2 Oct 20264 minutes read
Kiara SaloojeeDMARC EnthusiastThe FBI’s Warning on Impersonation Scams Applies to Your Brand Too
Overview:
- Reported losses from government impersonation scams exceeded $1.6 billion.
- Impersonation scams borrow an identity victims already trust.
- Any trusted company faces the same fraud schemes.
Nearly 61,000 complaints about government impersonation scams reached the FBI's Internet Crime Complaint Center (IC3) between January 2025 and July 2026. Reported losses exceeded $1.6 billion. The FBI shared these figures in a PSA on September 17, 2026.
The announcement warns of impersonation scams where cybercriminals pose as US and foreign officials to demand money or personally identifiable information (PII).
The FBI describes these fraud schemes as ongoing and widespread. They work because victims trust the identity being faked. That trust isn’t unique to government agencies, and neither are these fraud schemes.
How Government Impersonation Scams Work
Most government impersonation scams start with an unsolicited phone call. Text messages and emails are also used. According to the FBI, scammers often spoof real agency phone numbers and email addresses. They also use the names of real employees and present fake credentials.
Government impersonation fraud schemes rely on pressure. Scammers use urgent, aggressive tones and keep victims on the phone for the duration of the scam. They often tell victims not to speak to family, friends, banks, or law enforcement. Payment demands in these fraud schemes include prepaid cards, bank wires, and cryptocurrency.
Some government impersonation complaints involve a scammer who accuses the victim of a crime and threatens arrest unless they pay. The PSA also tracks other government impersonation fraud schemes:
- Jury duty and missed court date scams: 6,833 complaints and nearly $36 million in losses
- Passport and license renewal scams: 496 complaints and more than $348,000 in losses
- Medical license scams targeting practitioners: 3,322 complaints and more than $37 million in losses
- Scammers posing as foreign officials: 1,809 complaints and more than $140 million in losses
Some fraud schemes also use AI so scammers can appear as officials on video calls. This makes government impersonation harder to spot.
Why Impersonation Scams Target Trusted Names
Impersonation scams work by borrowing an identity the victim already trusts. Scammers then use that trust to demand money or data.
Government agencies aren't the only organizations with this kind of authority. Customers trust their bank, insurer, healthcare provider, and law firm to contact them from an official domain about payments, accounts, and personal data. Any business with that level of trust is exposed to the same fraud schemes.
How Impersonation Scams Can Use Your Official Domain
In government impersonation scams, the FBI says scammers spoof the email addresses of real agencies. These messages appear to come from the agency's official domain.
Enterprises face the same risk with their own domains. Attackers can send email that uses your official domains to impersonate your brand to customers, partners, and employees.
DMARC addresses this risk. It builds on two checks:
- SPF confirms the sending server is authorized to send email for your domain.
- DKIM adds a digital signature that confirms the message wasn't altered in transit.
An email passes DMARC when either SPF or DKIM passes and aligns with the domain in the “From” address. At full enforcement (p=reject), your DMARC policy tells receiving servers to reject email that fails these checks.
DMARC doesn't stop lookalike domains. Attackers register these domains and control their authentication settings. These domains aren't your official domain, so your DMARC policy doesn't apply to them. Fraud schemes that use lookalike domains can continue even after you reach DMARC enforcement.
The Limits of Email Authentication Against Impersonation Scams
The FBI’s warning shows that government impersonation scams run across many channels. Phone calls, text messages, and AI video calls fall outside email authentication. Receiving servers also aren’t required to follow your DMARC policy.
Email authentication protects your official domain. Monitoring for lookalike domains extends email protection to domains DMARC doesn't cover. Fraud schemes that use phone calls, text messages, or video calls need separate controls.
Protecting Your Brand from Email Impersonation Scams
Email impersonation scams rely on the trust people place in your official domain. Protecting that trust from fraud schemes takes enforcement, visibility, and ongoing monitoring.
Sendmarc helps you:
- Protect your brand reputation from spoofing and impersonation. Sendmarc’s DMARC Management takes your official domain to p=reject in stages.
- Identify lookalike domains that impersonate your company. Lookalike Domain Defense detects domains designed to mimic your official domain.
- Gain visibility and control over every email-sending tool. Sendmarc identifies all legitimate and unauthorized senders using your official domain.
- Maintain continuous monitoring after enforcement. Protection continues as your email environment changes and new fraud schemes emerge.
- Reduce the workload on stretched security and IT teams. Hands-on implementation support means your team doesn’t need to become DMARC experts.
Find out how exposed your official domain is to impersonation scams.
Test your domain
If you’re at risk of impersonation, one of our experts will be in touch to assist.
