India's Central Bureau of Investigation searched 89 locations across 20 states in three digital arrest fraud cases and arrested three people accused of moving the stolen money, the agency said.
The searches were conducted under Operation Chakra-VI, the agency's ongoing cybercrime enforcement programme. All three cases were transferred to the CBI from state police forces.
In a digital arrest, fraudsters posing as police officers, courts or central agencies contact a victim by phone or video call, allege involvement in a crime, and hold the person under sustained psychological coercion — often forbidding contact with family — while extracting transfers described as bail, verification deposits or asset audits.
The three cases together account for about ₹42.4 crore (approx. US$4.49 million) in losses, an official press release stated. One, linked to the Birla Institute of Technology and Science, Pilani, involved a victim kept under digital arrest for three months and defrauded of ₹7.67 crore by callers impersonating police officers. The release does not specify the victim's role at the institution. A second case in Gujarat also ran three months and cost the victim ₹19.24 crore, again to scammers posing as police. The third, in Karnataka, involved a month of coercion and ₹15.45 crore.
Those durations are the notable detail. Where most online fraud is transactional, these cases show victims held in a controlled state for weeks or months, which is what allows losses to climb into crores from a single target.
The CBI said the searches were planned on the basis of financial and technical analysis, including examination of bank accounts and online account access records, and were carried out simultaneously to prevent destruction of evidence. Investigators seized banking documents, account records and digital devices, which the agency said are now undergoing forensic examination to map the financial and technological infrastructure supporting syndicates operating across state lines.
The three people arrested are described as beneficiaries in the laundering chain rather than the callers. Akash, a resident of Haryana, allegedly received ₹1.95 crore into an account he opened himself and pushed the funds onward to other accounts the same day. Raja Karmakar of Kolkata is accused of receiving ₹1.5 crore into his firm's account. Jyoti Rani allegedly received part of the proceeds, withdrew some in cash and transferred the rest onward. The agency said efforts continue to trace the remaining accused.
On Dec. 1, 2025, a Supreme Court bench of Chief Justice Surya Kant and Justice Joymalya Bagchi ordered a pan-India CBI investigation into digital arrest scams, specifically directing scrutiny of mule accounts and alleged collusion by bank officials, and requiring several states to grant the agency consent under the Delhi Special Police Establishment Act. In interim directions issued Aug. 5, 2026, the court told the Reserve Bank of India to publish a standard operating procedure for banks handling mule accounts, pressed states to notify cyber crime coordination centres, and ordered an inter-departmental committee to examine a shared-liability and victim compensation framework.
Home ministry figures cited before the court show digital arrest complaints falling from 123,672 in 2024 to 58,249 in 2025 and 16,377 through June 30, 2026, with ₹18.05 crore restored across 36,290 cases. The trend is fewer complaints but heavier individual losses.
In a tech support scam, criminals pretend to work for a trusted technology or security company. They claim there is a problem with your device, software, subscription, or account, then try to persuade you to pay them, share personal information, or give them remote access to your computer.
These scams used to rely mainly on browser locks and fake virus warnings. Now, scammers use many more ways to reach people, including websites and platforms they trust.
Once someone makes contact, the scammers may demand payment, ask for personal information, or try to persuade them to install remote access software.
Beware of someone wanting to connect to your computer remotely. One of a tech support scammer’s most powerful weapons is the ability to connect remotely to a victim’s computer. If you allow this, the scammer may gain access to all of your files, folders, and the information they contain.
Tech support scams impersonating Malwarebytes
Tech support scams affect Malwarebytes directly because scammers often impersonate trusted security companies, as in the example below.
You can tell it’s not the real Malwarebytes when:
They use a name other than Malwarebytes. Malwarebytes does not outsource its support. We have our own Support team and do not authorize third parties to provide support using our name, logo, or any other intellectual property.
They can’t or won’t accept payment by credit card. Malwarebytes uses a credit card processor for all transactions. Credit card processors screen the companies they work with for risks such as fraud and abuse. Credit cards also offer consumer fraud protections, so it is a red flag if a company tries to steer you toward another payment method.
