FBI: Scammers Use AI, Fake Agents to Re-target Victims

On July 20 the FBI issued a public service announcement warning that criminals are posing as federal agents and using artificial intelligence to target people who previously lost money to scams. The alert identifies impersonations tied to the Internet Crime Complaint Center, known as IC3.

Scammers contact prior victims by phone, email, Facebook Messenger, Telegram, social media advertisements and online forums. Messages often include links to counterfeit websites that mimic the official IC3 portal but collect names, phone numbers, email addresses, details about the original scam and payment information.

The bureau described how attackers use AI to make their claims more convincing. Fraudsters have produced AI-generated videos and deepfakes that appear to show senior officials directing victims to submit complaints through a fake IC3 site. They also use AI-generated voices, fabricated video calls and caller ID spoofing to impersonate executives or law enforcement officers. On those counterfeit sites, users are asked to enter the scam type and an estimated loss; the site then issues a reference number and promises follow-up contact.

The bureau wrote: “Almost all complainants indicated the scammers claimed to have recovered the victim’s lost funds or offered to assist in recovering funds. However, the claim is a ruse to revictimize those who have already lost money to scams.”

Scammers may request payment in cryptocurrency, gift cards or wire transfers, or attempt to install malicious code through links they send.

Federal regulators have issued related warnings. The Federal Trade Commission notes criminals often target people who already paid another scammer and may use lists that include victims’ names, contact details and loss amounts. The Commodity Futures Trading Commission identified recovery fraud as a growing risk after cryptocurrency, foreign-exchange and investment scams.

The FBI emphasized IC3 does not operate on social media and does not charge fees to recover funds. The alert states: “IC3 does not maintain a social media presence. IC3 will never ask for payment to recover lost funds.”

Anyone who suspects they were contacted by an impersonator should report the interaction through the official IC3 website and include transaction records, phone numbers, email addresses and cryptocurrency wallet addresses when available.

The bulletin describes how attackers combine stolen victim data, synthetic media and spoofed web infrastructure to seek additional payments or sensitive information from people previously targeted by scams.