What to do about the phantom hacker scam
It usually starts with a warning. A pop-up freezes your screen, or a caller who says they are from Microsoft, your bank, or a security team tells you something alarming: a foreign hacker has broken into your accounts and your money is being drained as you speak. The only way to protect it, they say, is to move it somewhere safe. It feels like someone has finally noticed the danger and is helping you get ahead of it. That feeling is exactly what the phantom hacker scam is built to create.
So let’s be clear about what this is. The phantom hacker scam is a con, and the “hacker” they keep warning you about does not exist. The FBI has warned that this scheme has drained entire banking, savings, retirement, and investment accounts, often from older adults, by convincing people to hand their money over while believing they are rescuing it. Once you can see the shape of it, the fear it runs on starts to fade.
Why it works in three acts
What makes the phantom hacker scam so effective is that it is layered. According to the FBI’s IC3 alert, it typically unfolds in three phases, each one designed to make the next feel more believable.
In the first phase, a “tech support” impersonator makes contact through a pop-up, a text, an email, or a call, and gets you to install remote-access software or open your accounts while they watch. In the second phase, someone claiming to be from your bank or a financial institution’s fraud department calls to confirm the bad news: yes, hackers are in your accounts, and you need to move your money to protect it. In the third phase, a person posing as a government official, often the FBI or the Federal Reserve, backs up the story and pressures you to wire the money, send cryptocurrency, or convert it to cash for a “safe” account. Each voice seems to independently confirm the others, and that is the whole trick.
The one rule that ends it
There is a single fact that collapses the entire script: no real government agency, and no real bank, will ever tell you to move your money to a “safe account” to protect it. That account does not exist. The FBI has said plainly that the U.S. government will never ask you to wire money to a foreign account, buy cryptocurrency, or send gift or prepaid cards. A genuine bank secures your existing accounts in place; it does not ask you to empty them into somewhere new.
The payment methods are the other tell. Wire transfers, cash handed to a courier or deposited at a Bitcoin ATM, and cryptocurrency are the channels criminals rely on because the money moves fast and is very hard to recover. If anyone frames urgency and secrecy around one of those methods, that is the scam showing its hand.
If you are on the call right now
Stop and hang up. You do not owe the caller anything, and the longer you stay on the line, the more room they have to work. A few things worth holding onto:
- Do not move, wire, or withdraw any money, and do not buy cryptocurrency or gift cards, no matter how urgent or official it sounds.
- Do not install any software or grant remote access to your computer, and if you already did, disconnect the device from the internet and shut it down.
- Do not keep it secret. Scammers insist you tell no one precisely because an outside voice breaks the spell. Talk to someone you trust before you do anything.
- If you want to check on your accounts, call your bank using the number printed on your card or statement, never a number the caller gives you.
If you already moved money or gave access
If money has already left your accounts, act quickly, because the first hours matter most. Call your bank or the wire department immediately, tell them it was a scam, and ask whether the transfer can be recalled or frozen. If you sent cryptocurrency, our guide on what to do in the first 24 hours after a crypto scam walks through the steps that still help. If you gave someone remote access to your computer, our note on what to do after giving a scammer remote access covers how to lock things down.
Save everything while it is fresh: phone numbers, names and titles the callers used, screenshots of pop-ups or messages, and any transfer receipts or confirmation numbers. Our guide on preserving evidence in the first 24 hours explains how to capture it cleanly so investigators can use it later.
Report it, even if you didn’t lose money
Reporting is what helps investigators connect these calls to the operations behind them. File with the FBI’s Internet Crime Complaint Center at IC3.gov, and report the fraud to the FTC at ReportFraud.ftc.gov. If personal information was exposed, you can step through a recovery plan at IdentityTheft.gov and consider a free fraud alert or credit freeze. Reporting rarely brings money back on its own, but it gives the people who can act something concrete to work with, and it helps warn the next person who gets the same call.
This scam is engineered to make you feel like the only safe move is to act fast and tell no one. The opposite is true. Slowing down, hanging up, and saying it out loud to someone you trust is almost always enough to make the phantom hacker disappear.
— Gus