The FBI's 'Phantom Hacker Scam': How Seniors Are Losing Their Life Savings in Three Calls

The FBI is warning that a scam called the "Phantom Hacker Scam" has drained more than $1 billion from victims' savings and retirement accounts since 2024 — and older Americans are losing the most.

Here's the bottom line up front: this scam doesn't happen in one phone call. It happens in three, spread out over hours or even days, and each call is designed to make the next one seem more believable. By the time the third call comes, the victim isn't handing money to a stranger — they think they're protecting it from one.

If you understand how the three calls work, you can spot this scam the moment it starts. That's what this guide is for.

Last updated: 2026-08-16

---

What the FBI Is Actually Warning About

The Phantom Hacker Scam is an evolution of the classic tech support scam, but with one dangerous upgrade: it now pulls in a fake bank representative and a fake government official, so the victim gets "confirmation" from three separate directions that something is wrong and that moving their money is the only way to protect it.

The FBI says this scam has been accelerating, and investigators believe AI tools are helping scammers sound more convincing, respond faster to questions, and run more of these calls at once. Victims are overwhelmingly older adults — many losing their entire retirement savings in a single incident.

This isn't a scam that steals a little at a time. It's designed to empty an account in one coordinated push.

---

Call One: The "Tech Support" Impostor

It usually starts with a fake virus alert pop-up on your computer. A warning box appears, sometimes with a loud alarm sound, claiming your computer has been hacked and your bank accounts are at risk. It tells you to call a phone number immediately.

When you call, you reach someone claiming to be from Microsoft, Apple, Norton, or a similar company. They're friendly, calm, and reassuring — which is part of the manipulation. They tell you they need "remote access" to your computer to check for hackers, and they walk you through installing a remote-access program like AnyDesk or TeamViewer.

Once they're in, they can see everything on your screen, including any banking website you log into.

Nothing about this first call should ever happen. Microsoft, Apple, and antivirus companies do not put phone numbers in pop-up warnings, and they do not call you to report a hack — this is the same setup used in the broader tech support scam playbook. If you see a pop-up like this:

• Do not call the number on the screen
• Do not download any remote-access software
• Close the browser entirely (force-quit if it won't close normally) or restart your computer

---

Call Two: The "Bank" Impostor

A short time later — sometimes the same day, sometimes a day or two after — you get a call from someone claiming to be from your bank's fraud department, following the same script covered in our guide to bank impersonation scams. They already seem to know details about you, which makes them sound legitimate. In reality, the first scammer may have passed your information along, or the second caller may simply reference the "hack" you already believe is real.

This caller tells you that foreign hackers have accessed your bank account and that your money isn't safe there. They may say your account has already been compromised, or that a large fraudulent transfer is about to go through.

Then comes the part that makes this scam so effective: they tell you the money needs to be moved to a "safe" government-protected account — often described as being with the Federal Reserve, the FDIC, or a similar agency — to keep it away from the hackers.

This is the moment the scam becomes financially dangerous. No real bank will ever instruct you to move your own money to a different account to "protect" it from fraud. That instruction is the scam.

---

Call Three: The "Government" Impostor

If you hesitate at this point, the scammer has a third call ready. This one claims to be from the Federal Reserve, the Treasury Department, the SEC, or another federal agency. They confirm everything the fake bank representative told you — your money is at risk, and moving it to a designated "safe" account is the only way to protect it from hackers.

Having three separate callers — tech support, bank, and government — each confirm the same story is what makes this scam so effective. Each call is designed to remove any doubt the previous one left behind.

The scammers then walk victims through wiring money, moving funds via cryptocurrency ATMs, or in some cases physically withdrawing cash and handing it to a courier who claims to be a government agent collecting it for "safekeeping." Some victims are told to buy gold or silver bars and hand them directly to someone at their front door.

No real federal agency has ever asked anyone to wire money, buy cryptocurrency, withdraw cash, or hand over gold to a stranger to "protect" it. The Federal Reserve, FDIC, Treasury, and SEC do not manage individual citizens' bank accounts, and they never will.

