Scammers Are Posing as FBI Agents to Re-Scam Victims

The Setup

Most scams target strangers. This one targets people who are already hurting.

The FBI's Internet Crime Complaint Center (IC3) is a real federal agency. Millions of Americans use it to report online fraud. Scammers have figured out that people who file those complaints are proven targets. They've already been victimized once. They want their money back. They trust the government to help.

So the scammers call them, pretending to be IC3 agents.

How the Scam Works

The setup is convincing. Callers spoof real FBI phone numbers, so your caller ID shows a legitimate federal number. They use real agents' names, sometimes pulled from public FBI directories or news coverage. They may reference details from your original complaint.

Then comes the ask. Sometimes they want an upfront "recovery fee" to release your stolen funds. Sometimes they want your Social Security number, bank account details, or identity documents to "verify your claim." Either way, the goal is the same: take more from someone who has already lost.

The FBI issued a formal public warning about this scheme in 2026, confirming the pattern. The agency was direct in its advisory: the real IC3 will never contact you proactively and will never ask for money or personal information over the phone.

Why It Works

Spoofed caller ID takes minutes and costs almost nothing. When your phone shows "FBI Washington DC" with a number that checks out on a quick search, the natural instinct is to trust it.

Voice matters too. These callers are practiced. They know the right terminology. They sound calm, official, and helpful. They know you're frustrated and desperate, and they meet you there.

There is no secret handshake, no visual cue, no obvious tell. A real federal agent and a skilled impostor can sound identical on a phone call.

The Callback Problem

A common piece of advice is to hang up and call back on a number you find yourself. That's a good instinct, but it has a limit worth understanding.

If you hang up and call the real IC3, you'll reach the real agency. But that doesn't tell you whether the person who originally called you was legitimate or a scammer. The original call still happened. Hanging up and verifying through an official channel confirms the institution exists. It doesn't verify the individual.

For any caller claiming to represent an institution, always use a number from that institution's official website, a government-issued card, or a statement. Never call back a number the caller gave you. If you believe someone is in immediate danger or a crime is actively in progress, contact local authorities directly.

What the FBI Actually Does (and Doesn't Do)

The real IC3 operates at ic3.gov. You submit complaints online. Agents do not typically call victims to follow up. They do not call to offer money recovery. They do not ask for payment to process your case.

If someone calls claiming to be from the FBI or IC3 and asks for money or personal data, that is not the FBI.

The real IC3 will not:

• Call you unsolicited about a complaint you filed
• Ask for payment to recover your lost funds
• Request your Social Security number or bank account over the phone
• Pressure you to act quickly before you can think or consult someone

Any of those things on a call? End it.

Authority Is Easy to Fake

This scam works because authority is one of the easiest things to impersonate. A name, a phone number, a confident tone. None of those require the real thing. They only require a convincing performance.

And AI is making that performance cheaper. Voice cloning now requires as little as 20 to 30 seconds of audio to generate a convincing replica of someone's voice. Public figures, including real FBI agents who have appeared in news segments or official videos, already have that audio available online.

The question "does this sound like someone official?" is no longer a reliable filter. You need a different question entirely.

A Check That Spoofing Can't Beat

Trust Onion gives you a way to verify anyone claiming to be someone you know or a trusted source. You and someone you want to be able to verify, a family member, a colleague, or a contact at your bank, share a set of three private codewords through the app. Those words rotate every 60 seconds, calculated locally on your phone with no server required.

When someone calls claiming to be that person or institution, you ask: "What are the words?"

A real person who has the app gives you the current three words. An impostor, no matter how convincing they sound or whose number they're spoofing, cannot answer that question. The words change every minute. Stolen words expire. There is no database to hack and no way to guess.

For institutions like banks, the same principle applies in reverse. If a bank you've registered with uses Trust Onion, a legitimate representative can confirm the current words before you share anything sensitive. If they can't, you know something is wrong.

The real IC3 isn't going to call you out of the blue. But if someone does call claiming to represent any institution or person in your life, "What are the words?" is a question that ends a scam in seconds.

If You Think You've Been Targeted

If you receive a suspicious call from someone claiming to be from the FBI or IC3:

• Do not pay any money or provide personal information
• Hang up and go directly to ic3.gov to report it
• Contact your local FBI field office using a number from the official FBI website at fbi.gov
• If you believe you are in immediate danger, call 911

You can also report the call to the FTC at reportfraud.ftc.gov.

Being targeted by this scam says nothing about your intelligence or judgment. These operations are run by professional fraudsters who spend their days refining their technique. The system is designed to fool people. The answer is a better verification system, not more suspicion of yourself.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.