The "Phantom Hacker" scam: when fake tech support, your "bank", and a "government" official all work together
The Phantom Hacker scam runs in three phases — a fake tech-support alert, a fake bank call, then a fake government official — to convince you a hacker is in your accounts and you must move your savings to a "safe" account. It is your money, and once moved it is gone. Here is how it works and the free move that stops it.
The “Phantom Hacker” scam is a tech-support scam that grew teeth. Instead of one fake “technician”, it runs in three coordinated phases — tech support, then your “bank”, then a “government” official — each one impersonating someone you’d trust, all steering toward the same goal: convincing you that a hacker has invaded your accounts and the only way to stay safe is to move your money to a “protected” account. The hacker is invented. The money you move is real, and it goes to the scammers.
How the scam works
The FBI’s Internet Crime Complaint Center (IC3) lays out the layered script:
- Phase 1 — the tech-support imposter. A pop-up, call, email, or text about a computer problem gets you to call a number and install remote-access software. The “technician” claims your device is compromised and gets you to reveal which financial accounts you hold — to find the most valuable target.
- Phase 2 — the financial-institution imposter. Someone posing as your bank or brokerage calls to say “a foreign hacker has accessed your accounts” and your money isn’t safe where it is. They instruct you to move it — by wire, cash, or cryptocurrency.
- Phase 3 — the government imposter. To seal it, a fake official — often claiming to be from the Federal Reserve or another agency, sometimes with official-looking letterhead — confirms the danger and directs you to send your money to a “safe” government account. You’re told to keep it secret.
The FBI is blunt about the impact: between January and June 2023, it received about 19,000 tech-support-scam complaints with losses over $542 million, and older adults are hit hardest — almost half of victims were over 60.
The fact that ends it: no real bank or government agency tells you to move your money to a “safe” account to protect it. That sentence, from anyone, is the scam.
How to spot it
The tells are in the box below, but the shape to recognize is: a computer “problem” + a chain of callers (support → bank → government) + an instruction to move your own money somewhere “safe” + a demand for secrecy. Real institutions don’t operate as a relay team, and they never ask you to wire your savings to protect them.
What to do instead
You don’t need to buy anything to beat this — the free move comes first (see the defense box). The habit is The Pause on Money: the instant anyone tells you to move money, stop, and break the secrecy by talking to someone you trust before you act. Then call back on a number you trust — hang up and call your bank on the number on your card, never a number a caller gave you. The opening “your computer is infected” stage is covered in the tech-support pop-up scam and the refund twist in the tech-support refund scam; the government-official angle overlaps with SSA/IRS imposter scams. For more, see our defense moves and the 60-second quiz.
- It starts with a pop-up, call, email, or text about a computer problem that gets you to install remote-access software.
- A "bank" or "broker" then calls to say a foreign hacker is in your accounts and your money must be moved to protect it.
- A "government" official confirms the story and tells you to wire or send money to a "safe" account — and to tell no one.
- No real bank or government agency will ever tell you to move your money to a "safe" account to protect it. That instruction is the scam.
- Stop the moment you're told to move money, and break the secrecy by talking it through with someone you trust first.
- The US government will never ask you to send money by wire to a foreign account, by cryptocurrency, or in gift cards.
- Hang up. Don't call back any number they gave you — verify with your bank using the number on your card.
The Phantom Hacker works because it impersonates the exact people you'd normally turn to for help — IT, your bank, the government — so every instinct to 'check with an authority' just routes you to another scammer. The way out is to notice that no real authority on earth tells you to wire your life savings to a 'safe' account. The day a bank or a 'federal agent' says move your money to protect it, you've found the fraud, not the rescue. Hang up and call your bank yourself.
Sources
Frequently asked
A "bank" and a "government" official both confirmed the hacker — doesn't that make it real?
No. That layering is the whole technique. The FBI describes the Phantom Hacker as scammers "impersonating technology, banking, and government officials" in sequence, each persona vouching for the last to "enhance the trust victims place in the scammers". Multiple convincing callers is the scam working as designed — not proof.
They told me to keep it secret. Why?
Because the one thing that breaks the spell is a second opinion. Scammers tell victims "not to inform anyone of the real reason" precisely so no one you trust can say "that's a scam — don't move your money." Secrecy plus urgency is the tell.
I already moved money. What do I do now?
Act fast. Call your real bank on the number on your card to report it and try to stop or reverse the transfer, change passwords from a clean device, and have the computer checked for the remote-access software. Report it at IC3.gov. The sooner you flag a transfer that hasn't been collected, the better the chance of recovering it.