No one is safe form these attacks.
NurPhoto via Getty Images
The FBI has issued multiple warnings over the last year, as fake websites steal millions of dollars from citizens. These have included holiday discount websites, charity websites after emergencies and disasters, even fake document converters. But the FBI’s latest warning is a surprise. No one is safe from attack — not even the bureau itself.
“Threat actors are spoofing the FBI Internet Crime Complaint Center (IC3) government website,” the bureau warned on September 19. The www.ic3.gov website is included in all the bureau’s warnings as attacks and scams surge across the U.S. It’s a reporting and information tool. But now it’s being faked for “possible malicious activity.”
Once threat actors trick you into using the wrong website, they can initiate a range of scams — soliciting payment, stealing login credentials, even pushing malicious software downloads. Stolen data can include a person’s “name, home address, phone number, email address, and banking information.” It’s a honeypot.
The irony here is that “members of the public could unknowingly visit spoofed websites while attempting to find FBI IC3’s website to submit an IC3 report,” the FBI says.
The bureau’s guidance is simple:
- “Type www.ic3.gov directly into the address bar located at the top of your Internet browser, rather than using a search engine.
- If using a search engine, avoid any ‘sponsored’ results as these are usually paid imitators looking to deter traffic from the legitimate IC3 website.
- Verify that the URL of the IC3 website ends in [.]gov and is correctly entered as www.ic3.gov.
- Avoid clicking on any link whose URL differs from the legitimate IC3 site to mitigate risk of fraud.
- Never click on links that may include suspicious artifacts or graphics, such as unprofessional or low-quality graphics used to imitate a legitimate website.
- Never share sensitive information if you are unsure of the website’s legitimacy.”
The FBI also stresses it “will never ask for payment to recover lost funds, nor will IC3 refer someone to a company requesting payment for recovering funds.” This follows multiple warnings as attackers impersonating federal, state and local law enforcement have demanded payment to avoid arrest or for outstanding fines.
This advisory follows prior warnings where attacks have used social media lures to trick users into visiting fake IC3 websites “to assist in recovering funds.” The bureau confirms that “IC3 does not maintain any social media presence.”
The FBI asks internet users to “report any interactions with websites or individuals impersonating IC3.” To do so, it says, just visit IC3 at www.ic3.gov. Clearly, you’ll need to be very sure you are using the right website before you do so.