---

Why This Scam Works So Well on Smart, Careful People

This isn't about gullibility. The Phantom Hacker Scam is built by professional criminal organizations that test and refine their scripts constantly. A few things make it especially effective:

• It builds false confirmation. One caller could be a coincidence. Three separate callers, each backing up the last one, feels like proof — the same manufactured-credibility trick used in the SSA fake call transfer scam, where a single scammer "transfers" a victim to a fake supervisor mid-call.
• It moves fast enough to prevent research. Scammers create urgency — "the hackers could drain your account in the next hour" — specifically so victims don't have time to call their real bank or a family member to check.
• It targets retirement accounts specifically. Victims are often told their IRA or 401(k) is at risk too, and are walked through liquidating retirement funds "before the hackers can."
• The remote-access step gives scammers real information. Once they can see your screen, they can view real account balances, which they then reference to sound even more credible.

If you've ever wondered how someone could lose their entire savings to a scam, this is how — not through one bad decision, but through a carefully engineered sequence where each step makes the next one feel safer, not riskier.

---

The Three Rules That Stop This Scam Cold

You don't need to memorize every detail of how this scam works. You just need three rules, and if you follow them, this scam cannot succeed against you.

1. Never call a phone number that appears in a pop-up warning. If you're worried your computer might actually have a problem, close the browser, restart the computer, and if you want it checked, take it to a trusted local repair shop or call a family member first.

2. Never install remote-access software for someone who contacted you. It's fine to use remote access with a company you called yourself, for a service you signed up for. It is never fine to let someone who called you, or who you reached through a pop-up, take control of your screen.

3. No real bank or government agency will ever ask you to move money to "protect" it. Not to a new account, not via wire transfer, not through a cryptocurrency ATM, and not by handing cash or gold to a courier. If anyone tells you this, hang up immediately. Then call your bank directly using the number on the back of your card — never a number someone gave you on the phone.

If you're ever unsure whether a call is real, hang up and call back using a number you looked up yourself. A legitimate bank or government agency will never object to you verifying who they are.

---

If You Think You're in the Middle of This Scam Right Now

If you're currently on the phone with someone, or you've already sent money, act immediately:

• Hang up now. Don't say goodbye, don't explain yourself — just hang up.
• Do not turn your computer back on until you've had someone trustworthy check it for remote-access software, if you installed anything during the call. Our guide to the signs your computer has been hacked explains what to look for once it's safe to check.
• Call your bank directly using the number on your card or statement, and tell them you may be the target of a scam.
• If you already wired money or sent cryptocurrency, act within the hour if possible. Banks and crypto exchanges have a narrow window to intercept a transfer before it's finalized.
• Report it to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov, and to the FTC at reportfraud.ftc.gov.

You did not do anything wrong by trusting people who claimed to be protecting you. That trust is exactly what this scam is engineered to exploit.

---

How to Make Sure This Never Gets a Foothold

The single best defense against the Phantom Hacker Scam is catching it at call one — before any remote-access software gets installed and before any money moves. A few habits make that much easier:

Set your computer to block pop-ups with phone numbers. Most browsers can be configured to block these warning-style pop-ups entirely, which removes the scam's usual starting point.

Use identity and account monitoring that alerts you the moment something looks unusual. Aura monitors your bank accounts, credit, and Social Security number around the clock and sends an alert if it sees unusual activity — including the kind of large, unexpected transfer this scam is designed to trigger. It also includes up to $1 million in identity theft insurance if fraud does get through, and lets you add family members to the same plan so everyone's accounts are watched.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

Keep a family "verification password" for financial emergencies. Agree on a simple phrase with your spouse or adult children that anyone can ask for if a call ever claims your money is at risk. A real bank or agency will never object to you pausing to verify — a scammer trying to keep you on the phone will.

---

The Bottom Line

The Phantom Hacker Scam works because it's patient. It doesn't ask for your life savings in the first phone call — it spends hours building a false sense of confirmation across three, so that by the time the ask comes, it feels less like a decision and more like a formality.

Break the chain at any point and the scam collapses. Don't call the number in the pop-up. Don't let a stranger control your screen. And never move money because someone told you it needed "protecting." Those three rules are all it takes.

---

Think you or a loved one may be dealing with this scam right now? Don't wait — hang up, call your bank directly, and report it to the FBI at ic3.gov.