Skip to content
Scammers.com
Recovery & refund scamReviewed

Facebook "DARKTRACER" recovery ads and fake IC3 "Director of Fraud Investigations" page removed by Meta

Fox News reports Meta removed Facebook DARKTRACER recovery ads and a fake IC3 "Director of Fraud Investigations" page. The FBI says IC3 never recovers money via Messenger.

First reported
Reports
1

Source: foxnews.com · published

Illustration: Investing and crypto scams

What happened

Fox News' CyberGuy Report published on 8 November 2026 an account of fraud-recovery scam advertising on Facebook. One advertisement, displayed under the name Adam Molina, carried a graphic branded DARKTRACER that asked whether people had lost assets or funds to scammers and promoted recovering stolen assets and retrieving hacked cryptocurrency wallets, with a Facebook Messenger button. A second Facebook page used the title Director of Fraud Investigations and the name Grace K, with imagery of the White House, the FBI headquarters building, cryptocurrency graphics and references to the FBI's Internet Crime Complaint Center (IC3) and the U.S. Department of Justice, and claimed to help victims navigate IC3 reporting, suggesting people who lost more than $4,000 might qualify for federal review. The FBI, IC3, the Department of Justice and Meta are impersonated or misused; they are not involved in the recovery offers.

How the scam works

The report says Meta confirmed it removed the flagged accounts and ads for violating its impersonation policies. It notes the FBI says IC3 has no official social media presence and never recovers money through Facebook Messenger or Telegram or charges victims to recover funds. Recovery scams target people who have already been cheated: the advertiser offers hope of getting money back, then asks for fees, wallet access, personal details or remote access to a computer, and often takes a further payment without recovering anything.

Using titles such as Director of Fraud Investigations and images of government buildings makes the page look official. The $4,000 threshold and talk of federal review are designed to sound like a real programme. Once a conversation moves to Messenger, the scammer can push for payment or for the victim to install software away from public view.

Anyone who has lost money to a scam should report it to IC3.gov and local police, and should ignore anyone who contacts them afterwards offering recovery for a fee. Do not click recovery ads on social media, and do not share wallet seed phrases, passwords or remote-access codes. If you already paid a recovery firm found through Facebook, contact your bank and report the page to Meta.

Source

Fox News CyberGuy Report, 8 November 2026: https://www.foxnews.com/tech/facebook-recovery-scams-use-fake-fbi-profiles

Red flags

  • Facebook ads offering to recover stolen crypto or scam losses.
  • Pages using FBI, IC3 or Department of Justice imagery and titles.
  • A request to continue the conversation in Messenger or Telegram.
  • Fees, wallet access or remote-access software required before any recovery.
  • Claims that IC3 or federal review can return your money through social media.

If you were targeted

  1. 1Report losses only through IC3.gov and local police, never through social media ads.
  2. 2Ignore recovery offers that ask for fees, seed phrases or remote access.
  3. 3Do not continue conversations about fraud recovery into Messenger or Telegram.
  4. 4If you paid a recovery advertiser, contact your bank and report the page to Meta.
  5. 5Remember that IC3 has no official social media presence and does not recover funds that way.
PhishingReviewed

Fake Meta 'Page Appeal' site on chronos-reprieve-658a.s2506015.workers.dev steals Facebook logins and 2FA codes

Website scanning service ScanMalware posted on X on 12 November 2026 that chronos-reprieve-658a.s2506015[.]workers[.]dev is a confirmed scam. Its scan report describes a phishing kit imitating Meta's Privacy Center an…

  • chronos-reprieve-658a.s2506015.workers.dev
  • Path /analysis_center/; Cloudflare workers.dev subdomain; exfiltration via Telegram bot
  • Phishing kit exfiltrating to a Telegram bot (12 Nov 2026)
Reported Nov 12, 20261 report
PhishingReviewed

Fake Facebook login page at facebook-profile-login.blogspot.com

The OSINT account BeeSINT posted on Mastodon on 12 November 2026 a 'Phishing Spotlight' on facebook-profile-login[.]blogspot[.]com, built on Blogger, linking its analysis. The domain also appears on the Phishing Army…

  • facebook-profile-login.blogspot.com
  • Hosted on shared blogspot.com (Blogger) domain
Reported Nov 12, 20261 report
PhishingReviewed

Fake Onet Poczta (Polish webmail) login page at xxvv435.weebly.com

PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…

  • xxvv435.weebly.com
  • Weebly subdomain; URLScan brand: onetpl; VirusTotal 19/92
Reported Nov 12, 20261 report
PhishingReviewed

GMX.net email login phishing page at xncok12.weebly.com

PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…

  • xncok12.weebly.com
  • Weebly subdomain; VirusTotal 17/92
Reported Nov 12, 20261 report