Scams 2026: Deepfake Recovery Agents, Gold Extraction, and Fake GLP-1

CONSUMER PROTECTION · 2026 BRIEFING

The second crime is now the business model. How to tell a helper from a harvest.

Last reviewed: 7 September 2026 · Written by: One Day Advisor Editorial Team · Audience: Global consumers

This article is educational. It is not legal advice, medical advice, or a recommendation of any product, clinic, exchange, or recovery firm. When money or medicines are at stake, use official channels and licensed professionals.

Quick Answer

Quick Answer

If someone contacts you first, guarantees a result, and asks for money, a seed phrase, remote access, or an injectable from a social-media storefront — treat it as a second crime, not a solution.

Three fraud markets fused in 2026. They look different at the checkout. They run on the same funnel.

Deepfake recovery agents. Criminals impersonate police, financial regulators, crypto exchanges, and “law firms,” including with AI video of real officials. They target people who already lost money.
Gold as bait and as cash-out. Some schemes sell a story about bullion returns. Others use government-impersonation pressure to make victims convert cash into bars that leave the banking system.
Fake or unregulated GLP-1. Counterfeit pens, cloned pharmacy websites, “research” peptides, and oral products that test as containing no GLP-1 at all.

What is established: major agencies have issued public warnings on all three patterns in 2025–2026. What remains uncertain: exact global loss totals, because most victims never file a complete report, and because recovery-scam losses are often booked as a second incident rather than a separate crime type.

The practical rule does not depend on those totals. Officials you did not call back on a number taken from their own website are not officials. Medicines that did not pass through a licensed pharmacy are not a bargain.

How the 2026 funnel works

These scams are often described as three industries. For the victim they are usually one sequence.

Harvest. Your details come from a prior loss report, a leaked customer list, a public “I was scammed” post, or a cloned pharmacy ad.
Costume. A deepfake official, a forged regulator letter, a cloned government site, a title, a hologram screenshot.
Extract. A “release tax” in crypto, a gold-bar purchase, a wire, or a pen that may contain the wrong thing — or nothing.
Resell the victim. A second “recovery agent,” a “customs hold on your gold,” or a “replacement authentic box” after the first pen failed.

Urgency plus emotion is not a side effect. It is the product. The U.S. Federal Bureau of Investigation has flagged synthetic video and voice that create fear or haste, along with visual artifacts — odd hands, lighting, cadence — that still appear on some deepfakes. Those artifacts are becoming less reliable as models improve. Process beats eyeballing.

1. Deepfake recovery agents

What changed

Recovery fraud is old: after an investment, romance, or crypto loss, a stranger offers to get the money back for a fee. The 2026 change is the costume.

On 20 July 2026 the FBI’s Internet Crime Complaint Center issued an updated public service announcement. Criminals were impersonating FBI personnel and IC3 itself. In the more advanced variant, they circulated AI-generated video that appeared to show a senior FBI official directing viewers to a cloned IC3 complaint page. The fake site collected a name, phone number, email, scam type, and estimated loss, then issued a reference number and promised follow-up. That follow-up is the second theft.

This sits on top of earlier warnings. In 2025 the FBI described fictitious law firms that target cryptocurrency-scam victims. The U.S. Federal Trade Commission has separately warned that prior fraud victims are re-targeted with fake recovery offers, including callers posing as FTC staff. The U.S. Commodity Futures Trading Commission has long treated “we can retrieve your lost trading funds” as a classic advance-fee pattern.

Crypto is over-represented because transfers are fast, hard to reverse, and easy to narrate in technical language — “on-chain freeze,” “whitelist,” “node sync,” “AML release.” Voice cloning has also been used to impersonate exchange support. A voice that sounds like Coinbase or Kraken on a live call is not proof of identity.

What real agencies do not do

The FBI has been explicit on the points that matter to a consumer:

IC3 does not recover funds through messaging apps.
IC3 does not charge a fee to release money.
IC3 does not operate official social-media complaint accounts that cold-contact victims.
A reference number from a site you reached via a video or a text is not a case file.

Police and regulators in other countries follow the same logic even when the letterhead is different. A UK “Action Fraud officer,” a European “Europol recovery desk,” or an “exchange compliance team” that found you on Telegram is playing the same script.

Established evidence versus marketing

Established: revictimization is deliberate. Lists of prior victims are bought and reused. Guaranteed recovery of stolen crypto is incompatible with how blockchains and courts actually work. Tracing an address is not the same as retrieving an asset.

