If a deepfake was used to demand money, steal an account, threaten someone, or impersonate a person or organization, report it quickly and preserve the original material before deleting or editing anything. File an internet-fraud report with the FBI’s Internet Crime Complaint Center (IC3), use a local FBI field office or tips.fbi.gov for an active crime, threat to life, or national-security concern, and report qualifying cyber incidents through CISA’s Incident Reporting System. Contact your bank, card issuer, local police, and the platform at the same time when safety, payment recovery, account takeover, or content removal is involved.
Investigators need more than a suspicious-looking clip. Keep the native image, video, audio, document, or email export; preserve the conversation and account context; record identifiers, timestamps, payment details, and a written timeline; and maintain an untouched master copy with a documented chain of custody. A deepfake by itself does not automatically create an FBI case. The suspected content must connect to a federal crime or a foreign actor.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first hour
Deepfake scams are social-engineering crimes as much as they are media-manipulation incidents. Synthetic video, cloned voice, or fabricated documents may be used to make an impostor appear credible, but the urgent issue is usually the requested action: sending money, revealing credentials, transferring a cryptocurrency balance, sharing intimate material, or ignoring a safety warning.
Recommended Free Tools
- Stop the requested action. Do not send money, gift cards, cryptocurrency, passwords, multifactor codes, identity documents, or additional photos or recordings while the demand is being evaluated.
- End the conversation without destroying it. Do not argue with the sender or warn them that you are reporting them. Preserve the demand first, then block the account if necessary.
- Verify independently. Call the purported relative, executive, employer, bank, or agency using a number or channel you already trust. Do not use a phone number, link, or contact method supplied in the suspicious message.
- Protect accounts and funds. If you disclosed credentials, change them from a known-clean device, revoke active sessions, and notify the affected provider. Ask your bank, card issuer, or cryptocurrency service whether a transfer can be recalled or frozen.
- Preserve volatile material. Capture the complete conversation, profile, phone number, username, URL, date and time, and any warning banner before the content disappears.
The FBI warns that synthetic content can make social-engineering and financial-fraud schemes more believable. A convincing voice or face is not proof that the person contacting you is genuine.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose the reporting channel that matches the harm
Use parallel reports when more than one type of harm is present. The channel that receives the initial complaint may not be the organization that can freeze funds, secure an account, remove content, or respond to immediate danger.
| Situation | Primary report | What to include or expect |
|---|---|---|
| Internet-enabled fraud, impersonation, investment or employment scam, or financial loss | FBI Internet Crime Complaint Center at ic3.gov | Submit the complete investigator packet, including identities, interaction history, transaction details, URLs, and original media. The FBI says to report as soon as possible; prompt reporting can support recovery of lost funds. |
| Ongoing crime, threat to life, imminent danger, or national-security concern | Your local FBI field office or tips.fbi.gov | Use an emergency channel for immediate danger rather than waiting for an online fraud form. Also contact local emergency services when someone may be in immediate physical danger. |
| Qualifying cyber incident affecting an organization or public service | CISA Incident Reporting System or its 24-hour operations center | The 2023 joint bulletin lists [email protected] and (888) 282-0870. Include technical indicators, affected systems, times, and steps already taken. |
| Unauthorized payment, account takeover, or stolen credentials | Bank, card issuer, payment service, cryptocurrency service, and the affected account provider | Ask about recall, reversal, account lockdown, credential reset, and preservation of provider records. Keep each case number and add it to your IC3 submission. |
| Threatening, harassing, or non-consensual intimate content | Local police, the FBI when a federal crime or threat is involved, and the platform hosting the content | Request immediate safety assistance and content preservation or removal. Do not forward intimate material unnecessarily; preserve it securely and provide it only through an official reporting process. |
IC3 is the usual first federal route for cyber-enabled fraud. A local field office or tips.fbi.gov is more appropriate when the crime is active, someone is in danger, or the matter involves national security. CISA’s channel is for qualifying cyber incidents, not a replacement for a police report or a bank’s fraud process.
Build an investigator packet before you submit
An investigator should be able to understand what happened without guessing which file belongs to which event. Keep the packet factual and chronological. Separate what you directly observed from what you suspect about manipulation.
Write a short timeline
Use UTC for times when possible, and state the local time zone if the device recorded local time. Include:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- When the first contact occurred and where it occurred.
- The identity the sender claimed and the identity you believe they were impersonating.
- What the sender requested, including the exact payment or account instructions.
- What you did, such as replying, transferring funds, opening a link, or sharing a file.
- When you noticed the material might be synthetic or the account might be compromised.
- When you contacted a bank, police department, platform, employer, or family member, with each case number.
