The FBI has issued a new Public Service Announcement (I-091925-PSA) warning that threat actors are actively spoofing the Internet Crime Complaint Center (IC3) website. These fake websites are designed to look identical to the legitimate IC3 portal, tricking victims into submitting sensitive personal and financial information.
What’s Happening
Spoofed domains are one of the oldest but still highly effective tactics in the cybercriminal playbook. According to the FBI, malicious actors are slightly altering the real IC3 domain (www.ic3.gov)—for example:
- Using misspellings (e.g.,
www.lc3.govinstead ofwww.ic3.gov) - Registering alternative top-level domains (e.g.,
.com,.org, or.net) - Employing sponsored search results to appear above the legitimate FBI site in search engine queries
Once victims land on these spoofed sites, they may unknowingly submit data such as names, addresses, phone numbers, banking details, or even cryptocurrency information. Criminals can then exploit this information for identity theft, financial fraud, or follow-up scams.
Why This Matters
The spoofing of IC3 is particularly dangerous because victims typically turn to the site when they’ve already experienced cybercrime. This creates a “double victimization” scenario:
- The initial fraud or cyberattack
- A secondary compromise when trying to report it
CyberNews reports that some spoofed sites even pose as recovery services, falsely promising to help victims reclaim stolen funds—for a fee. The FBI stresses that IC3 will never request payment and has no social media presence.
FBI Recommendations for Defense
Security teams should advise employees and clients to:
- Navigate directly to the official IC3 website by typing
www.ic3.govinto the browser, rather than relying on search engines. - Avoid sponsored search results, as these are often manipulated by bad actors.
- Verify the
.govdomain—U.S. government websites always end in.gov, never.comor.org. - Inspect site quality—poor graphics, broken links, or low-quality design are common indicators of spoofing.
- Never share sensitive data unless you are certain you’re on the official IC3 site.
Reporting Spoofing Attempts
If you encounter a spoofed IC3 website or fall victim to one:
- File a report through the legitimate IC3 portal at www.ic3.gov
- Contact your local FBI field office
- Collect and provide as much detail as possible, including spoofed domains, communications, payment instructions, and financial transaction details
The Bigger Picture
As Forbes and eSecurity Planet highlight, this campaign is part of a broader wave of government impersonation scams, where cybercriminals exploit trust in official institutions. The takeaway for defenders is clear: domain spoofing remains a low-cost, high-impact threat vector, and even well-informed users can fall victim if they let their guard down.
đź”— Read the official FBI PSA here: FBI IC3 Spoofing Alert
đź”— Supporting coverage: Forbes, CyberNews, eSecurityPlanet