Emerging: the share of recovery approaches that now include a live deepfake or a cloned government domain. Agencies say the sophistication has increased. Public data do not yet give a clean global percentage.

Opinion, and we will label it as such: most “crypto recovery companies” that advertise guaranteed results, testimonials on Telegram, or payment in the same asset that was stolen are not investigators. They are a distribution channel for the second hit. Legitimate forensic firms exist. They do not cold-call you, and they do not ask for a seed phrase.

Checklist: recovery-agent pitches

Signal	How to read it
They contacted you about a past loss	Default to scam. Real agencies do not hunt victims on Telegram to offer a refund.
Guaranteed recovery or a named success rate	Incompatible with how stolen crypto and wires are actually recovered.
Fee, tax, gas, AML, customs, or retainer before funds move	Advance-fee fraud. The fee is the product.
Seed phrase, private key, 2FA code, or remote desktop	Wallet or device takeover. Stop.
Deepfake video plus a short form plus a reference number	Harvesting for the callback.
Move from email or a website to WhatsApp or Telegram	Isolation. Harder to record, easier to pressure.
They already know the amount, platform, or story	Your details were resold, not “traced by the Bureau.”

If you already sent money or a key

Do not pay a second “unlock” fee. That is the next scene, not the fix.
Preserve evidence: screenshots, wallet addresses, transaction hashes, voice notes, URLs, caller IDs.
If an exchange account was used, contact the exchange through a URL you type yourself.
File a police report in your jurisdiction. For U.S.-nexus cyber fraud, file at IC3.gov — typed by you.
Assume the device may be compromised if you granted remote access. Change passwords from a clean device.

Speed helps only for the first hop — a bank recall, an exchange freeze. It does not justify paying a stranger who claims to be faster than the police.

2. Gold: the conservative story, the extraction tool

Two products, one metal

Gold is not a scam. Unsolicited gold is often a payment rail.

There are two consumer-facing patterns worth keeping separate, because the defense is different.

Pattern A — gold as the investment story

A new contact — often from a wrong-number text, a delivery mix-up, a dating app, or a professional-looking “family office” page — introduces a bullion or gold-trading programme. Early small profits appear on a dashboard. Larger transfers follow. Documents may carry forged central-bank or securities-regulator marks. Returns are said to come from overseas metal that needs an “activation,” “unlock,” or “customs” payment.

Illustrative 2026 cases fit a global template even when the currency is local: a Kuala Lumpur engineer lost about RM1.2 million after a Christmas cake-delivery message turned into a gold scheme across multiple company accounts. Separate investigations in the same market described a title-bearing promoter, an unregistered firm, and counterfeit central-bank paperwork around an RM8.4 million gold-investment complaint. Those are not uniquely Malaysian designs. They are romance-to-investment and affinity-plus-forged-letterhead, with gold as the costume.

Pattern B — gold as the last mile

In government-official impersonation scams, the victim is told that an account is under investigation, a fine is due, or “safe assets” must be purchased. Cash is withdrawn and converted into bullion so the money leaves a reversible bank rail. In November 2025, staff at a Singapore bullion dealer spotted this pattern during a purchase and alerted police; officers recovered about S$200,000 in bars from a collector linked to a government-official impersonation syndicate. The metal was the exit, not the thesis.

Older brand-name collapses still matter for decision-making. Long-running gold programmes can leave victims in forfeiture queues years later. “We will recover your Genneva-style allocation” from an unsolicited agent is how the next chapter starts.

What is known, what is not

Established: bullion can be a portfolio asset when bought from a dealer you can identify, with assay and serials you can check independently. Established: criminals use gold because it is liquid, feels prudent, and is harder to claw back than a card payment.

Emerging: how much of 2026 gold-related fraud is now paired with deepfake police or bank staff on a video call. Case reports exist. Clean global statistics do not.

Limitation: this publication cannot authenticate a specific bar, dealer, or certificate from a photograph. A hologram on a PDF is not an assay.

Checklist: gold pitches

Ask this	If the answer is no
Can you walk into the dealer and verify serials against the refiner’s own channel?	You are buying a story, not metal.
Do stated returns come from spreads and storage — or from new investors?	If new investors, treat as a transfer scheme.
Did a new online friend introduce the deal?	That is a recruitment channel.
Are you told to buy bars now and hand them to a courier or “compliance officer”?	That is cash-out, not investing.
Does any PDF carry a central-bank, police, or securities-regulator logo you did not fetch from the agency site?	Forgery until proven otherwise.
Is someone offering to recover gold you already lost, for a fee?	Second-hit recovery fraud. See section 1.

