Phantom Hacker Scam: The 3-Step Con That Empties Savings

The Phantom Hacker scam is a team effort. In September 2023 the FBI warned about a scheme that uses three fake helpers, one after another, to convince older adults that a hacker is about to empty their accounts. By the end, the victim has moved their own savings straight to the scammers. The FBI’s alert was titled “Phantom Hacker” Scams Target Senior Citizens and Result in Victims Losing their Life Savings.

It is a more elaborate version of the tech support scams the FBI says cost people 60 and older more than $1 billion in 2025. Read our alert on those losses.

What is the Phantom Hacker scam?

It is a tech support scam that turns into a bank and government impostor scam. The FBI says it often starts with a call, text, email or pop-up from someone posing as tech support, and ends with the victim wiring money, sending cash or buying cryptocurrency for “protection.” Victims are told not to tell anyone.

In the first half of 2023, the FBI’s Internet Crime Complaint Center (IC3) received 19,000 complaints about tech support scams, with estimated losses of more than $542 million. Almost half of the victims who reported were over 60, and that group accounted for 66% of the losses.

What happens in each of the three phases?

The FBI describes three phases:

1. The tech support impostor. A “support agent” contacts you and gets you to install software that gives them remote access to your computer. They run a fake virus scan, then ask you to open your financial accounts, which lets them pick the one with the most money.
2. The bank impostor. Next, someone posing as your bank or brokerage calls to say a foreign hacker has gotten into your accounts. You’re told to move your money to a “safe” third-party account, often described as an account at the Federal Reserve or another U.S. government agency. The transfers may go by wire, cash or cryptocurrency, sometimes over days or months.
3. The government impostor. If you start to doubt the story, a “Federal Reserve” or other government employee may send an email or a letter on official-looking letterhead. They insist your money is still not safe and must be moved again, to a new “alias” account.

EXAMPLE — SCAM

Today 3:20 PM●●● ▮

Incoming call (888) 555-0174

Caller: This is the fraud department at your bank. Our systems show a foreign hacker has accessed your savings and retirement accounts.

Caller: To protect your money, we’re moving it to a secure account held by the Federal Reserve. Do not discuss this with anyone, including bank staff at your branch. They may be involved.

Why do the callers tell you to keep it secret?

Because a family member, a friend or a teller at your branch would spot the scam. The FBI says victims are directed not to tell anyone, and the FTC has found that impersonators try to keep people on the phone so they can’t talk to anyone who could help. If a caller says your own bank staff can’t be trusted, that is a sure sign to hang up.

How is it different from a regular tech support scam?

A regular tech support scam usually wants a “repair” fee or a fake refund. The Phantom Hacker scam goes after everything in your accounts, using three different impostors to make the story feel confirmed. The FBI has also warned that some of these scammers send a courier to your home to collect cash, gold or other precious metals. See courier scams: when someone comes to pick up your cash.

The FBI’s advice for stopping it early:

• Don’t click unsolicited pop-ups, links in texts or emails, or attachments.
• Don’t call phone numbers that appear in pop-ups, texts or emails.
• Don’t download software because someone you don’t know asks you to.
• Don’t let anyone you don’t know take control of your computer.

The FBI adds that the U.S. government will never ask you to wire money to foreign accounts, send cryptocurrency or buy gift or prepaid cards. The same “move your money to protect it” story shows up in other bank impostor scams, too. See Zelle scams and the “safe account” trick.

What should you do if you already moved money?

Act right away:

• Call your bank at the number on your card or statement and ask it to stop or reverse any transfers. Our first-hour checklist after a scam covers each payment method.
• Report it to your local FBI field office and to IC3.gov. The FBI asks for the names of the people or companies that contacted you, their phone numbers, emails and websites, and the bank accounts and names your money was sent to.
• Get help if you are 60 or older. The National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311) helps with reporting.
• Watch for a second scam. People who lost money are often contacted by fake “recovery” services. See recovery scams.

To report the calls themselves, see how to report a scam call. If you help an older parent with their computer, our guide to protecting an aging parent from scams has simple steps to set up together.