They make unsolicited support calls. Malwarebytes does not do this. Tech support scammers may buy personal information from data brokers that have identified people as potentially vulnerable targets. But how would a legitimate company know that you have a problem with your computer—or even that you own one? If someone calls out of the blue claiming that your computer has a problem, hang up.
What to do if you’ve been scammed
If you’ve fallen victim to a tech support scam, here are a few steps you can take:
Have you already paid? Contact your credit card company or bank and let them know what’s happened. You may also need to file a complaint with the FTC or contact your local law enforcement agency, depending on your region.
Did you share your password with the scammer? Change it on every account that uses the same password. Consider using a password manager and enabling two-factor authentication (2FA) on important accounts.
Scan your system. If scammers have accessed your computer, they may have installed a backdoor that allows them to return later. Malwarebytes can remove backdoors and other software left behind by scammers.
Keep an eye out for unexpected payments. Look for suspicious charges or payments on your credit cards and bank accounts so you can dispute them quickly and prevent further losses.
Be wary of suspicious emails and text messages. Scammers may now see you as a potential target and try other methods to defraud you.
How Malwarebytes is fighting tech support scams
Malwarebytes researchers actively fight tech support scams in the US and overseas. They work closely with the Federal Trade Commission (FTC), providing technical evidence to help shut down tech support scammers and educating internet users about the latest tactics and how to protect themselves.
In 2026, online scams have unfortunately become part of the new normal. They can appear almost anywhere, from social media and messaging apps to search results, websites, and online communities, and they can target anyone. Sometimes, all it takes is a moment of curiosity and a convincing offer.
Among the most devastating scams are so-called “get-rich-quick” schemes. These scams promise something that’s difficult for people to resist: the chance to make a lot of money, quickly and with little or no effort. It may come in the form of an investment opportunity, a new cryptocurrency project, or an exclusive chance to get in early before everyone else.
However, behind the promises of easy money can be carefully designed operations built to gain trust, collect deposits, and ultimately leave victims with significant financial losses. In some cases, scammers go to considerable lengths to make their projects appear legitimate, creating professional-looking websites, social media profiles, and convincing stories designed to attract as many victims as possible.
This is the story of one such project: a crypto scam discovered on a cybercrime forum, where the people behind it appeared to openly discuss and promote their operation.
What we found provides a glimpse into how modern online scams are built, promoted, and potentially used to target everyday consumers.
Meet “xrep”
Threat actor’s profile on a cybercrime underground forum
The threat actor known as xrep has been active in the cybercrime underground since March 2026. It appears that xrep has already built a positive reputation among customers, receiving favorable feedback for the services and solutions they provide.
Positive feedback left by another cybercriminal
In general, xrep specializes in ready-to-use solutions related to X, formerly known as Twitter. Rather than requiring customers to build their own infrastructure or develop the necessary tools, xrep offers what can essentially be described as a full turnkey solution for scammers.
Overview of services offered by xrep
This approach significantly lowers the barrier to entry for scammers looking to conduct malicious activities. By providing a ready-made package that requires little technical expertise to deploy, xrep enables individuals with limited skills to potentially launch scams with considerably less effort.
$TSLA scam: A crypto investment opportunity designed to steal
Tesla scam kit offer
The scam project, discovered on May 16 by the Malwarebytes research team on a high-profile cybercrime forum, is a good example of how modern scams combine social engineering, phishing, and financial fraud into a single operation.
The product, priced at just $500, is essentially a ready-made website designed to look like a legitimate cryptocurrency presale. The supposed opportunity is presented as an exclusive $TSLA token presale for users of X, creating the impression that visitors have been personally selected for an early investment opportunity.
Tesla scam kit description and pricing
The website is designed to look professional and trustworthy, clearly impersonating the Tesla brand name and company logo. It supports multiple languages and is optimized for both computers and mobile devices. But the most important part is what happens behind the scenes.
The scam begins with a fake “eligibility check.” Visitors are asked to enter their X username. The screenshots below are taken from the $TSLA token scam site.
The website then retrieves their real profile picture and uses it to generate a fictional token allocation. This makes the offer appear personalized, giving the victim the impression that they have been specifically chosen to participate.
