Impersonation of the Internet Crime Complaint Center

Cyber actors are scamming victims into providing personal information and downloading malicious files by impersonating the Internet Crime Complaint Center (IC3). In a recent scam, the unknown actors emailed victims requesting the recipients provide additional information in order to be paid restitution. In an attempt to make the emails appear legitimate, the scammers included hyperlinks of news articles which detailed the arrest or apprehension of an internet fraudster. The unknown actors also attached a text document (.txt) to download, complete, and return to the perpetrators. The text file contained malware which was designed to further victimize the recipient.

As of July 2017, the IC3 has received numerous victim complaints regarding the scam. In each case, the perpetrator used the email template below, making only minor changes to the information.

Internet Crime Complaint Center (IC3) In Partnership with: FBI/NW3C/IAI REF: FLP-IP/2422-FM10089/0877 RE: Internet Crime Victim Restitution INTENDED ONLY FOR: [Victim's Email] Our records indicate that you are eligible to receive restitution for one or more of the internet fraud schemes you've been a victim of. See necessary case details below. Case on apprehended internet fraudster, (subjects name), a Nigerian national who was arrested on felony charges in Atlanta, November 2014 has officially been closed. The case was closed based on the following terms; 1. Restitution Order: seized assets shall be liquidated and converted into a restitution fund, 2. Time served plus 68 months and, 3. 10 years' probation, court documents show (available upon request). The perpetrator and his group of co-offenders had over 2000 aliases originating from Russia, Nigeria, Ghana, London, and many more masking their original identities. Our records indicate that you have been a victim of fraud because your contact details were found on several devices belonging to the perpetrator. Following court orders, this makes you eligible to receive restitution for damages caused by his crimes. Being that (subject) operated on an international scale and victimized thousands of individuals and companies of several nationalities; we determined that the investigation had to be kept private and away from public media to maintain unitary judgment and integrity in international relations. Because this was a private investigation, all victims (including yourself) were represented by a professional court-appointed public defender. (European Law Firm) with over 10 years of experience on similar cases. After having consistently pursued the (subjects) case for two years, successfully secured restitution payments of GBP 1,459,910.00 for each victim. Restitutions are ordered to be paid immediately. To start receiving your restitution benefits, contact the (Law Firm) at: [Multiple Perpetrator Email Addresses Used Here] *Note that all entries must be claimed no later than [various dates used]. Be sure to quote you Reference Number in all correspondences. Sincerely Yours, [Various Names Used] Internet Relations Internet Crime Complaint Center (IC3)

At least three other versions of the IC3 impersonation scam have been identified. The first involved a fake IC3 social media page, which advertised itself as the FBI Cyber Crime Department (IC3) and requested recipients provide personal information in order to report an internet crime.

The second involved an email which stated the recipient was treated unfairly by various banks and courier companies. The email claimed the recipient's name was found in a financial company's database and that they will be compensated for this unfair treatment. The email template used for this scam is provided below:

Internet Crimes Complaint Center Counter-terrorism Division and Cyber Crime Division ICC Headquarters/18 Court Road Central Ave HOUSTON, Texas USA, Attention Beneficiary, I am Mr. Director in charge of the compensation funds to scam victims from the Internet Crimes Complaint Center (IC3). It may interest you to know that reports have reached our office by so many correspondence on the uneasy way which people like you are treated by Various Banks and Courier Companies across Europe to Africa and Asia and we have decided to put a stop to that and that is why the IMF was appointed to monitor your transaction here in united state and Europe from the (IMF) that your compensation funds gets to you. After proper and several investigations and research at and Office, we found your name in database among those that have sent money through to Nigeria and other country right now we are working hand in hand with to track every fraudsters down, do not respond to their e-mails, letters and phone calls any longer as they are scammers and you should be very careful to avoid being a victim to fraudsters any longer because they have nothing to offer you but to rip-off what you have worked earnestly hard to earn. In view of the determination and commitment of this New Governmental policy against cyber crime to ensure that every outstanding foreign beneficiaries debts are settled, but to our greatest dismay, despite all the effort made last year to ensure that most foreign beneficiaries receive their payment, record still show that a lot of foreign beneficiaries did not receive their payment due to their inability to settle some outstanding up-front obligation needed by the Monetary Body. In this regard a meeting was held between the Board of Directors of The Internet Crimes Complaint Center (IC3) investigations it was agreed that you will be compensated with the sum of $10.5,000,000.00(Ten Million And Five Hundred Thousand United States Dollars) by the Internet Crimes Complaint Center (IC3) which has set aside as a compensation to everyone who have by one way or the other sent money to fraudsters in Nigeria and those country would be paid by the UNITED NATIONS from Counter-terrorism Division and Cyber Crime Division here in USA. Get back to me ASAP for further directives; or kindly contact the USA delegate from the Internet Crimes Complaint Center (IC3)in charge to handle your fund via these email address (various email addresses used) Yours sincerely, Director In Charge, Internet Crimes Complaint Center (IC3)

The third example involved an email from the Internet Crime Investigation Center/Cyber Division and provided an address in Minneapolis, Minnesota. The email also included a case reference number in the subject line. The email informed the recipient that their IP address was referred to the IC3 as a possible victim of a federal cyber-crime. The email then requests the recipient to contact the sender via telephone. As of December, 2017, the IC3 had received over 100 complaints regarding this scam. No monetary losses have yet to be reported. A copy of the email is provided below:

Individuals who believe they may be a victim of an online scam (regardless of dollar amount) can file a complaint with the IC3 at www.ic3.gov.

In reporting online scams, be as descriptive as possible in the complaint form by providing:

1. Name of the subject and company.
2. Email addresses and phone numbers used by the subject.
3. Web sites used by the subject company.
4. Account names and numbers and financial institutions that received any funds (e.g., wire transfers, prepaid card payments).
5. Description of interaction with the subject.

Although all of this information is not required to submit a complaint, it is helpful for the IC3 to have as much information about the scam as possible, to use in the course of investigating these incidents. Complainants are also encouraged to keep all original documentation, emails, faxes, and logs of fraudulent communications. To view previously released PSAs and scam alerts, visit the IC3 Press Room at www.ic3.gov/PSA.