The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3) is warning that scammers are impersonating the bureau on social media and on messaging apps, targeting people who’ve already been victims of cybercrime.

The FBI has issued warnings like this before, but scammers posing as IC3 employees and FBI agents continue to evolve their schemes and claim new victims.

The best-known of these scams are recovery scams, complete with FBI logos and branding that make them look far more convincing.

Facebook accounts like the one below—and yes, I reported it—with equally fake reviews prey on people who have already fallen victim to a scammer.

“Have You Been Scammed or Defrauded? We’re Here to Help.

If you’ve fallen victim to online fraud, investment scams, crypto scams, romance scams, or unauthorized transactions, Reliable Scam Recovery Inc is ready to assist you in pursuing the recovery of your lost funds.

Our experienced recovery team works with victims to investigate scam activities, trace transactions, and provide guidance throughout the recovery process with confidentiality and professionalism.

Professional case assessment

Secure and confidential support

Dedicated recovery assistance

Fast response team

Don’t let scammers win. Take the first step toward reclaiming your losses today.

Contact Ic3 Scam Recovery Inc now for support and recovery assistance.”

The scammers count on victims feeling desperate and embarrassed. They have no scruples about victimizing them all over again.

The post contains a lot of the tell-tale signs IC3 warns about. Very vague but reassuring claims: “experienced recovery team,” “professional case assessment,” “secure and confidential support” all sound impressive but provide no verifiable detail. High‑level promises like “investigate scam activities” and “trace transactions” imply special legal or technical powers, but the FBI warns that scammers make similar promises to convince victims they’re dealing with authorized investigators.

Besides setting up fake IC3 accounts, they also monitor social media for posts from victims saying they’ve reported a scam to the FBI, then swoop in posing as FBI follow‑up contacts.

If victims remain unconvinced, the scammers may create videos depicting senior FBI officials or other recognizable public figures urging them to submit their case through a specific link “to speed up recovery.” The FBI says criminals are increasingly using AI-generated deepfake audio and video to make these messages appear genuine.

How to stay safe

First and foremost, remember that IC3 has no official social media presence, does not investigate crimes via social media, and will never contact victims directly to recover funds.

As the IC3 homepage states:

“The IC3 does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds or investigate cases. The IC3 will never directly contact you for information or money.”

So, if an “agent” appears in your direct messages (DMs) right after you post publicly about being a crime victim or planning to report to the FBI, assume they are a scammer until independently verified. A few other tips:

• Never pay upfront: Legitimate government agencies never ask you for advance payment to recover stolen money.
• Ignore unsolicited claims: Be highly suspicious of anyone who reaches out to you out of the blue claiming they can reverse a previous scam.
• Never share your credentials: Do not give remote access to your device or hand over your passwords and recovery phrases to unknown third parties.
• Don’t provide IDs or financial information. Scammers can use them for identity theft or further fraud.
• Use verification tools: If you receive a suspicious email, message, or phone call, you can verify its legitimacy using tools like Malwarebytes Scam Guard.
• Report scammers: If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at ic3.gov. 

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Christopher Nolan’s The Odyssey is one of the biggest movie releases of the year and scammers wasted no time taking advantage of it. Within hours of the film’s release, we found scams targeting people looking for pirated copies. Some used fake browser warnings on piracy sites, while others disguised malware as movie downloads.

Some used fake browser error messages designed to funnel people through malvertising networks. Others offered what appeared to be movie downloads that were actually Windows executables disguised as video files.

Neither scam has anything to do with the movie itself. They’re simply taking advantage of people searching for a popular new release.

The Odyssey piracy scams we found

We observed two main tactics.

One used fake pop-ups claiming your browser was missing a required “component.” Clicking Fix It Now didn’t solve any problem. It simply routed visitors into a malvertising network. Exactly where those redirects ended depended on whatever campaign the network was serving at the time.

