Older Americans with retirement savings are losing everything to a fraud scheme the FBI calls the “phantom hacker” scam, a three-stage con in which criminals pose as tech support agents, then bank officials, then government representatives to convince victims their accounts have been breached by foreign hackers. The endgame is always the same: the target is told to move life savings into a supposed “safe” U.S. government account that is actually controlled by the scammers. The FBI’s Internet Crime Complaint Center issued a formal public service announcement about the scheme, and multiple FBI field offices have since released separate warnings as losses mount among seniors nationwide.
Why a three-phase con drains more from each victim
Most impersonation scams rely on a single urgent request: a caller pretends to be from the IRS, demands payment, and hopes the target complies before thinking twice. The phantom hacker scheme works differently. It layers three separate personas in sequence, each one reinforcing the story the last one told. A fake tech support agent first contacts the victim, often through a pop-up alert or unsolicited phone call, and claims the victim’s computer or financial accounts have been compromised. Once the target is alarmed, a second caller posing as a representative of the victim’s bank or brokerage confirms the supposed breach and urges immediate action. A third impersonator then appears, this time claiming to represent a federal agency, and directs the victim to move funds into an account described as a protected government holding.
Each handoff deepens the victim’s belief that the threat is real. By the time the “government official” arrives, the target has already heard the same story from two seemingly independent sources. That sequential trust-building is what separates the phantom hacker from a standard one-call scam and helps explain why individual losses can wipe out entire retirement accounts. The FBI’s Phoenix field office described victims as “typically older” adults whose life savings were targeted through this exact escalation pattern.
FBI and DOJ records trace the scheme’s spread
The IC3 published its initial public service announcement, designated PSA230929, identifying the phantom hacker as a growing nationwide threat aimed at senior citizens. That advisory described the full three-persona structure and warned that victims were being told foreign hackers had infiltrated their accounts. The FBI’s El Paso field office echoed the warning in its own release, adding a blunt corrective that there was never any hacker inside the victims’ systems or bank records.
A follow-up IC3 advisory, PSA240129, expanded the known tactics. Scammers were not limiting themselves to wire transfers. Some were instructing victims to liquidate retirement accounts or brokerage holdings, purchase gold or silver, and hand over cash and precious metals to couriers sent directly to victims’ homes. The physical retrieval step made recovery even harder because, unlike electronic transfers, cash and metals leave no clear digital trail and can be quickly moved or melted down. Investigators reported that once victims surrendered control of their assets, the money was almost always gone for good.
The FBI warnings emphasize that the criminals behind the phantom hacker scheme are organized and patient. Rather than blasting out mass robocalls, they often stay on the phone with a single target for hours, walking them through complex transfers and reassuring them at every step. In some cases, scammers have allegedly instructed victims not to tell family members or local bank employees what was happening, claiming the supposed “foreign hackers” might have insiders watching their accounts. That secrecy isolates victims from the very people most likely to recognize the scam.
Red flags and how to respond
Authorities stress that legitimate government agencies will never ask people to move money into a separate “safe” account, whether labeled as federal, insured, or protected. They also will not send couriers to pick up cash, metals, or gift cards from a private home. Any unsolicited pop-up that locks a screen and lists a phone number for “support,” or any caller who demands remote access to a computer, should be treated as suspicious.
Experts advise anyone who receives a call about alleged account breaches to hang up and contact their bank or brokerage using the number printed on official statements or the institution’s website, not a number provided in a pop-up or voicemail. If a caller claims to be from a federal agency, people should independently look up that agency’s public contact information and verify the story before taking any action. Seniors and their families are also encouraged to discuss these fraud patterns in advance so that older adults feel comfortable pausing and checking with a trusted relative before moving large sums of money.
The FBI asks victims or their relatives to report suspected phantom hacker incidents to the Internet Crime Complaint Center, even if the money appears unrecoverable. Detailed reports help investigators track patterns, identify common scripts and phone numbers, and coordinate with financial institutions that might be able to freeze transfers in progress. For older Americans who have already lost savings, reporting can also connect them with victim assistance resources and, in rare cases, restitution efforts tied to criminal prosecutions.
As the scheme continues to evolve, law enforcement officials say awareness is the most effective defense. The more people understand that multiple “helpers” appearing in sequence can be a coordinated fraud, the less likely they are to trust a stranger’s urgent instructions with a lifetime of savings.
Free tool for readers: Built for Americans 55 to 80: a free, plain-English retirement check. See your Retirement Safety Score — your 0–100 number and a few steps — in about five minutes, no account needed.
