FBIs IC3 Used To Scam People Out Of Their Information

A recently discovered cyberattack involves impersonating the FBI’s Internet Crime Complaint Center (IC3) to trick unsuspecting people into giving up personal details to criminals. There are currently three identified versions of this scam; all claim to pay victims some amount of restitution once the personal details are entered into a form. And another surprise…the form that is sent for those details to be entered into also contains malware that ends up on the user’s device.

It isn’t detailed how the cybercriminals get the email addresses, but considering that most people’s email address (or many of them) has been stolen over the years, it could have been from anywhere. If you ever wondered why your email address can be so valuable; after all, it’s just an address, this is one reason. They can address you personally if they have such information. And when it seems that a communication is specific to you, you are more likely to take it seriously.

But don’t be fooled by this or any other. The IC3 will not directly initiate communication with you using email. They will do that via the U.S. Postal Service.

Two of these reported scams appear very legitimate. One letter uses legal language to describe what happened and even include links to the so-called stories of the arrests of the perpetrators who supposedly took advantage of the victims. Another is a very short and sweet note supposedly from the IC3’s Cyber Division stating that the victim’s IP address was used in fraud and he or she is due restitution. A fake toll-free phone number is included. The third is very poorly written with many grammatical mistakes. It claims the victim’s name was found in a corporate database used to send fraudulent funds to Nigeria.

Neither the IC3 nor FBI will ever ask you to fill out an unsolicited form they send you. However, if you believe you have been a victim of any of these or any other internet-related crime, regardless of the amount of money involved, report it on the website. There is a link there to use. They request that you be as detailed as possible about what happened, when it occurred, what websites were used, any relevant names and addresses, including email addresses used, and any account numbers used to transfer funds. They also recommend you keep all related documentation in case they need to access it later.