Record identities and technical context
- Names, phone numbers, email addresses, usernames, profile URLs, domains, and cryptocurrency wallet addresses.
- The application or website used, device type, account used to view the material, and whether the message was public, private, disappearing, or timed.
- Original message text, voice notes, videos, images, documents, and email exports.
- Email headers or platform export files when available. Do not rely only on a screenshot of an email if the original can be exported.
- Dates and times displayed by the service, plus the time zone and any discrepancy with your device clock.
Document money and account effects
- Payment date, amount, currency, method, receiving institution, recipient account, wallet address, and transaction ID.
- Invoices, gift-card numbers, bank instructions, wire details, receipts, confirmation screens, and reversal requests.
- Accounts accessed or changed, passwords or recovery methods exposed, and devices or sessions that were revoked.
- Every file, image, identity document, or personal detail you supplied to the suspect.
Preserve proof-of-life material
Scammers may send a short video, voice note, or live-looking message to prove that an alleged relative or executive is real. If it disappears or can be viewed only once, screenshot or screen-record it whenever possible. Capture the surrounding account name, message time, URL, and any interface warning in the same recording. Keep the original capture and do not trim away the surrounding context.
Preserve the original evidence and its context
Forensic value comes from authenticity, provenance, and reproducibility. An edited clip, a re-encoded download, or a detector result without the source file may prevent investigators from checking metadata and platform history.
Keep an untouched master
- Download or export the native file through the platform’s normal function, if available. Do not open it in an editor that automatically rewrites metadata before making a master copy.
- Copy the file to storage that can be kept read-only or otherwise protected from alteration. Label it as the master and do not use it for enhancement, conversion, or repeated viewing.
- Make working copies for playback, transcription, frame extraction, or other examination. Keep the master separate from those copies.
- Preserve screenshots or screen recordings showing how the item appeared in context. A native media file without its account, message, or URL may not establish how it was presented.
Record acquisition and handling
For each file or export, record the source account or device, acquisition date and time in UTC, original file name, file size, storage location, and the person who made the copy. Log every transfer, duplicate, upload, or handoff. If a provider or investigator gives you a different copy, record when and from whom it was received.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use a simple evidence log such as:
Item ID: DF-001 Description: Original voice message received in the family chat Source: Account name and platform; sender phone number Acquired: 2026-10-17 14:32 UTC Original name: [the exact exported file name] Master location: Read-only evidence storage Working copies: DF-001-W1, DF-001-W2 Handling: Copied by [name]; transferred to [name] on [date/time] Processing: None on master; W1 transcribed, W2 converted for playback
The bracketed fields above are a template: replace them with actual values in your private record. Do not put passwords, recovery codes, or unnecessary intimate details in a report that does not need them.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Do not alter the only copy
- Do not crop, stabilize, brighten, denoise, add subtitles, or re-encode the only video or audio file.
- Do not run the only copy through an online deepfake detector. Uploading may change the file, expose private material, or give a third party a copy.
- Do not rename the master to make it easier to recognize; record the original name and use an evidence ID in your log instead.
- Do not delete the sender’s account, conversation, or cloud copy merely because you saved a screenshot.
If you enhance a working copy for readability, retain the unaltered source and disclose the software, settings, date, and purpose of the enhancement. Investigators may need original metadata, platform context, and comparison material from a known-authentic source.
Follow forensic handling guidance
The FBI Laboratory Handbook sets procedures for collection, preservation, packaging, and shipment of evidence. If an investigator asks you to provide a device or storage media, follow that investigator’s instructions rather than improvising packaging or mailing it. Keep your master until an official recipient confirms receipt and tells you whether it may be released.
Describe why the media is suspicious without overstating it
Investigators need your observations, not a conclusion that you cannot prove. Explain what you noticed and identify the comparison that made it unusual.
- Voice characteristics do not match the person’s normal speech, accent, breathing, or conversational habits.
- Lip movement drifts from the spoken words, or facial motion changes abruptly between frames.
- Reflections, shadows, eyeglasses, or lighting appear physically impossible or inconsistent.
- Scars, tattoos, teeth, fingers, jewelry, or hair change between frames without an explanation.
- Displayed timestamps conflict with the platform’s message time, travel history, or known events.
- The request conflicts with the person’s established behavior, such as demanding secrecy, a new payment method, or urgent action outside normal procedures.
Label these as observations rather than proof. A visual artifact can result from ordinary compression, a poor camera, or a legitimate edit. Conversely, a polished file may still be fraudulent. Let investigators compare the material with known-authentic recordings and obtain provider records.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Why the FBI may or may not investigate
The FBI stated in 2022 oversight testimony: “We cannot open an investigation purely because a deepfake exists, as fake speech may be protected by the First Amendment, but we can investigate this content and its creators when there is a clear nexus to a federal crime or a foreign actor.”
