Recognize the three-phase “phantom hacker” scam before a fake tech-support call empties an account

The FBI describes a scam that chains a fake tech-support call, a fake bank fraud department and a fake government agent to persuade victims, often older adults, to move savings into a ‘safe’ account. Knowing the sequence and refusing unsolicited remote access stops it early.

Source facts

The FBI’s Phantom Hacker PSA describes an evolution of tech support scams that layers imposter tech support, financial institution and government personas. Between January and June 2023, IC3 received 19,000 tech support scam complaints with estimated losses over $542 million; almost 50% of victims were over 60 and they accounted for 66% of losses.

In phase one, a fake support representative gets the victim to install software that allows remote access, pretends to find a hack, and has the victim open financial accounts to see which is most lucrative. In phase two, a fake bank representative says a foreign hacker accessed the accounts and directs transfers to a ‘safe’ third-party account by wire, cash or cryptocurrency, and tells the victim not to say why. A fake government employee may follow with official-looking letters.

The FBI advises not to call numbers from pop-ups, texts or emails, not to download software or give control of a computer to an unknown person who contacted you, and notes that the US Government will never request money by wire to foreign accounts, cryptocurrency or gift cards. Victims should report to their local FBI field office and IC3, including account numbers that received funds.

Applicability

Use this for awareness training, customer communications and help-desk scripts. The figures are from the FBI’s 2023 announcement; current loss data may differ.

DSE recommendation

DSE recommends telling staff and customers, in writing, that your support team never cold-calls to request remote access or to move money. Publish the one phone number and portal people should use to reach real support, train help-desk staff to treat a caller describing this sequence as an active fraud case, and encourage employees to share the warning with older relatives.

Verification

Check that the support contact statement appears in onboarding material, invoices and the customer portal, and include a phantom-hacker scenario in the next awareness exercise. Track reports of impersonation calls using your company name and review them quarterly.

Official reference

FBI Internet Crime Complaint Center — “Phantom Hacker” Scams Target Senior Citizens (PSA230929). Reviewed October 18, 2026.