The second involved a file advertised as The Odyssey 2026 1080p WEBRip-LAMA. Once downloaded, however, it turned out to be an .exe file. That’s a Windows application, not a video.

Movies don’t need to run as programs. If a supposed movie download ends in .exe, it isn’t a movie.

The fake “Browser Issue Detected” warning

On cloned piracy sites listing The Odyssey torrents, we encountered a fake browser pop-up claiming Browser Issue Detected. It warned that a “missing component” was preventing full access. It presented a prominent Fix It Now button, with a much smaller Close and Continue Browsing option underneath.

There was no missing browser component. The entire pop-up was part of the webpage itself, designed to look like a genuine browser warning.

What made this particularly interesting was how consistently it appeared. We found the same overlay—identical wording, identical layout, with only the branding colors changed—across multiple cloned torrent sites.

These were not the genuine torrent trackers, but convincing copies designed to impersonate well-known piracy sites that reproduced real listing layouts, artwork, and cast information for The Odyssey, then displayed the fake browser warning on top. Taken together, the cloned websites and identical pop-ups strongly suggest a coordinated campaign built to capture searches for a major new release, rather than legitimate torrent sites that had been compromised.

Clicking Fix It Now typically sends visitors through one or more advertising redirects. Depending on which campaign is active at that moment, users may eventually land on:

• A fake browser extension
• Scareware urging them to call a fake technical support number
• Another redirect attempting to deliver malware

The final destination can vary from one visit to the next because the underlying ad network changes what it serves over time.

A movie that was actually a program

The second scam targeted people who actually tried to download the movie. We also found a listing named The Odyssey 2026 1080p WEBRip-LAMA.exe, advertised as a 1080p WEBRip release with 597 seeders and 520 leechers.

Windows immediately identified the download as an Application, confirming what the file extension had already revealed.

Legitimate movie downloads use video containers such as .mkv, .mp4, or .avi. These files are opened by a media player, they do not execute code.

Several other details stood out.

The file description read “wireless bus Business Controller,” which has nothing to do with video playback and was likely leftover metadata from whatever software was originally used to build the executable.

The file also displayed VLC Media Player’s familiar orange traffic cone icon, despite being an application rather than a video file. That’s a classic social engineering trick. VLC is one of the world’s most widely used media players, so many people instinctively associate its icon with a harmless video. In a downloads folder, the file looks like something you can safely double-click when, in reality, doing so executes an unknown program with your own user permissions.

Files packaged this way (with misleading extensions, spoofed icons, and inconsistent metadata) are a well-established malware delivery technique.

---

---

What runs after the user launches the file depends on the campaign. It could be:

• A Trojan that opens a backdoor into the system
• An infostealer that steals saved passwords and browser sessions
• A loader that downloads additional malware
• In some cases, ransomware

It’s also worth remembering that large numbers of seeders don’t prove a file is safe. They only indicate that many people are sharing it, and plenty of people unknowingly distribute malicious files.

Why these scams work

Neither scam relied on exploiting a software vulnerability.

Instead, both relied on convincing someone to take the next step: clicking a fake browser warning or running what they believed was a movie.

That’s much harder for security software to prevent completely, because browsers can’t reliably distinguish between a genuine browser message and one rendered entirely in a webpage’s HTML. Likewise, antivirus software can’t flag every executable simply because it uses a misleading icon or contains unusual metadata, as many legitimate applications do too.

Security software still plays an important role. It can block known malicious websites, detect malware after it’s identified, and stop many malicious downloads or redirects before they complete.

But recognizing that a “movie” ending in .exe is never really a movie remains one of the simplest and most effective security checks users can make themselves.

What to do if you may have been affected

• If you clicked Fix It Now and something unexpected downloaded or opened afterward, run a full Malwarebytes scan.
• If you ran a supposed movie that turned out to be an .exe, disconnect the computer from the network, perform a full malware scan, and avoid using the device for banking, email, or other sensitive accounts until you’re confident it’s clean.
• Check your browser for extensions you don’t remember installing and remove anything unfamiliar.
• If you executed an unknown program, change passwords for important accounts from a separate, trusted device.
• Treat any pirated “movie” that isn’t a standard video format as suspicious. There is no legitimate reason for a movie download to be a Windows application.

