The FBI has spent the past few months investigating reports of Internet Crime Complaint Center phishing scams. IC3 has been impersonated in several campaigns that attempt to convince people to reveal sensitive information that can be used to drain bank accounts and steal identities.
The FBI has identified three email templates that are being used by scammers to obtain sensitive information from victims. In some cases, victims have also had malware installed on their devices as a result of opening email attachments.
It is not known when the Internet Crime Complaint Center phishing scams started, although complaints started to be received by the FBI in July 2017. Over the following months, many victims of the scams submitted complaints to the FBI via the Internet Crime Complaint Center.
One of the emails appeared to have been sent from IC3 claiming the recipient was eligible to receive restitution as a victim of Internet crime. The emails reference the apprehension of a Nigerian scammer in 2014 – with appropriate links supplied in the email. Email recipients are advised that the case has now been closed, the scammer has been jailed, and his assets have been seized.
The email recipient is informed that FBI records show they have been a victim of one of the scams and are now eligible to receive restitution for the damages. The email recipient is told they must contact a European law firm who will pay damages immediately, with average restitution payments of £1,459,910 made to each victim. Urgency is added by supplying a date by which all claims must be received.
Other email templates are also being used which are variations on the same theme. In all cases the aim is to get the victim to reveal sensitive information including financial details for the supposed transfer of funds.
The emails also contain a text file to download, complete, and return as part of the claims process. That file is infected with malware that is intended to further victimize email recipients.
Other Internet Crime Complaint Center phishing scams have also been identified that similarly impersonate IC3. One such scam claims the email recipient’s computer has been used to commit multiple online crimes. The user told to contact the FBI by telephone regarding the investigation. Telephone number connects the email recipient to the scammer, not the FBI.
The FBI has advised all individuals receiving emails such as these to report the scams to IC3.