Figure 7: Scam project screenshot
The site also uses classic psychological pressure tactics. A fake fundraising progress bar continuously increases, a countdown timer creates a sense of urgency, and warnings suggest that the token price will increase soon. These features are designed to create FOMO (fear of missing out) and encourage victims to act before they have time to question whether the investment is legitimate.
Once a victim is convinced, the scam offers two ways to lose money or access to their cryptocurrency wallet.
The first is a classic phishing attack. Victims are encouraged to connect their cryptocurrency wallet to receive a supposed 15% bonus. Instead of connecting a legitimate wallet, they are prompted to enter their 12-word recovery phrase, also known as a seed phrase.
This phrase is effectively the master key to a cryptocurrency wallet. Anyone who obtains it may be able to access the funds stored in that wallet.
The second method involves direct payments. After going through the fake wallet process, victims are redirected to a convincing-looking personal dashboard. There, they can see a fabricated token balance and are encouraged to purchase additional $TSLA tokens.
The victim is instructed to manually send cryptocurrency, such as Bitcoin, Ethereum, USDT, or Dogecoin, to an address controlled by the scammer.
Victims may believe they have made a legitimate investment, but no real tokens are being purchased. Instead, the scammer simply receives the cryptocurrency while the victim sees a fake balance displayed on the website.
What makes this operation particularly concerning is the level of control provided to the scammer. The kit includes an administrative panel where the operator can monitor victims, view their X usernames and locations, track their activity, and collect the recovery phrases entered into the phishing page.
The scammer can also check whether a stolen wallet contains valuable cryptocurrency. This allows them to identify which victims may be worth targeting further. The operator can even manipulate the fake balance shown to a victim, for example, increasing the displayed amount to make the victim believe their investment is growing and encourage them to send even more money.
The administrative panel also allows scammers to manage fake purchase orders and send personalized messages to victims. For example, if someone has already made a payment, the scammer can send a notification claiming that the transaction is delayed and that the victim needs to pay an additional network fee. This creates another opportunity to extract money from someone who has already fallen for the initial scam.
In other words, this is not simply a fake cryptocurrency website. It is a complete scam-in-a-box. The technical infrastructure, phishing functionality, fake investment dashboard, victim tracking, and administrative controls are bundled together into a ready-to-use package.
The significance of this discovery goes beyond this particular $TSLA-themed project. By selling a complete, turnkey operation, xrep effectively lowers the technical barrier for individuals who want to conduct cryptocurrency scams. Someone who may not have the skills to build a phishing website, develop an administration system, or create convincing investment interfaces can potentially purchase the kit and begin targeting victims with minimal effort.
For ordinary internet users, the lesson is simple: a professional-looking website does not make an investment opportunity legitimate. Personalized offers, countdown timers, rapidly increasing “fundraising” figures, and promises of exclusive access are all tactics that can be used to create a false sense of urgency. Most importantly, no legitimate investment opportunity should ever require you to give away your cryptocurrency wallet’s recovery phrase.
Once that phrase is compromised, the consequences can be devastating, and unlike a traditional bank transfer, cryptocurrency transactions are often impossible to reverse.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
OnlyFans creators are used to posting adult videos of themselves online, but what happens if someone takes control of their images and uses them for fraud? This week, USA Today revealed how criminals are impersonating OnlyFans creators using AI tools. They use deepfake content to lure the real models’ fans with fake promises of live chats, and then ghost them after the followers pay up in advance.
How the catfishers hook their bait
This is a form of catfishing, in which an attacker impersonates someone online and engages in romantic or sexual interactions for ulterior motives. In this case, the scammers create fake accounts on platforms like TikTok, using material lifted from a real creator’s photos and given a synthetic voice. They’ll use that to nudge viewers into a direct message conversation on services like Snapchat.
Once there, the “creator” asks for a Cash App payment in exchange for exclusive content. Cash App is a peer-to-peer payments service built for casual sends between friends, not for commerce. Transfers clear instantly and settle in the recipient’s balance within seconds. Once it’s been sent, it’s very difficult to recover.
That informal design is exactly what makes it useful here. As soon as the fan pays up, the criminal blocks them and disappears.