Closing thoughts

Piracy-adjacent malvertising and fake-movie droppers persist because they don’t need to be sophisticated. They only need a title popular enough to guarantee search traffic. A $250 million IMAX epic with a year of ticket pre-sales behind it is about as close to guaranteed traffic as the piracy economy gets, which is why these scams surfaced within hours of release day rather than weeks later.

If you’re downloading a film and it asks you to install something, fix your browser, or run an .exe, you’re almost certainly not getting a movie. You’re downloading software that could infect your computer.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Apple is urging users to treat any suspicious FaceTime call or message as untrusted, especially if it involves payments, refunds, password resets, or requests for personal information.

This warning appears in a broader Apple support article about scams that target iPhone and iPad users through social engineering. Apple says attackers may contact people by phone calls, FaceTime, text messages, or emails while pretending to represent a trusted organization.

The advice comes as many users still delay installing security updates, leaving them exposed even after Apple has released security patches.

Over recent months, we’ve seen a familiar pattern: attackers combine convincing Apple‑branded social engineering with known iOS vulnerabilities, then profit from the gap between “patch available” and “patch installed.”

Criminals have been reported making unsolicited FaceTime calls that look like they come from “Apple Support” or a bank, alongside messages disguised as urgent account alerts or refund offers. Once the victim answers or replies, the script is pretty much standard:

• The caller claims there is fraudulent activity or a technical problem.
• They pressure the user to “verify” card details, online banking credentials, or Apple ID information.
• In some cases, they persuade the victim to install remote‑access software or share one‑time passcodes.

Nothing in this process requires malware on the device. The “exploit” is human trust, backed by familiar names, logos, and a real‑time call that feels inherently more legitimate than a text message. That makes FaceTime a useful delivery channel for social engineering, especially since users are used to seeing Apple notifications and support prompts elsewhere in their digital life.

From an attacker’s point of view, combining social engineering with vulnerabilities is attractive. Social engineering can steal your usernames and passwords, while a browser‑side exploit can silently execute malicious code when users visit a booby‑trapped site. Chain those attacks together and the attacker can move from app‑level compromise to full system control. That’s how campaigns like DarkSword operate.

How to stay safe

Apple’s advice is straightforward:

• Don’t trust unexpected calls or texts.
• Never share sensitive information over unsolicited contact.
• Keep your iPhone updated to the latest iOS version.

We’d add:

• Protect your devices with an up-to-date, real-time security solution.
• Contact companies directly through trusted channels. Don’t use contact details provided in an email, text message, or call.
• Use Malwarebytes Scam Guard to determine whether a message is likely to be a scam.
• Be especially suspicious of unexpected FaceTime calls claiming to be from your bank or Apple. These organizations are unlikely to use FaceTime to contact you about serious account issues.

Apple also asks users to report suspicious FaceTime calls:

“If you receive a suspicious FaceTime call (for example, from what looks like a bank or financial institution), email a screenshot of the call information to reportfacetimefraud@apple.com.”

How to update your iPhone or iPad

To check whether you’re running the latest version of iOS or iPadOS:

• Go to Settings > General > Software Update. If an update is available, you’ll be able to download and install it from there.
• Turn on Automatic Updates if you haven’t already. You’ll find it on the same screen. That way, your device can install important security updates as soon as they’re available.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

You want to turn some crypto into a gift card. You search, click a promising result, and land on a site that looks polished and legitimate: a dark theme, trust badges, and promises of instant delivery and no ID checks. You wouldn’t think to question it.

But a professional-looking website isn’t proof that it’s legitimate.

What’s going on

Crypto gift card sites are an easy category to fake.