If gold already left the house

Report to local police immediately. Note dealer name, bar serials, time, and who collected the metal.
Tell the bank or card issuer on a number from the back of the card, not from the caller.
Do not buy a second lot to “prove funds” or “release a hold.”
If a regulator logo appeared on the paperwork, send the document to that regulator’s official fraud inbox — found on their site.

3. Fake GLP-1: the product may be empty, dirty, or someone else’s

Why this belongs in a scam briefing

Demand for semaglutide and tirzepatide outran supervised supply in several markets. That gap invited four overlapping offers that consumers often treat as one “cheaper Ozempic”:

Look-alike counterfeit pens in packaging that copies a licensed brand, sometimes even recycling a real lot number.
Compounded products that are not the approved drug, not reviewed the same way, and sometimes labelled with a pharmacy that does not exist.
“Research use only” peptides sold with human dosing instructions.
Oral “GLP-1” drops and herbals that, when tested, contained no GLP-1 analogue at all.

The financial loss is real. The medical risk is the larger decision. Wrong potency, no active ingredient, non-sterile injectables, and unsupervised titration are not coupon-code problems.

What regulators have documented

United States. The Food and Drug Administration has warned that counterfeit Ozempic has appeared even inside parts of the legitimate supply chain. In one public notice, seized counterfeit 1 mg pens used lot number PAR1229 — also used on authentic product — and could be distinguished by the placement of EXP/LOT text on the pen label. FDA has also described fraudulent compounded semaglutide and tirzepatide whose labelled pharmacy did not exist; warned firms selling unapproved peptides marked “for research”; and issued waves of warning letters in 2026 to telehealth companies over claims that implied compounded GLP-1 products were the approved drug or were “FDA-approved.” Compounded drugs are not FDA-approved. That is a legal fact, not a slogan.

Australia. In March 2026 the Therapeutic Goods Administration updated a safety advisory after laboratory testing of imported weight-loss products that claimed to contain GLP-1 or tirzepatide. Several oral liquids contained no GLP-1 and no GLP-1 analogue. The brand was the inventory.

United Kingdom and Europe. Pharmacy bodies have reported cloned websites and social accounts of legitimate online pharmacies used to sell counterfeit weight-loss pens. Patients sometimes noticed only after a cheap tirzepatide pen produced no effect. Medicines regulators have also flagged specific counterfeit Mounjaro batches in circulation.

Asia-Pacific enforcement. Customs and health authorities in multiple countries have reported sharp increases in illegal inbound GLP-1 parcels. In Malaysia and elsewhere, pharmacists have described AI-cloned pharmacy storefronts and AI-generated ministry letters used to sell unregistered products. Prescription-only status does not vanish because the listing is on a marketplace.

Limitation: a regulator alert about one lot or one country does not prove the pen in your drawer is fake — or genuine. It proves the channel is contaminated enough that source matters more than price.

Compounded is not a synonym for generic

When a licensed product is in shortage, some jurisdictions allow compounding for individual patients. That legal window has been used, and misused, as a marketing story. A compounded pen can be prepared carefully. It can also be made from unverified bulk powder, in a facility that is not sterile, at a dose the label does not match.

FDA has reported hundreds of adverse-event filings associated with compounded semaglutide. Many resemble known effects of the approved drugs. That does not make the two products equivalent. It means harm reports exist and quality is not guaranteed in advance.

We do not take a position on whether a specific patient should use an approved GLP-1 under a clinician. We do take a position on social-commerce injectables: they fail the evidence test.

Checklist: GLP-1 offers

Offer	Reality check
Telegram, marketplace, or “agent” pen at a fraction of clinic price	Treat as unregulated until the pack is verified through the national medicines register and a licensed pharmacy.
“Same as Ozempic / Wegovy / Mounjaro, just compounded”	Compounded is not approved and not interchangeable by slogan.
Oral “GLP-1 herbal” or multi-in-one drops	Several regulators found zero GLP-1 on testing.
Cloned pharmacy site or an AI ministry letter	Documented 2026 tactic. Check the pharmacy against the regulator’s own register.
“Research use only” with a human dosing card	The disclaimer is the tell. The customer is the patient.
No prescription, ships today, no cold chain	Not a shortcut. It is the inventory channel for fakes.
Seller offers a replacement “authentic” box after the first failed	Second hit. Keep the first pen for the clinic and the regulator.