Why the laws don’t reach the actual servers
Lawmakers are tackling this with multiple state-level anti-deepfake bills. Federally, the Take It Down Act criminalizes non-consensual explicit content, including AI-generated images, and requires rapid platform takedowns. In the EU, the AI Act requires anyone who uses AI for image generation to disclose it publicly.
So why is this still happening?
The problem is that domestic laws only apply to domestic platforms. The stolen material largely sits on overseas hosts, making it difficult to control.
Even if laws could be universally enforced, it might not matter. In three experiments conducted this year, researchers at the University of Bristol found that most participants relied on deepfake content even after being told it was fake.
What actually helps
This kind of fraud has two victims: the fans who lose money to scams, and the creators. The latter lose income that they might have collected from fans, and also run the risk of retribution from disgruntled followers who think they’ve been taken advantage of.
One creator, Jessieanna Campbell, told USA Today that confused fans complained to her after mistakenly thinking she had taken their money. “I get messages all the time, like, ‘Hey, why did you take my $150 and block me?’ and I’m like, ‘What are you talking about?'”
USA Today also interviewed one creator who had angry fans visit her home, and is now sometimes scared to leave her house.
Some creators are hiring private content takedown services to try and fix the problem themselves. Others are posting public service announcements warning of these fake accounts. But it’s up to the fans to listen.
If a “creator” on a third-party platform contacts you, watch the video closely; the deepfakes are often flawed. USA Today reported that a TikTok video impersonating creator Elaina St. James, made by animating a still photo and cloning her voice, showed distorted teeth and frozen eyebrows. Here’s our guide to spotting deepfakes of any kind.
Common sense is the bottom line. If someone steers you into a direct messaging platform and solicits money for exclusive content, think twice. Check with the creator via a verified account to see if it’s real.
Scammers don’t need to hack you. They just need you to click once.
If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s neither.
Below are two popups pulled from real pages—one dressed up as Apple Support, one as Amazon.
Same con, two costumes
Below, one popup is skinned as Apple Support, the other as Amazon. Swap the logo and color palette and the structure is identical: a warning icon, a claim that a $149.99 purchase was just made “via Pre-Authorization,” and a phone number to call immediately. That phone number is exactly the same in both.
Fake Apple alertFake Amazon alert
That reused phone number is the tell. If you only see one popup, running the number through a lookup tool like Malwarebytes Scam Number Check is usually enough to expose it—a real Apple or Amazon line won’t come back flagged, but a scam number typically does, often tied to complaints about several unrelated companies at once.
Why the copy is built the way it is
Every element in these popups is doing specific psychological work:
A believable, moderate dollar amount. $149.99 is high enough to alarm you, low enough to sound like a real subscription or product charge rather than an obvious lie.
“Pre-Authorization” jargon. This is real payment terminology (used for things like hotel holds or gas station charges), borrowed here to sound technically credible to someone who doesn’t handle payments professionally.
Manufactured urgency. “Call immediately,” “Immediate Action Required,” “no hold times”—all are designed to get you dialing before you stop to verify anything.
Visual authority. Red warning triangles, brand-matching fonts and layouts, and a full-screen modal that blocks the rest of the page all borrow the visual language of legitimate security alerts.
A single, frictionless call to action. One button, one phone number. The popup wants exactly one thing from you: to pick up the phone.
If you do call, the number connects to a live scammer posing as support staff, whose actual goal is to get remote access to your device, walk you through “verifying” your identity in a way that hands over real account or payment info, or push you toward paying a fake fee—often via gift cards or a wire transfer.
How to tell if it’s fake
A few checks work regardless of which brand is being impersonated:
Real companies don’t alert you this way. Apple and Amazon notify you about account activity through email, in-app notifications, or your account’s activity log—never through an unexpected popup while you’re browsing.
No legitimate company tells you to call a phone number to stop a charge. Disputing a charge happens through your bank, your card issuer, or the company’s actual account dashboard—not a hotline dictated by a popup.
Check where the popup is actually served from. These often ride in on malicious ads, compromised sites, or browser redirects—the underlying page may be spoofed or injected, not the real apple.com or amazon.com support page it appears to sit on top of.