When you report, state the concrete offense or threat instead of describing only the technology. Relevant examples include:
- Impersonation used to obtain money, credentials, or access to an account.
- Investment, employment, romance, or business-email fraud.
- Identity theft, account takeover, extortion, blackmail, or threats.
- Evidence tampering or obstruction connected to another crime.
- Non-consensual pornography or sexual extortion.
- Foreign influence, intelligence activity, or another matter involving a foreign actor.
Europol identifies CEO fraud, evidence tampering, and non-consensual pornography among criminal uses of deepfakes. FBI reporting also describes AI-assisted investment, employment, impersonation, and extortion schemes. A report that explains who was impersonated, what was demanded, who lost money or faced danger, and which records support the account gives authorities a clearer jurisdictional basis.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Submit the federal report with useful detail
IC3 submission
Use ic3.gov for internet-enabled fraud and financial loss. Report as soon as possible, even if you are still gathering supplemental material. Include the timeline, identifiers, URLs, native-file descriptions, payment information, account effects, and the case numbers from your bank or local police report. Explain where the original files are stored and whether any material is disappearing or available only once.
FBI field office or tips.fbi.gov
Use a local FBI field office or tips.fbi.gov for an ongoing crime, threat to life, or national-security concern. If danger is immediate, contact local emergency services first. Tell the receiving official that you have preserved original media and can provide it through an approved channel; do not attach sensitive files to an unsolicited email.
CISA incident reporting
Organizations facing a qualifying cyber incident can use CISA’s Incident Reporting System or its 24-hour operations center. The 2023 joint bulletin lists [email protected] and (888) 282-0870. Provide affected systems, indicators, dates and times, suspected access, containment steps, and the location of preserved logs and media. Continue to notify law enforcement, regulators, customers, or partners when another obligation applies.
Run parallel recovery and safety actions
Federal reporting does not replace urgent remediation. Keep the report numbers and add them to later submissions.
- Bank or card issuer: request a recall, stop payment, charge investigation, or account restriction as appropriate. Give the exact amount, destination, and transaction time.
- Cryptocurrency service: report the wallet address and transaction ID immediately. Recovery is uncertain, but speed preserves the possibility of an exchange or law-enforcement hold.
- Account provider: reset credentials, revoke sessions and app tokens, replace recovery methods, and preserve login history.
- Employer or family: warn people who may receive the same impersonation, using a verified channel.
- Platform: report impersonation, fraud, threats, or non-consensual intimate content and request preservation or removal. Keep screenshots of the platform’s confirmation.
- Local police: report threats, stalking, extortion, physical danger, or an incident requiring an immediate local response.
Common mistakes that weaken a report
- Waiting for certainty: you can report suspected fraud while clearly labeling what is unconfirmed.
- Submitting only a cropped clip: keep the full native file and the surrounding conversation.
- Deleting the account or chat: preserve it before blocking, reporting, or changing settings.
- Relying on an automated detector: detector output is an observation, not a substitute for provenance and original files.
- Editing without a log: keep the original and document every conversion or enhancement on a working copy.
- Sending evidence through an unverified contact: use the official reporting channel and ask how investigators want large or sensitive files transferred.
- Reporting only the deepfake: explain the connected offense, loss, threat, or foreign-actor concern.
- Assuming one report reaches everyone: IC3, police, banks, platforms, and CISA have different roles; use the channels that match the harm.
What the available loss figures do—and do not—show
The FBI’s 2025 IC3 Annual Report recorded almost $13 million in losses from AI-involved employment scams and more than $632 million in losses in investment complaints with a reported AI nexus. These are complaint-based figures, not a measurement of all deepfake fraud or its total prevalence. They illustrate why rapid reporting and complete transaction records matter, but they do not establish that every complaint involved a deepfake video or cloned voice.
Quick Recap
Printable preservation checklist
- Stop sending money, credentials, gift cards, cryptocurrency, or additional media.
- Verify the alleged person or organization through a known-good channel.
- Capture the complete conversation, profile, number, URL, timestamps, and warning banners.
- Export native media, email headers, and platform records when available.
- Save proof-of-life messages before they disappear.
- Write a UTC-based timeline and describe the requested action.
- Record names, usernames, domains, wallet addresses, payment details, and case numbers.
- Keep an untouched master and make working copies for viewing or analysis.
- Log acquisition, transfers, storage, and any processing.
- Report promptly to IC3, the FBI, CISA, police, financial institutions, and platforms as appropriate.
- Describe suspicious features as observations and explain the concrete crime or threat.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
