Coordinated Network Impersonates US Assistant Attorney General Across Platforms in Likely Attempt to Scam Fraud Victims
We identified a very likely coordinated network of accounts across Facebook, Instagram, Pinterest, Threads, TikTok, X, and YouTube that is impersonating U.S. Assistant Attorney General Colin McDonald, who serves in the Department of Justice’s National Fraud Enforcement Division.
We identified a very likely coordinated network of accounts across Facebook, Instagram, Pinterest, Threads, TikTok, X, and YouTube that is impersonating U.S. Assistant Attorney General Colin McDonald, who serves in the Department of Justice’s National Fraud Enforcement Division. The accounts portray McDonald as a "funds recovery specialist" who helps scam victims reclaim lost funds. Open-source indicators suggest the account administrators are primarily based in Nigeria. We examined five accounts per platform, but assess there are almost certainly dozens of others based on on-platform searches we conducted for variations of McDonald's name.
Online Activity
Accounts Timed to Appointment
The network contains older, very likely repurposed accounts that changed their names around May 2026 and new accounts created around that same month. This date corresponds to McDonald's April 1 swearing-in and initial news coverage of his role.
Evasive Handles Funnel to DMs
Across platforms, the accounts use different spellings of McDonald’s name (e.g., Colin Mcdonald, Collin McDonald). Their handles contain random numerals (e.g., mcdonald58796, collins.mcdonalds049), indicating an attempt to evade moderation or bulk or automated account creation. Their bios and post text solicit direct messages or funnel victims to closed and encrypted messaging platforms like WhatsApp and Telegram.
Facebook Ad Solicits Victims
Since July 24, one Facebook page has run an ad that repurposed a Fox News graphic to solicit reports and direct messages from fraud victims.
Testimonials Suggest International Targeting
Other posts from these accounts shared alleged testimonials from individuals thanking Collins for successfully recovering funds, including one of a U.K. man. This suggests that the operation also targets non-U.S. audiences.
Victim Confirms Script in Use
We found a Threads testimonial from an alleged victim who posted a screenshot of a direct message with a McDonald impersonator. The message used the fabricated backstory, suggesting that the script is in active use.
Why this matters
This campaign shows how easily bad actors weaponize platform trust signals — inauthentic Pages, AI-generated testimonials, and urgency tactics — to target seniors. The shared business address and domain infrastructure across multiple "front" accounts point to a repeatable operation, not an isolated scam, meaning takedowns of individual ads won't stop it. The end goal, harvesting contact data under the guise of Medicare advice, likely feeds lead-generation or telemarketing pipelines, extending harm well past the initial click.
How We Investigated This
Graphika's intelligence is built on a proprietary methodology developed over more than a decade of network analysis and open source investigation. Every insight we publish is grounded in rigorous, evidence-based research across the platforms, communities, and narratives that shape online discourse.
Network Mapping
We identify and map online communities based on how they interact, not just what they say, revealing the structural relationships between actors and audiences.
Narrative Tracking
We monitor how narratives form, evolve, and spread across platforms, distinguishing organic conversation from coordinated amplification.
Behavioral Analysis
We analyze patterns of behavior across accounts and networks to detect coordination, inauthentic activity, and influence operations.
Cross-Platform Intelligence
Our analysis spans mainstream and niche platforms, giving a complete picture of how information moves across the broader online ecosystem.
Expert Validation
Every finding is reviewed by our team of analysts, researchers, and subject matter experts before publication.
Graphika is the most trusted provider of actionable open-source intelligence to help organizations stay ahead of emerging online events and make decisions on how to navigate them. Led by prominent innovators and technologists in the field of online discourse analysis, Graphika supports global enterprises and public sector customers across trust & safety, cyber threat intelligence, and strategic communications, spanning industries including intelligence, technology, media and entertainment, and global banking.
Related Insights
Facebook Ads Promote Likely Scam World Cup Group Stage Ticket Sales
We identified four Facebook accounts that used Facebook Ads, stolen profile images, and near-identical text posts to market likely fraudulent sales of FIFA World Cup 2026 group-stage tickets.
Read the Insight
Scammers Post Meta Ads Offering Free Phones and Financial Aid Lure Senior Citizens
Ads on Facebook, Instagram, Messenger, and Threads are targeting U.S. senior citizens with promises of free smartphones, internet service, and "senior cards" for food, rent, or medical expenses.
Read the Insight
Russian Media, Pro-Kremlin Actors Cast US Travel and Ticket Restrictions as Undermining, Causing Chaos for World Cup
Pro-Kremlin actors online, including websites linked to pro-Russia Portal Kombat (PK) influence operation, shared reports about the U.S. denying entry to Somali referee Omar Artan for the FIFA World Cup and restrictions affecting Iranian players and supporters.
Read the InsightSee How Graphika Can Help Your Team Act on This Intelligence
This insight is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.