If you already used a grey-market pen or vial

Stop further doses from that source.
Keep the box, pen, vial, batch/lot photo, and the listing URL.
Contact a licensed clinician. Bring the pack. Describe timing and symptoms without editing the story.
Report the product to your national medicines regulator. That is how lot alerts get built.
Do not accept a second unregulated shipment as a remedy.

Seek urgent care for severe abdominal pain, signs of allergic reaction, fainting, persistent vomiting, or symptoms your clinician flags as emergency signs. This article cannot triage you.

A single decision rule

Across all three markets, the cheap test is source-of-contact plus irreversibility.

You were contacted by	They want	Your move
A video of an official, a text, Telegram	A fee or a seed phrase	Hang up. Reload the agency site yourself.
A new friend or “Datuk / director / analyst”	A gold transfer or bar handover	No independent dealer, no deal.
A marketplace or cloned pharmacy	Payment for a pen	Licensed prescription channel only.
Someone who already knows your last scam	One more payment to “finish recovery”	You are on a list. Close the channel.

Key decision rule
Officials do not invoice victims. Exchanges do not ask for seed phrases. Ministries of health do not sell pens on chat apps. If the pitch requires you to believe all three at once, it is not sophisticated. It is stacked.

Official channels (type these yourself)

Do not use numbers, QR codes, or “portals” supplied in the message that warned you. Open a fresh browser. Type the domain.

United States

FBI Internet Crime Complaint Center (IC3) — cyber and crypto-related complaints.
FTC ReportFraud — consumer fraud, including recovery impersonation.
FDA: unapproved and counterfeit GLP-1 — medicines safety statements.
If a medicine caused harm: FDA MedWatch, via FDA.gov.

United Kingdom

Action Fraud — fraud reporting.
MHRA — suspected counterfeit or defective medicines.

European Union

National police cybercrime unit first, then the national medicines agency. EU-wide shopping-scam portals do not replace a local police file when money has already moved.

Australia

Scamwatch (ACCAN / ACCC) — consumer scams.
TGA safety alerts — counterfeit and unregistered GLP-1 products.

Singapore

ScamShield — reporting and blocking tools.
Police hotline / i-Witness for in-progress extraction, including bullion cash-outs.

Everywhere else

Local police report first when funds or medicines are already gone. Banks and card networks need a case number.
National medicines regulator for any injectable or tablet bought outside a licensed pharmacy.
National securities or central-bank fraud desk if the pitch was an “investment” with forged letterhead.

Interpol and the World Health Organization publish medical-product alerts that national regulators localize. Those alerts are starting points for lot numbers, not a substitute for a local clinic.

What this article is not

It is not a ranking of recovery companies. That search is how many people meet the second syndicate.
It is not a claim that all compounding is criminal. It is a claim that compounding is not a consumer shortcut around approval, sterility, and prescription law.
It is not investment advice about gold allocations.
It is not a guide to obtaining GLP-1 medicines. Approved products exist through licensed clinicians in many countries. That is a medical decision.

We will update this briefing when major agencies issue new public-service announcements, lot-specific counterfeit alerts, or material changes to how recovery impersonation is described. Lot numbers go stale. The funnel does not.

Sources and basis

Primary public warnings informing this briefing include: FBI IC3 public service announcement I-072026-PSA (20 July 2026) on impersonation of FBI/IC3 personnel and AI-generated video; earlier FBI advisories on fictitious recovery law firms; FTC consumer alerts on revictimization of fraud victims; CFTC investor alerts on recovery fraud; FDA statements on unapproved and counterfeit GLP-1 products, including counterfeit Ozempic lot communications and 2026 warning letters to telehealth firms marketing compounded GLP-1s; TGA safety advisory of 2 March 2026 on imported products claiming to contain GLP-1; national enforcement reporting on cloned pharmacy storefronts and illegal GLP-1 importation; and public police accounts of bullion used as a cash-out rail in government-impersonation cases.

Case examples are illustrative of method, not a complete map of every syndicate. Loss figures vary by agency, year, and whether a second payment is counted as a new crime. Where tallies conflict, we prefer the existence of the warning over a precise global dollar number.

One Day Advisor is an independent digital media publication focused on informed, evidence-aware decisions in finance, health, technology, and consumer trends. We do not replace professional advice. We aim to be a trusted starting point for understanding.