A popup you can’t easily close is a red flag on its own. Legitimate sites don’t need to trap you behind a full-screen modal to relay account information.
If in doubt, go direct. Close the tab (force-close via task manager if needed) and navigate to the company’s site yourself, or call the number printed on your card or official account page—never the one in the popup.
Check the number before you dial it. Run it through Malwarebytes Scam Number Check to see if it’s already been flagged as a scam line.
Block it before it loads. A browser extension like Malwarebytes Browser Guard catches both known malicious pages and unknown ones showing scam-like behavior, so these popups often get stopped before they ever render.
Don’t judge a scam by its logo
The brand on screen—Apple, Amazon, or whoever’s next—is the least important part of this scam. What actually matters is the pattern underneath: an unexpected popup, a suspiciously specific dollar amount, urgent language, and a phone number that wants you to call before you think. Once you recognize that pattern, it doesn’t matter which company’s name is stamped on top of it.
Twenty years ago, a British mathematician named Clive Humby popularized a phrase that came to describe data’s relationship with the entire global economy: “Data is the new oil.”
Pithy as the phrase sounds, it is undeniably true.
Data steers decisions at businesses of every size. Data created entirely new industries built around its capture. And, for a select number of companies, data has produced billions—if not trillions—of dollars in value.
So how is it that, on the dark web, your stolen identity can be purchased for just 95 cents?
That’s what a Malwarebytes researcher found last month after spending 48 hours inside the dark web to investigate cybercrime. Across a variety of forums and directories, he found subscription plans for malware that steals information once implanted on a device. He found guides for deploying social engineering scams. He found people selling their services to build fake websites that trick people into handing over their usernames and passwords. And he found one of the dark web’s most traded commodities—personal data, packaged together about individual people, to help a cybercriminal commit identity fraud.
These packages are called “fullz.” For victims in the United States, a fullz contains a full name, Social Security Number, date of birth, address, and other personal details. That is enough, on its own, for a cybercriminal to potentially open a bogus line of credit, file a fake tax return, access financial accounts, or obtain medical services under someone else’s name.
As we wrote on Malwarebytes Labs:
“For less than the cost of a cup of coffee, a cybercriminal can buy enough information to devastate someone’s financial life.”
It’s the kind of risk that could scare anyone, especially considering the scale behind it. In just the first six months of 2026, Malwarebytes found more than 7,500 compromised data sets on the dark web containing more than 8.4 billion records.
And yet, even today, cybersecurity professionals still get asked why anyone should bother protecting their data.
The public, understandably, are exhausted. With data breaches happening every week—if not every day—cybersecurity can start to feel pointless. With young people unable to build financial security, they start believing that they have nothing worth stealing. And with Big Tech already collecting our every movement, behavior, click, and concern, people understandably feel powerless to fight any kind of data abuse, be it corporate or criminal.
So today’s episode approaches the question from a different direction. This isn’t about why you should protect yourself—plenty of company websites will tell you that, and most of them rely on fear. This is about why hackers want your data in the first place.
Today, on the Lock and Code podcast, host David Ruiz explains how cybercriminals turn a single repeated password into account takeover, how a screenshot of your house from Google Maps became a tool in extortion emails, and why the most benign information about you—an address, an age, one public photo—is often the most useful data a stranger can buy.
Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that either doesn’t exist or wasn’t created by the person posting it.
There are plenty of genuine resin artists on TikTok. Unfortunately, the platform has also attracted scammers who steal videos and impersonate legitimate creators.
The scam is fairly straightforward. A TikTok account presents itself as a resin artist, posts satisfying videos, and invites people to “DM to order.” In some cases, the videos are stolen from other creators, the account has no real process footage, and the seller disappears after receiving payment.
One resin artist discovered that scammers were using their videos to impersonate them and scam TikTok users. They shared the following comment:
Ridiculous TikTok scammer…lol. Profile says they’re a resin artist and to DM them to order, but none of the videos are theirs. When I wrote to them asking them to take down the many videos of mine that they posted, passing them off as their own with no credit, their answer was that they aren’t a resin artist and are just sharing videos they like Literally about 1/4 of “their” videos are mine
These scams often rely on trust and urgency. The account may show polished clips of poured resin, finished coasters, trays, jewelry, or wall art, then push buyers to move the conversation into direct messages. Once the buyer moves to a different platform, the scammer typically requests a deposit, full payment, or personal details with little chance of being held accountable.
