FBI Warns Scammers are Spoofing it’s Own Website

The Ultimate Irony: When Scammers Spoof the FBI

As security awareness professionals, we often use the FBI’s Internet Crime Complaint Center (IC3) as a trusted resource for our employees. However, a recent FBI Public Service Announcement highlights a bold new tactic: scammers are now spoofing the IC3 website itself. By creating look-alike domains and paying for sponsored search results, threat actors are intercepting victims who are already trying to report a crime, leading to secondary “follow-on” scams and further data theft.

This trend underscores a critical lesson for our training programs: trust is a vulnerability that must be verified at every level—even when the logo on the screen belongs to federal law enforcement.

Guidance to Encourage Among Employees

To help your workforce navigate these high-stakes impersonation attempts, prioritize these specific “government-grade” safety checks:

• The “.gov” Gold Standard: This is the single most important rule to reinforce. Legitimate federal agencies in the U.S. will always use a .gov top-level domain. Train your team to treat any “FBI” or “IC3” site ending in .com, .org, or .net as an immediate red flag.

• Skip the “Sponsored” Results: Scammers often buy ad space to appear at the very top of search results. Advise employees to ignore the “Ad” or “Sponsored” links when searching for official agencies and instead scroll down to the organic, verified results.

• Bookmark the Essentials: Encourage a “Trust, then Bookmark” habit. Provide a list of official reporting links—like www.ic3.gov—and suggest employees save them to their browser. This eliminates the need to rely on search engines during a high-stress moment after a potential breach.

• Government Doesn’t “Pay-to-Play”: A common hook in these spoofed sites is the promise of “recovering lost funds” for a fee. Be explicit in your training: The FBI and IC3 will never ask for payment, banking passwords, or gift cards to process a report or recover money.

• Verify Out-of-Band: If an employee is contacted by someone claiming to be from the FBI, teach them to find the contact info for their local FBI Field Office independently via the official website rather than using the number or link provided in the message.

By teaching our teams to verify the “how” and the “where” of their reporting, we ensure that their first step toward recovery doesn’t lead to a second victimization.

Read the full breakdown of the FBI spoofing alert here: FBI Warns Scammers are Spoofing it’s Own Website