Several legitimate platforms let people convert Bitcoin, Ethereum, and other cryptocurrencies into gift cards for major brands. They also tend to look similar: a dark theme, a bold “Pay with crypto” message, trust badges, and a grid of popular gift card deals.

That makes them easy to imitate.

Scammers build lookalike sites that copy the same design language and sometimes even use a name that’s only one or two letters different from a legitimate platform. They’re designed to be mistaken for the real thing by anyone scrolling quickly or clicking through from an ad or search result.

The pricing is part of the deception, too. A $100 Amazon gift card for $95. A $25 Steam Wallet code for $24. A $100 Netflix gift card for $92. Those discounts don’t look unrealistic, so the scam looks very convincing.

What’s the scam?

The simplest scam is non-delivery. You pay, and nothing arrives because there was never any gift card to send. The website exists solely to collect crypto payments.

Crypto payments generally can’t be reversed. There’s no bank to call and no chargeback if the gift card never arrives. Once your Bitcoin or Ethereum leaves your wallet, it’s usually gone.
Some scams go a step further and send you a code. It just isn’t a legitimate one.

Stolen gift card numbers are bought and sold on cybercriminal marketplaces, often for a fraction of their face value because they’re likely to be drained or reported before they’re redeemed. A scam site can buy those codes cheaply, resell them at what looks like a reasonable discount, and leave you with a code that never works or stops working shortly after purchase.

Even if a stolen code works at first, buying it helps create demand for more stolen gift cards.

There’s another reason these sites attract criminals. Crypto gift cards are commonly used to launder stolen cryptocurrency. Converting crypto into gift cards, and gift cards into goods or account balances, makes transactions harder to trace. A fake storefront doesn’t just be steal from buyers, organized crime gangs also use it to move funds.

None of this requires advanced technical skills. A convincing storefront, irreversible crypto payments, and search or social media ads are often enough to lure victims.

How to protect yourself

• Go directly to the platform’s official site by typing the address yourself, rather than clicking a link from an ad, a search result, or a message.
• Check the spelling of the domain character by character. Scam sites often use domains that differ from a legitimate one by just one or two letters.
• Don’t assume “No ID required” means a site is trustworthy. It’s a genuine feature on some platforms, but scammers use it too.
• Think twice before clicking Connect Wallet. Depending on the permissions you approve, it can expose more than a single payment.
• Be skeptical of discounted gift cards, even modest discounts. Small discounts are designed to look believable.
• Search for the platform’s name plus “scam” or “reviews” before you pay, especially if you found the site through an ad.
• Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard. It can flag a fake storefront before you land on it, even ones it hasn’t seen before.

If you’ve already sent crypto to a suspicious site

Treat the funds as unrecoverable, but act quickly anyway.

• If you have the transaction ID, check a blockchain explorer to see whether the funds were sent to a known exchange. If they were, contact the exchange’s fraud team immediately.
• If you connected your wallet rather than sending a payment, review and revoke any token approvals you granted.
• Report the site to Google Safe Browsing and Microsoft SmartScreen to help warn other people.

Remember

A crypto gift card site can look completely legitimate and still not be. Before you send anything, check its reputation first.

---

---

Mule betting or third-party betting account scams are a form of money mule scam where criminals recruit or coerce people into opening gambling accounts in their own name. The criminals then use those accounts to place bets to help launder money and obscure the source or ownership of funds.

The UK Gambling Commission describes “mule” betting accounts as online betting accounts created using another person’s personal details, with or without that person’s knowledge. It says criminals can control large numbers of these accounts to disguise who is betting and where the money came from. The Commission also warns that criminals may move illicit funds through third-party bank accounts to break the audit trail, often targeting vulnerable people and university students.

A common pattern is that the scammer offers easy money, “helps” the victim open an account, or claims they can’t use their own identity. That matches broader money mule recruitment tactics, where criminals approach people online, promise quick cash, and use the victim’s account to move or launder funds.