And real artists don’t just get their work ripped off. A scammer may contact a creator claiming to want to buy, feature, or license their work, but the real goal is to extract fees, banking information, or other sensitive data. Social media art scams are often repetitive because they are built from the same templates and scripts.
Different videos, same script
How to spot a TikTok resin art scam
The safest approach is the boring one: verify before you pay. If the artwork looks amazing but the seller’s identity is vague, the risk is real.
Check the TikTok account
Before ordering, look for signs that the artist is genuine:
The account didn’t appear overnight and has a history of original posts.
The same videos don’t appear under multiple creator names or belong to another artist.
The creator shows themselves making the artwork, with consistent process videos, a recognizable workspace, and works in progress.
The videos don’t contain obvious AI artifacts, such as impossible resin effects or objects moving after they’ve supposedly been sealed inside hardened resin.
Comments raising concerns haven’t been deleted or buried under generic praise.
The seller isn’t pushing you to order only through direct messages or asking for payment before you’ve verified who they are.
Check the website
If you do click through to a website, spend a few minutes checking it before you buy:
Look for a genuine returns and refunds policy, a physical business address, company or VAT details (where applicable), and consistent contact information.
Check how old the website is. Scam sites often use domains that were registered only weeks or months ago, especially when they claim to have been selling handmade products for years.
Search for recent independent reviews rather than relying on testimonials published on the site itself.
Run a reverse image search on the product photos to see whether they’ve been copied from another artist.
Only pay using a method that offers buyer protection, such as a credit card or PayPal. If a seller insists on a bank transfer, cryptocurrency, or another irreversible payment method, walk away.
Not every resin art account is a scam. Many belong to genuine artists, and that’s why impersonation scams can be so convincing.
If you’re unsure, paste the website address into Malwarebytes Scam Guard and ask whether it shows signs of being fraudulent. It can help identify suspiciously new domains and other common scam indicators.
Use real-time web protection to block known fraudulent and malicious websites, like Browser Guard did for this web shop:
Browser Guard blocks the fraudulent website
Both are free—making them much cheaper than sending money to a scammer.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
The FBI IC3 scam has evolved into a broader fraud scheme in which criminals impersonate FBI personnel and the Internet Crime Complaint Center (IC3) to target people who have already fallen victim to scams. According to an updated Public Service Announcement (PSA), scammers are using AI-generated videos, fake social media profiles, and spoofed websites to create a false sense of trust while attempting to steal personal and financial information.
The updated warning describes several exploitation tactics, including targeting previous scam victims, using artificial intelligence to create fictitious or misleading promotional materials, and building fake websites designed to collect personally identifiable information. The scammers falsely claim to be affiliated with government agencies or law enforcement and often promise to help victims recover lost funds.
FBI IC3 Scam Targets Previous Fraud Victims
In one version of the FBI IC3 scam, criminals create fake social media profiles and pages that impersonate FBI personnel. The goal is to lure previous scam victims into what the PSA describes as "re-targeting" scams.
After realizing they have been defrauded, victims may tell the original scammers they plan to report the incident to the FBI and submit an IC3 complaint. The victim is then contacted by someone pretending to be an FBI agent through platforms such as Facebook Messenger and Telegram.
The impersonator may send a link claiming to update an existing IC3 complaint. The link could contain malicious code or collect additional financial information, allowing criminals to further exploit the victim.
In other cases, scammers approach victims through email, phone calls, social media advertisements, or online forums. They claim to have recovered lost funds or offer assistance in recovering money. The FBI warning states these claims are a ruse designed to revictimize people who have already lost money.
AI-Generated Videos Promote Spoofed IC3 Websites
Another version of the scheme involves AI-generated videos or deepfakes featuring individuals impersonating FBI personnel. The videos are used on social media to promote spoofed versions of the official IC3 website.
One reported example involved an AI-generated video depicting a senior FBI leader encouraging users to submit complaints through a fake IC3 website. The spoofed site was designed to resemble the legitimate government website, but its functionality was limited to complaint submission.
