Scammers Are Posing as FBI Agents to Re-Scam Victims

The FBI's Internet Crime Complaint Center is a real federal agency. Millions of Americans use it to report online fraud. Scammers have figured out that people who file those complaints are proven targets. They've already been victimized once. They want their money back. They trust the government to help.

So the scammers call them, pretending to be IC3 agents. The FBI issued a formal public warning about this scheme, confirming the pattern: the real IC3 will never contact you proactively and will never ask for money or personal information over the phone.

How the Scam Works

Callers spoof real FBI phone numbers, so your caller ID shows a legitimate federal number. When your phone reads "FBI Washington DC" with a number that checks out on a quick search, the natural instinct is to trust it. They use real agents' names, sometimes pulled from public FBI directories or news coverage, and they may reference details from your original complaint.

Then comes the ask. Sometimes they want an upfront recovery fee to release your stolen funds. Sometimes they want your Social Security number, bank account details, or identity documents to "verify your claim." Either way, the goal is the same: take more from someone who has already lost.

These callers are practiced. They know the right terminology, they sound calm and official, and they know you're frustrated and desperate. A real federal agent and a skilled impostor can sound identical on a phone call.

The Callback Problem

A common instinct is to hang up and call back on a number you find yourself. That's a good step, but it has a limit. If you hang up and call the real IC3, you'll reach the real agency, but that doesn't tell you whether the person who originally called you was legitimate or a scammer. Hanging up and verifying through an official channel confirms the institution exists. It does not verify the individual.

Always use a number from the institution's official website, a government-issued card, or a statement. Never call back a number the caller gave you. If you believe someone is in immediate danger or a crime is actively in progress, contact local authorities directly.

The real IC3 operates at ic3.gov. Agents do not typically call victims to follow up, offer money recovery, or ask for payment to process a case. If someone calls claiming to be from the FBI or IC3 and asks for money or personal data, that is not the FBI.

Authority is one of the easiest things to impersonate: a name, a phone number, a confident tone. None of those require the real thing. AI is making that performance cheaper, too. Voice cloning can generate a convincing replica of someone's voice from as little as 20 to 30 seconds of audio, and public figures, including real FBI agents who have appeared in news segments or official videos, already have that audio available online. The question "does this sound like someone official?" is no longer a reliable filter.

Trust Onion gives you a check that spoofing cannot beat. You and a person or institution you want to verify share three private codewords through the app. Those words rotate every 60 seconds, calculated locally on your phone with no server required. When someone calls claiming to be that person or institution, you ask: "What are the words?" A real person who has the app gives you the current three words. An impostor, no matter how convincing they sound or whose number they're spoofing, cannot answer. Stolen words expire. There is no database to hack.

Note that a successful callback to the real IC3 does not prove the original caller was legitimate. Use ic3.gov and fbi.gov to find contact information yourself, and report any suspicious call there. You can also report to the FTC at reportfraud.ftc.gov.

Being targeted by this scam says nothing about your intelligence or judgment. These operations are run by professional fraudsters who spend their days refining their technique. The real IC3 isn't going to call you out of the blue, but if someone does, that question takes seconds to ask and ends the con immediately.

A controlled voice-cloning safety demonstration

Try our tool to see just how easy voice cloning is. This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample. Trust Onion does not store the submitted recording, clone, or generated audio.