"Phantom Hacker" Three-Stage Tech/Bank/Government Imposter Scam

Overview

A multi-layered scam where fraudsters pose first as tech support, then a bank or brokerage, then a U.S. government agency to convince victims their money is at risk and must be moved to a "safe" account that scammers actually control.

How It Works

The FBI describes the "Phantom Hacker" scam as unfolding in three coordinated steps. A scammer posing as a customer support representative from a legitimate technology company initiates contact with the victim through a phone call, text, email, or a pop-up window on their computer and instructs the victim to call a number for "assistance."

Red Flags

• Unsolicited pop-up, text, or email claiming your computer or accounts have been hacked
• Being told to download remote-access software so 'tech support' can fix a problem
• A second caller claiming to be from your bank or brokerage saying your account was hacked by a foreign actor
• Instructions to move money into a 'safe' third-party account, often described as held by the Federal Reserve or another government agency
• Pressure to use wire transfer, cash, or conversion to cryptocurrency, sometimes sent overseas
• Being told not to tell anyone (including bank staff) the real reason you're moving money
• A third scammer posing as a government official sending fake official-looking letters or emails to keep the scheme going

Real Examples

• The FBI's Internet Crime Complaint Center reported that between January and June 2023 it received 19,000 tech support scam complaints with losses over $542 million, with victims over 60 comprising about half of victims and 66% of losses.
• In 2025, the FBI's Internet Crime Complaint Center received over 47,000 reports related to tech support scams, resulting in nationwide losses exceeding $2.1 billion, with about half of the victims and losses involving individuals aged 60 and older.
• GuideStone Financial Resources said it had recently detected and stopped a Phantom Hacker fraud attempt targeting one of its members before any funds were moved.

Where It Spreads

How to Protect Yourself

• Do not click on unsolicited pop-ups, links in texts, or email attachments claiming your device or accounts are compromised
• Never call a phone number provided in a pop-up, text, or unsolicited email — look up the real number yourself
• Never allow a stranger who contacted you to install software or take remote control of your computer
• Independently verify any claim that your financial accounts are compromised by calling your bank or brokerage directly using a number from your card or statement
• Remember that no legitimate government agency will ever ask you to wire money, buy cryptocurrency, or send cash/gift cards to 'protect' your funds
• If you've already sent money, report it immediately to your financial institution and file a complaint with the FBI's IC3.gov

Related Scams