It usually starts with a pop-up warning or an unexpected phone call about your computer. By the end, a stranger has convinced a retiree to move their life savings into an account they promise is safe. This is the “phantom hacker” scam, and the FBI says it has drained more than $1 billion from Americans since 2024, with older adults hit hardest.
How the phantom hacker scam works
The scam is built to feel like a rescue rather than a robbery, which is what makes it so effective. According to an FBI public warning from its Internet Crime Complaint Center, it unfolds in three phases, with a different fake “official” showing up at each stage to keep the pressure on and the story believable.
Each phase hands you off to the next, so the victim never gets a quiet moment to step back and question the whole thing. By the time the final actor appears, the target has already been softened up by two earlier “helpers” who seemed to be on their side. The Internet Crime Complaint Center reports that older adults are hit hardest by this scheme, and that victims often lose entire retirement and savings balances, which is why it is worth understanding each step before it ever reaches you.
Free retirement updates: Social Security and Medicare change every year, and nobody sends you a memo. Our free Retirement Shield newsletter breaks down what changed and what to do. Get it free in your inbox.
Phase one: the fake tech-support agent
It begins with a phony tech-support contact, reached through a pop-up on your screen, a phone call, or an email. The person claims your computer or your accounts have been hacked and offers to help. To “fix” the problem, they talk you into installing software that gives them remote access to your computer.
That remote access is the hook. Once they are into your machine, they can see your financial accounts, make the threat feel real by pointing at your own balances, and set up the next stage of the con. The moment a supposed tech agent asks you to install software or hand over control of your computer over a warning you did not go looking for, that is the scam announcing itself.
Phase two and three: the bank and the government
Next, a second scammer calls posing as a representative from your bank or brokerage. This “agent” warns that your money is now at risk from a foreign hacker and that you need to act fast to protect it. The goal is to build urgency and fear so you stop thinking clearly.
Then comes the final actor, someone impersonating a U.S. government official, sometimes claiming to be from the Federal Reserve. This person sends an official-looking letter or email and pressures you to wire or transfer your savings into a new account they describe as “safe” or an “alias” account, and to keep the whole thing secret. In reality the account belongs to the scammer, and the money is often sent overseas where it is nearly impossible to recover.
The red flags that give it away
Even though the story shifts from one caller to the next, the warning signs stay the same, and learning them is the surest way to catch the con in progress. Be suspicious of any unsolicited contact that steers you toward installing remote-access software on your computer. Treat anyone who tells you to move your money to keep it “safe” as a scammer, full stop.
The other tells are pressure tactics. Demands for secrecy, insistence that you act right now, and requests for payment by wire transfer, gift cards, or cryptocurrency are all hallmarks of this scheme. Real institutions do not operate that way. If a contact combines even two of these, unsolicited outreach, a push to move money, secrecy, and a hard deadline, you are almost certainly looking at the phantom hacker playbook.
The one rule that stops it cold
There is a single principle that defeats this entire playbook: no real bank or government agency will ever tell you to move your money to protect it. Legitimate institutions do not ask you to wire funds to a new account, and the government never calls to demand payment by wire transfer, gift cards, or cryptocurrency. If someone tells you to do any of those things, that alone tells you it is a scam, no matter how official they sound.
Scammers rely on the fact that “move your money to keep it safe” sounds responsible in the moment. It is not. Your money is safest right where it is, in your own accounts, and any urgent instruction to relocate it is the red flag, not the rescue.
Protecting yourself and the people you love
A few habits make you a hard target. Do not click on pop-ups warning you about a hacked computer, and never call the phone number that a warning, pop-up, or message gives you, because that number connects straight to the scammers. If you get a call claiming your accounts are compromised, hang up. Then call your bank yourself, using the number printed on the back of your card, so you know you are talking to the real institution. You can also report the scheme to the FBI at ic3.gov, which is where the bureau tracks these cases.
Because this scheme targets older adults so heavily, it is worth having a plain conversation with parents, grandparents, and neighbors about it. Agree on a simple family rule: before moving any money in response to an urgent call, pause and check with a trusted person first. Scammers depend on isolation and speed, so a single phone call to a family member or the real bank is often all it takes to break the spell and keep a lifetime of savings where it belongs.
This article was produced with AI assistance and reviewed by a human editor. Figures are linked to their primary sources; where a claim could not be verified from the public record, we say so.
More Financial Reading