The fake complaint form requested information including a user's name, phone number, email address, scam type, and estimated financial loss. After submission, the site provided a reference number and claimed someone would contact the individual.
How to Spot AI-Generated Videos and Fake Messages
The PSA warns that scammers can use AI-generated videos and cloned voices to impersonate company executives, law enforcement personnel, and other authority figures. These materials may be used during real-time video chats or private communications to convince victims they are speaking with a legitimate person.
People are advised to carefully examine email addresses, phone numbers, URLs, and spelling for subtle inconsistencies. Potential warning signs in manipulated images and videos include distorted hands or feet, unrealistic facial features, irregular faces, unusual accessories, inaccurate shadows, watermarks, unnatural movements, and voice call delays.
The FBI also advises people to be cautious when online content triggers strong emotions such as fear, anger, or disbelief. Users should verify surprising videos or images through reputable news sources or known official channels before responding.
IC3 does not maintain a social media presence and will not contact individuals directly through phone, email, social media, messaging apps, online chats, or public forums. The agency also does not recover funds for victims through Facebook or Telegram and will never request payment for fund recovery.
People seeking to file an IC3 complaint should type www.ic3.gov directly into their browser and verify that the website address ends in ".gov." Victims should avoid sponsored search results and suspicious links, and should never share sensitive information with websites they cannot verify.
Anyone who has fallen victim to the scam should report it through the legitimate IC3 website and provide details about the person or company involved, communication methods, financial transactions, and interactions with the scammer.
The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3) is warning that scammers are impersonating the bureau on social media and on messaging apps, targeting people who’ve already been victims of cybercrime.
The FBI has issued warnings like this before, but scammers posing as IC3 employees and FBI agents continue to evolve their schemes and claim new victims.
The best-known of these scams are recovery scams, complete with FBI logos and branding that make them look far more convincing.
Facebook accounts like the one below—and yes, I reported it—with equally fake reviews prey on people who have already fallen victim to a scammer.
“Have You Been Scammed or Defrauded? We’re Here to Help.
If you’ve fallen victim to online fraud, investment scams, crypto scams, romance scams, or unauthorized transactions, Reliable Scam Recovery Inc is ready to assist you in pursuing the recovery of your lost funds.
Our experienced recovery team works with victims to investigate scam activities, trace transactions, and provide guidance throughout the recovery process with confidentiality and professionalism.
Professional case assessment
Secure and confidential support
Dedicated recovery assistance
Fast response team
Don’t let scammers win. Take the first step toward reclaiming your losses today.
Contact Ic3 Scam Recovery Inc now for support and recovery assistance.”
The scammers count on victims feeling desperate and embarrassed. They have no scruples about victimizing them all over again.
The post contains a lot of the tell-tale signs IC3 warns about. Very vague but reassuring claims: “experienced recovery team,” “professional case assessment,” “secure and confidential support” all sound impressive but provide no verifiable detail. High‑level promises like “investigate scam activities” and “trace transactions” imply special legal or technical powers, but the FBI warns that scammers make similar promises to convince victims they’re dealing with authorized investigators.
Besides setting up fake IC3 accounts, they also monitor social media for posts from victims saying they’ve reported a scam to the FBI, then swoop in posing as FBI follow‑up contacts.
If victims remain unconvinced, the scammers may create videos depicting senior FBI officials or other recognizable public figures urging them to submit their case through a specific link “to speed up recovery.” The FBI says criminals are increasingly using AI-generated deepfake audio and video to make these messages appear genuine.
How to stay safe
First and foremost, remember that IC3 has no official social media presence, does not investigate crimes via social media, and will never contact victims directly to recover funds.
“The IC3 does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds or investigate cases. The IC3 will never directly contact you for information or money.”
So, if an “agent” appears in your direct messages (DMs) right after you post publicly about being a crime victim or planning to report to the FBI, assume they are a scammer until independently verified. A few other tips:
Never pay upfront: Legitimate government agencies never ask you for advance payment to recover stolen money.
Ignore unsolicited claims: Be highly suspicious of anyone who reaches out to you out of the blue claiming they can reverse a previous scam.
