A scam can begin with a warning that someone’s computer has been hacked and end with the victim personally transferring their savings to the criminals pretending to protect them.
The FBI calls one version of the scheme the “Phantom Hacker” scam. It typically uses several impostors playing different roles, including technology support workers, bank representatives and government officials, to make the story increasingly convincing.
New FBI data shows how expensive the broader category has become. The Internet Crime Complaint Center recorded 47,794 Tech/Customer Support complaints during 2025, representing $2,134,675,818 in reported losses.
The Cool Down highlighted the threat after GuideStone Financial Resources said it recently detected a sophisticated Phantom Hacker attempt against one of its members before any money was transferred.
The Scam Starts With a Fake Computer Emergency
The FBI describes the Phantom Hacker scam as a three-stage operation in which each new impostor is designed to make the previous caller seem more legitimate. The goal is to convince victims that hackers have compromised their financial accounts and that moving the money is the only way to protect it.
In the first stage, someone posing as a representative of a legitimate technology company contacts the victim through a phone call, text message, email or computer pop-up. The person claims there is a problem with the victim’s device and may instruct the victim to call a supposed support number or download remote-access software.
Once remote access is granted, the fake technician may pretend to run a virus scan and announce that the computer has been hacked or is at risk. The scammer can then ask the victim to open financial accounts supposedly to look for unauthorized transactions. In reality, the FBI says that step can give the criminal information about which accounts contain the most money.
The supposed technician then tells the victim that someone from the bank, brokerage or other financial institution will make contact to handle the financial side of the emergency.
A Second Scammer Pretends to Be From the Bank
The next contact appears to confirm the original warning. A second scammer poses as an employee of the financial institution and claims that a foreign hacker has gained access to the victim’s bank, investment or retirement accounts.
The fake financial representative tells the victim the money is no longer safe where it is. Instead of stealing the funds directly, the scammer persuades the victim to authorize the transaction personally, often framing the transfer as an emergency security measure.
The supposed solution may be a “safe” third-party account falsely described as belonging to the Federal Reserve or another government agency. Victims can be instructed to move money through wire transfers, cash or cryptocurrency, sometimes directly to recipients outside the United States.
The FBI says some victims are told to complete several transactions over days or even months. They may also be ordered not to tell relatives, bank employees or anyone else the real reason for moving the money, reducing the chance that another person will recognize the scam before the savings are gone.
A Fake Government Official Can Make the Story Look Even More Real
The third stage adds another layer of authority. A scammer may claim to represent the Federal Reserve or another U.S. government agency and reinforce the warning that the victim’s money remains in danger.
If the victim becomes suspicious, the criminals can send official-looking emails or letters using government names, logos or letterhead. Those documents are meant to make the previous calls seem legitimate and convince the victim that the supposed investigation is real.
The scammer continues pushing the victim to move funds into another account for “protection.” The FBI warns that victims have lost money from checking accounts, savings, retirement funds and investments while believing they were protecting those assets from hackers.
There is no safe government account waiting to receive the money. Once victims follow the instructions, the funds are under the criminals’ control.
GuideStone Says It Stopped One Attempt Before Money Moved
GuideStone Financial Resources issued a warning on Aug. 5 after saying it had recently helped identify a sophisticated Phantom Hacker attempt targeting one of its members.
GuideStone Director of Enterprise Risk Brandon Waldeck said the scheme exploits both fear and trust because victims believe they are securing their accounts or helping authorities with a legitimate investigation. The organization urged members to independently verify anyone claiming to represent a financial institution.
GuideStone also warned that caller ID can be spoofed. A telephone showing the name of a bank, financial company or government agency therefore does not prove that the person on the other end actually works there.
Tech and Customer Support Scams Cost More Than $2.13 Billion in 2025
The FBI’s 2025 Internet Crime Report recorded 47,794 complaints in the Tech/Customer Support category and $2,134,675,818 in reported losses.
That was a substantial increase from 2024, when IC3 recorded 36,002 Tech/Customer Support complaints and approximately $1.46 billion in reported losses. In 2023, the category accounted for 37,560 complaints and about $924.5 million in losses.
The FBI ranks Tech/Customer Support fraud as the third-largest 2025 cyber-enabled fraud category by reported losses, behind investment fraud at approximately $8.65 billion and business email compromise at roughly $3.05 billion.
Those statistics cover the broader Tech/Customer Support category rather than Phantom Hacker cases alone. The FBI does not provide a separate 2025 national loss total exclusively for the three-stage Phantom Hacker scheme, so the entire $2.13 billion should not be described as money lost specifically to Phantom Hackers.
Older Americans Reported More Than $1 Billion in Tech-Support Losses
People age 60 and older were particularly heavily represented in the FBI’s data. One age-specific table in the 2025 report lists 21,333 Tech/Customer Support complaints from people 60 and older and $1,040,730,043 in reported losses. The FBI has long warned that Phantom Hacker scammers commonly target older people who have accumulated savings, investment assets or retirement funds that criminals can exploit.
No Bank or Government Agency Needs You to Move Money to Keep It Safe
Anyone who receives an unexpected warning that a computer or financial account has been hacked should stop before downloading software, granting remote access or moving money. The FBI advises people not to use telephone numbers supplied in unsolicited pop-ups, texts or emails and not to give an unknown caller control of a computer.
Instead, independently contact the bank, brokerage, retirement provider or government agency using a telephone number taken from an account statement, payment card or the organization’s official website.
If remote-access software was installed, disconnect the device from the internet, contact a trusted computer-security professional and change important passwords from a different trusted device. Anyone who has already transferred money should contact the financial institution immediately and explain that the payment resulted from fraud.
Victims should also preserve telephone numbers, emails, text messages, screenshots, transaction receipts, bank-account information and cryptocurrency wallet addresses used by the scammers. The FBI asks victims to report Phantom Hacker and other internet-enabled fraud through IC3.gov as quickly as possible and include as much transaction and contact information as they can.