Barclays defines a money mule as:

“A money mule is someone who lets criminals use their bank account to move money. Often the mule doesn’t know what’s really happening, and has been manipulated into believing a cover story, or lured by an offer of payment.”

A UK study published in 2025 found that 21% of adults had been asked to receive money into their bank account, apply for a loan on someone else’s behalf, or open a new account—all in exchange for cash.

Mule betting is a specialized form of money mule scam. As well as helping to hide the source and destination of criminal funds, these accounts can also end up being involved in betting-related crime, including match fixing.

It is important to realize that by acting as a money mule, you’re getting involved with organized crime. In the US, money mules can face criminal prosecution, and authorities warn that claiming “you didn’t know” is not always a defense.

The FBI says common targets include students, job seekers, and people using dating sites. The “mule herder” usually promises easy money, then quickly asks the victim to open a bank or betting account or receive and transfer money on their behalf. Money gets deposited into that account from a fraud victim, a stolen source, or another mule who is a link in the chain.

The criminal then uses the account to place bets, move funds, or cash out in ways that make the money appear to be gambling winnings rather than the proceeds of fraud.

The key gain for the criminals is layering: each extra account, bet, transfer, or cash-out step makes the money harder to trace. On paper, the account holder appears to be the person carrying out the transactions, even though someone else is controlling the account.

From the victim’s perspective, it can look like a legit side hustle at first: easy money, simple tasks, and a promise they can keep a percentage. After that, the requests usually escalate into more frequent transfers, identity verification, sending card details, or handing over full control of the account.

How to stay safe

Like many scams, money mule schemes often start with small, seemingly harmless requests before escalating. The safest approach is simple: if someone asks you to move money in exchange for an easy reward, assume it’s a scam unless you can independently prove otherwise.

• Never use your own bank account to move money for someone else. Legitimate employers or businesses do not ask you to receive and forward funds through your personal account. This is a common follow-up tactic in romance, friendship, and job scams.
• Be skeptical of easy-money offers, especially “work-from-home” jobs that promise quick pay for simple transfers. If it sounds too good to be true, it usually is.
• Research any company or person making the offer before you respond. Check that the business is real, registered, and traceable, and be extra cautious with overseas or hard-to-verify contacts.
• Never share banking details, passwords, PINs, or one-time passcodes with anyone you do not fully trust. Protecting access to your accounts helps block both coercion and takeover attempts.
• Monitor your accounts regularly and act fast on unexpected deposits or suspicious requests. If money appears out of nowhere, do not touch it; contact your bank immediately.

Pro tip: If someone contacts you out of the blue, Malwarebytes Scam Guard can help you determine whether it’s a scam.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Crypto prediction and betting sites are appearing around the World Cup, and researchers have already tracked scams aimed at fans, including fake ticketing, fixed-match betting, prediction scams, and fan-branded meme coins.

We investigated one prediction site ourselves. While we aren’t claiming every site works the same way, it matched several well-known scam patterns. Whether it’s a worthless token, a fake betting platform, or a disappearing website, the result is often the same: you lose money.

What you need to know

• This isn’t a single scam. Different sites use different tactics, but many follow the same playbooks.
• Even if a site pays out exactly what it promises, you could receive a token that’s difficult or impossible to sell.
• Some sites simply keep your deposit and stop responding.
• Crypto transactions generally can’t be reversed. Once you’ve sent the money, recovering it may be impossible.

How you lose money

The last three examples below are based on a token we investigated directly. The first two are common scam patterns seen across this category.

• Pump-and-dump: A token is promoted through the game, early participants receive genuine payouts that build trust, then the creators sell their holdings and the price collapses. Later buyers are left with a token few people want.
• Take the money and vanish: You deposit crypto to unlock betting or enter the game. The site keeps the money and disappears.
• Fake free-to-play: The game is advertised as free, but you have to buy or hold a token before you can participate. The game attracts users; the token sale generates revenue.
• Copycat naming: A new token uses a name similar to an established cryptocurrency, making it easier for people to mistake it for a legitimate project.
• Manufactured activity: The same tokens move repeatedly through a central wallet, creating the appearance of trading activity. On charts, it can look like an active market when little genuine trading is taking place.

