Lost money to a scam? FBI warns about recovery scams

The FBI has issued a new alert to warn consumers that criminals are impersonating FBI employees and the Internet Crime Complaint Center (IC3) in an increasingly sophisticated recovery scam.

Instead of targeting random victims, these scammers go after people who lost money in previous scams. They promise to recover stolen funds, then use fake FBI identities, AI-generated videos, spoofed government websites, social media accounts, and malicious links to steal even more personal and financial information.

Key takeaways

• The FBI warns that criminals are impersonating FBI personnel and the Internet Crime Complaint Center (IC3).
• Victims of previous scams are being targeted with fake "fund recovery" offers.
• Fraudsters are using AI-generated videos, cloned voices, fake government websites, malicious links, spoofed phone numbers, and fake social media accounts.
• The goal is to steal more money or collect additional personal and financial information.
• IC3 does not have social media accounts, does not communicate with victims through messaging apps, and never charges fees to recover stolen money.

How the scam works

Recovery scams are a cruel form of online fraud because they rely on revictimizing people who have already fallen for an investment scam, romance scam, fake online store, cryptocurrency fraud, or another scheme.

The FBI says scammers contact victims through multiple channels, including phone calls, emails, instant messaging apps such as Facebook Messenger and  Telegram, social media ads and online forums.

Most victims are told the same lie: that their lost money has been recovered or that they will be offered assistance in recovering their losses.

“Almost all complainants indicated the scammers claimed to have recovered the victim's lost funds or offered to assist in recovering funds,” the FBI said. “However, the claim is a ruse to revictimize those who have already lost money to scams.”

The fraudsters claim to work for the FBI, IC3, or another government agency investigating online crime.

Victims are then encouraged to:

• Verify their identity
• Submit banking information
• Provide copies of government-issued identification
• Click links to "update" an existing complaint
• Pay taxes, processing fees, or administrative costs before recovered funds can be released

In reality, no money has been recovered, and the entire process is designed to steal even more sensitive information or persuade victims to send additional payments.

Scam tactic #1: Fake FBI agents contact victims on social media

One scheme highlighted by the FBI begins after a victim tells the original scammers they intend to report the fraud. Soon after, someone posing as an FBI agent contacts the victim through Facebook Messenger before moving the conversation to Telegram.

The impersonator sends what appears to be a link for updating an existing IC3 complaint.

Instead of reaching the FBI, victims are directed to malicious websites that either install malware or collect additional personal and financial information. Because the contact arrives shortly after the original scam, many victims genuinely believe they're speaking with investigators.

Scam tactic #2: AI-generated FBI videos promote fake complaint websites

The FBI also identified scammers using AI-generated videos featuring senior FBI officials.

In these deepfake videos, the fake officials encourage victims to submit complaints through what appears to be the official IC3 website. The spoofed website closely resembles the real one but only includes a simplified complaint form requesting:

• Full name
• Phone number
• Email address
• Scam type
• Estimated financial losses

After submitting the form, victims receive a fake reference number and are told someone will contact them.

That follow-up comes from the scammers themselves.

Scam tactic #3: Fake websites designed to steal your information

Another tactic involves creating websites that closely mirror the real IC3 complaint portal.

These websites copy official branding, layouts, and government language to convince visitors they are interacting with a legitimate federal agency. Unlike the genuine IC3 website, however, these fake pages only allow users to submit personal information. Most other links don't work or simply redirect visitors back to the homepage.

Scam tactic #4: AI voice cloning and fake video calls

The FBI warns that AI isn't only being used to create convincing videos.

Criminals also use AI-generated voices during phone calls and video chats to impersonate government officials, company executives, or other trusted figures.

Some victims receive prerecorded video messages intended to prove the person they're communicating with is "real." Others participate in live video conversations where AI-generated content makes the impersonation appear increasingly convincing.

Scam tactic #5: Sponsored search results and fake government websites

The FBI also warns consumers to be cautious when searching online for the IC3 website.

Cybercriminals frequently purchase sponsored advertisements that appear above legitimate search results, hoping victims will click fake websites instead of the official government portal.

Rather than searching for the FBI or IC3 online, type www.ic3.gov directly into your browser and always confirm that the website ends in .gov.

Red flags to watch for

Be suspicious if someone claiming to represent the FBI or another government agency:

• Contacts you through Facebook, Telegram, WhatsApp, or another messaging app
• Promises they have recovered your lost money
• Asks for payment before releasing funds
• Requests cryptocurrency, gift cards, or wire transfers
• Sends links to complaint forms or account verification pages
• Pressures you to act immediately
• Asks you to keep the conversation confidential

How to protect yourself

According to the FBI:

• IC3 does not maintain social media accounts.
• IC3 will never contact victims through Facebook, Telegram, WhatsApp, or similar platforms.
• IC3 never requests payment to recover stolen funds.
• Always type www.ic3.gov directly into your browser instead of clicking links or sponsored search results.
• Verify that government websites end in .gov before entering any personal information.

For additional protection, we recommend using several layers of verification before responding to unexpected recovery offers.

If you receive a suspicious email, message, website, or social media profile claiming recovery of your money, Bitdefender Scamio can help assess whether it is part of a scam. Before visiting unfamiliar websites, Bitdefender Link Checker lets you verify URLs for signs of fraud. If you encounter a video that appears to feature a government official or another trusted figure, Bitdefender RealCheck for Android and iOS can help identify whether the content may have been generated or manipulated using AI.

Recovery scams often combine several tactics, including phishing emails, malicious links, fake websites, social media messages, AI-generated content, and requests for remote access to a victim’s device. That is why layered security is increasingly important. Bitdefender Scam Protection Pro combines tools that help identify suspicious content, block scam websites, detect threats in emails, texts, chats, notifications, and calendar invitations, and warn users about emerging scam campaigns. Remote Access Scam Protection also monitors remote-access applications on Windows devices and warns users when they are about to access online banking or financial services while one of these tools is running in the background, helping prevent scammers from exploiting remote-control software to steal money or sensitive information.

These protections are available as part of our all-in-one security suites you can check out here.

What if you've already been targeted?

If you believe you've been contacted by someone impersonating the FBI or IC3:

• Stop communicating with the individual
• Do not send additional money or personal information
• Save screenshots, emails, URLs, cryptocurrency wallet addresses, and any payment records
• Contact your bank immediately if you've shared financial information
• Report fake social media accounts to the platform where you found them
• If you're in the United States, report the incident directly through the official IC3 website at www.ic3.gov

Stay Safe!