White House Orders Multi-Agency Crackdown on Foreign Cybercrime Networks

President Trump signed an executive order on March 6, 2026 directing federal agencies to dismantle foreign transnational criminal organizations (TCOs) running scams, ransomware attacks, and fraud schemes against Americans. The order gives the State Department, DHS, DOJ, and Treasury 60 to 120 days to produce an action plan — and explicitly puts visa restrictions, sanctions, and expulsion of foreign diplomats on the table as enforcement tools.

Key Points

  • What: Executive order directing agencies to combat foreign-run cybercrime, scam centers, and fraud schemes targeting Americans
  • Who: Federal agencies, foreign governments linked to TCOs, and potentially visa holders from implicated countries
  • When: Action plan due within 120 days of March 6, 2026; Victim Restoration Program recommendation due within 90 days
  • Impact: Nations that tolerate TCO activity could face visa restrictions and sanctions, with ripple effects for their nationals in the US

What the Order Does

The order targets a broad range of criminal activity: ransomware, phishing, financial fraud, sextortion, impersonation, and forced labor schemes. It identifies foreign TCOs — sometimes backed by state actors — as the main culprits.

Key directives include:

  • 60-day review: The Secretaries of State, Treasury, Defense, and Homeland Security must review existing frameworks for combating TCO-linked cybercrime.
  • 120-day action plan: Agencies must submit a plan to the President identifying specific TCOs and proposing ways to disrupt and dismantle them.
  • New operational cell: A dedicated unit will be created within the National Coordination Center (NCC) to coordinate federal anti-cybercrime efforts and loop in private-sector cybersecurity firms.
  • DOJ prosecution push: The Attorney General is directed to prioritize prosecutions of cyber-fraud defendants, including scam center operators and sextortion schemes.
  • Victim Restoration Program: Within 90 days, the DOJ must recommend a program to return seized or forfeited funds to fraud victims.

The Immigration Angle: Visa Restrictions as a Tool

For visa holders, the most directly relevant section is the international engagement directive. The State Department is ordered to pressure foreign governments to crack down on TCOs — and if they don't cooperate, consequences can include:

  • Visa restrictions on nationals of non-compliant countries
  • Targeted sanctions
  • Trade penalties
  • Expulsion of foreign officials and diplomats complicit in TCO activity

This mirrors tools used in previous administrations, but the explicit directive to use visa restrictions as leverage is notable. If your home country is identified as a TCO safe haven, nationals — including students and workers in the US — could face increased scrutiny or travel complications.

What's Not Changing (Yet)

This is an executive order that directs agencies to develop plans — not a final rule that immediately changes visa processing, fees, or eligibility. No specific countries have been named. The real impact will depend on the action plan produced over the next 120 days.

What You Should Do

For most F-1 and H-1B holders, no immediate action is required. However:

  • Watch for country-specific visa restrictions if your home country is later linked to TCO activity. The State Department could move quickly once the action plan is finalized.
  • If you are a victim of cybercrime or fraud, the forthcoming Victim Restoration Program (expected within 90 days) may offer financial relief — watch for DOJ announcements.
  • Employers and HR teams should monitor whether any new sanctions affect employees' home countries, which could complicate international travel and visa renewals.

Stay tuned — the 120-day deadline puts the action plan around early July 2026.