report. That detail is the whole game. A fresh victim is anxious, out of pocket, and desperate for a way to claw the money back, which is exactly the state of mind a recovery scam is built to exploit.

The FBI describes two main variants. In the first, a supposed agent contacts the victim on Facebook Messenger, then moves the conversation to Telegram, and sends a link to "update" their IC3 complaint. The link either installs malicious code or collects more financial detail to set up a second theft. In the second, attackers circulate an AI-generated video, a deepfake, of a senior FBI official telling people to file through what looks like the real IC3 site. The spoofed page copies the appearance of ic3.gov but does almost nothing: it offers a single form asking for a name, phone number, email, scam type, and estimated loss, and every other link simply loops back to the home screen. Submit the form and you receive a reference number and a promise of follow-up. Both are props. In some versions the criminals also use voice cloning, feeding a short audio sample into an AI model so it can speak in a known official's voice on a call.

• The scheme targets people who have already reported fraud or announced their intent to, reaching them by email, phone call, and social media messages or advertisements.
• The fake IC3 sites harvest personal and financial data through a one-step complaint form, then issue a bogus reference number to keep the victim waiting rather than suspicious.
• The FBI stresses that IC3 has no social media presence at all, never contacts people first by phone, email, or chat app, and never asks for a payment to recover lost funds.

Why it matters

The immediate harm falls on people who can least absorb it: fraud victims who lose a second round of money or surrender the personal data, their name, contact details, and the exact sum they lost, that makes the next attack sharper. For an organisation, the exposure runs two ways. Any executive or official whose face and voice appear in public, on a webinar, an earnings call, or a conference stage, can now be deepfaked into endorsing a fraudulent site, which turns your brand and your leadership into bait you never agreed to provide. Your own people are targets too. If a member of your finance team, or a customer just defrauded by a fake invoice, gets a call tomorrow from a calm recovery agent who already knows the details of the loss, the pretext will feel earned. The wider shift is that the trust we place in institutions has itself become the raw material of the attack. This scam does not break a system. It borrows the credibility of the FBI, wraps it in synthetic media that is getting harder to spot, and aims it at the moment a person is most willing to believe help is on the way.

What to do about it

1. Treat any unsolicited offer to recover lost funds as the scam itself. IC3 never reaches out first and never charges to get money back, so an approach of that kind is fraudulent by definition, however official the caller, the badge, or the video appears.
2. Reach the agency by typing the address yourself. Enter www.ic3.gov directly into the browser, skip sponsored search results, and confirm the domain ends in .gov before entering anything, because the spoofed sites only work if you arrive through a link somebody handed you.
3. Verify the person, not the face or the voice. Confirm any official contact through a known, published channel before you act, because deepfake video and cloned audio can now reproduce a face or a voice well enough that the old tells, distorted hands, mismatched shadows, a lag on a voice call, no longer reliably give the fake away.

Bottom line

This is a second wave, aimed at the people the first wave already hit, and its power comes from timing rather than clever code. It offers rescue to someone who just lost money, in the voice of an agency they are inclined to trust, using video and audio that a year ago would have cost far more to fake. The defence is unglamorous and it holds: no legitimate authority initiates contact to recover your money, and the only safe way to reach the IC3 is an address you typed yourself. Worth raising at your next security meeting, and worth passing to any customer or colleague who has just been burned. The help that finds you first is the part to distrust. FBI IC3 Public Service Announcement I-072026-PSA lists the reported variants and warning signs.