Traditional crypto advice doesn’t help much here

You’ve probably heard advice like “never share your seed phrase.” That’s still important, but it isn’t what’s happening here.

These sites don’t need access to your wallet or seed phrase. They persuade you to send money voluntarily. Once you’ve done that, there may be nothing to recover.

How to check a token

• Look at how many people actually hold the token. A token with very few holders, despite lots of apparent trading, deserves extra scrutiny.

• Check the transfer history, not just the trading volume. On one token we examined, identical amounts repeatedly moved into and back out of the same central wallet. We confirmed this pattern across more than a dozen addresses. Genuine market activity rarely produces repeated matching round trips like this.

• Search the token name alongside “price.” If a similarly named cryptocurrency already exists, you may be looking at a copycat.

• Before sending money, ask yourself what happens if you never see it again. If you aren’t comfortable with that answer, don’t send it.

If you’ve already sent money

• Don’t send more to unlock a refund or payout. That’s often part of the scam.
• Assume the money may be gone. Waiting for the site to make things right rarely works.
• Disconnect unfamiliar apps, then revoke any spending permissions you granted. Disconnecting a wallet from a site doesn’t necessarily revoke any spending approvals you’ve already granted. Check your wallet’s support pages for instructions on reviewing and revoking those permissions.
• Report the scam to help protect others:
  • Report the website to your country’s cybercrime reporting service or consumer protection agency.
  • Report the wallet address if the wallet or exchange you use provides an abuse reporting option.
  • If you found the site through social media or a search engine, report the post or advert so it can be reviewed.

Whether the site pays you in a token that quickly becomes worthless or simply disappears with your deposit, the outcome can be much the same.

If a crypto prediction game asks you to buy or hold a token before you can play, stop and ask why. The game may be there to encourage token sales rather than reward successful predictions.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Not sure this will have any effect, but I support the effort:

According to Google’s legal filing, Outsider Enterprise operates through Telegram. The group offers phishing-as-a-service to individuals who may not be technically savvy enough to set up fraudulent websites and text campaigns on their own. In its Telegram channels, Outsider Enterprise reportedly provided instructions on how to use Google’s Gemini AI to create websites that imitate those of Google, YouTube, and government agencies such as New York’s E-ZPass. The group offered nearly 300 scam templates.

[…]

Google worked with AT&T, Verizon, and T-Mobile to block many of these malicious text messages, and Google notes that its on-device scam detection in Google Messages probably helped reduce the number of successful phishing attempts, too. This AI-powered feature apparently stops 10 billion scam texts every month, so it’s fair to expect it caught at least some Outsider Enterprise activity.

Another article.

Ignoring a real breach notification invites risk, but falling for a bogus one could be even worse. Stop reacting on autopilot.

If you’ve been a victim of fraud, you’re likely already a lead on a ‘sucker list’ – and if you’re not careful, your ordeal may be about to get worse.

Can you believe your ears? Increasingly, the answer is no. Here’s what’s at stake for your business, and how to beat the deepfakers.

Like any other marketplace, the social commerce platform has its share of red flags. It pays to know what to look for so you can shop or sell without headaches.

It’s time to file your tax return. And cybercriminals are lurking to make an already stressful period even more edgy.

The mobile marketplace app has a growing number of users, but not all of them are genuine. Watch out for these common scams.

Here’s how the most common scams targeting Apple Pay users work and what you can do to stay one step ahead

Have you ever received a package you never ordered? It could be a warning sign that your data has been compromised, with more fraud to follow.

How a fast-growing scam is tricking WhatsApp users into revealing their most sensitive financial and other data