Never share your credentials: Do not give remote access to your device or hand over your passwords and recovery phrases to unknown third parties.
Don’t provide IDs or financial information. Scammers can use them for identity theft or further fraud.
Use verification tools: If you receive a suspicious email, message, or phone call, you can verify its legitimacy using tools like Malwarebytes Scam Guard.
Report scammers: If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at ic3.gov.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
A major global crypto investment scam investigation has led to the arrest of an alleged key figure behind an international criminal organization accused of defrauding victims of more than €100 million every month. Dutch police announced multiple arrests across Europe following a long-running investigation into a fraud network that allegedly employed over 700 people operating from around 20 call centers worldwide.
The main suspect, a 46-year-old dual Israeli and Polish national, was arrested at an airport in Poland on May 26 at the request of Dutch authorities. Investigators believe he played an indispensable role in the organization, which allegedly carried out large-scale investment fraud targeting victims across multiple countries.
Global Crypto Investment Scam Network Operated Through Worldwide Call Centers
According to Dutch police, the organization functioned like a professional company with approximately 700 employees spread across nearly 20 offices globally. Individuals working as financial advisors scam operators allegedly contacted victims daily through online platforms and telephone calls while posing as legitimate investment professionals.
Authorities said the organization was structured with a central headquarters overseeing multiple teams, each assigned to target victims in specific countries. Employees reportedly worked under pseudonyms and used technical measures to hide their identities and locations.
[caption id="attachment_113134" align="aligncenter" width="600"] Excerpts from emails that victims sent to scammers[/caption]
As part of the investigation, Belgian police arrested five individuals believed to have worked as fraudulent financial advisors.
Multiple Arrests Made Across Europe
The investigation resulted in several coordinated arrests during May and July.
On July 7, authorities arrested two Dutch nationals aged 45 and 34, along with a 34-year-old Belgian, all residing in Cyprus. A 25-year-old suspect was also arrested in Belgium the same day. On July 10, police arrested a 44-year-old Dutch national in Athens.
The main suspect has since been extradited to the Netherlands, where an examining magistrate ordered 14 days of pre-trial detention. Dutch authorities indicated that additional arrests remain possible as the investigation continues.
How the Global Crypto Investment Scam Worked
Investigators said the online investment scam relied on building long-term trust with victims. Individuals posing as account managers or financial advisors maintained frequent contact through phone calls and online communication, sometimes over several months.
Victims were encouraged to begin with relatively small investments that appeared to generate immediate returns. Police said the investment platforms displayed convincing but fabricated profits, even though no actual investments were being made.
As confidence grew, victims were persuaded to transfer increasingly larger amounts, often in the form of cryptocurrency fraud payments. Instead of being invested, investigators said the funds were diverted directly to the criminal organization.
Authorities also warned that victims who stop investing may later be contacted by so-called recovery companies requesting upfront deposits to recover lost funds. Police believe these recovery operations may also be connected to the same fraud networks.
Hundreds of Complaints Linked to Investment Fraud
Dutch authorities have received approximately 550 reports connected to the organization, while Belgian police have recorded around 200 complaints. Investigators estimate the total number of victims worldwide could reach tens of thousands.
The financial losses reported by victims in the Netherlands alone amount to nearly €25 million, with many individuals losing well over €10,000.
Dutch police said officers proactively contacted some victims after discovering that many remained unaware they had fallen victim to cyber fraud.
Financial investigators are now examining whether assets linked to the suspects can be frozen or seized.
Digital Infrastructure Taken Offline
Investigators said the criminal organization remained active since at least 2021 and relied heavily on concealed digital infrastructure to evade law enforcement.
By tracing financial transactions, IP addresses, and other digital evidence, the Dutch police identified offices, suspects, and critical infrastructure supporting the operation. Authorities worked with commercial service providers to take key elements of the network offline.
The investigation also involved Europol, with intelligence shared across multiple countries to support ongoing criminal prosecutions.
Officials said the case demonstrates the scale and sophistication of modern investment fraud operations and highlighted continued international cooperation to dismantle cyber-enabled financial crime networks.
Login
