Teams of scammers claim to be tech support, banks and government agencies

-
The "Phantom Hacker" scam involves a coordinated team of fraudsters posing as tech support, financial institutions, and U.S. government agencies to convince victims their devices and money are at risk.
-
Scammers use fake pop-ups, remote access software, and fabricated threats to trick victims into transferring funds to supposed safe accounts via wire transfers, cryptocurrency, or cashall under the guise of protecting their finances.
-
Red flags include unsolicited tech support pop-ups, urgency to act, demands for remote access to devices, pressure to move money using untraceable methods, and instructions to keep the activity secret.
The tech support scam has always been dangerous because victims often act without thinking when told their devices have been hacked. When told their money is at risk, they often panic.
Since 2023, the FBI has warned of a tech support scam on steroids the Phantom Hacker scam.
It often starts with a pop-up on the victims phone or computer, telling them their device has been compromised and instructing them to call a tech support number. When they do, they are connected to a team of scammers.
The first scammer directs the victim to download an app, allowing the scammer remote access to the victim's computer. The scammer pretends to run a virus scan on the victim's computer and falsely claims the computer has been or is at risk of being hacked.
Next, the scammer requests the victim open their financial accounts to determine whether there have been any unauthorized charges - a tactic the scammer uses to determine which financial account is most lucrative for targeting. The scammer chooses an account to target and tells the victim they will receive a call with further instructions from the fraud department of the respective financial institution hosting that account.
Team effort
A scammer posing as the victims financial institution contacts the victim. The scammer falsely informs the victim that their computer and financial accounts have been accessed by a foreign hacker and the victim must move their money to a "safe" third-party account, such as an account with the Federal Reserve or another US Government agency.
The scammer directs the victim to transfer money via a wire transfer, cash, or cryptocurrency, often directly to overseas recipients. The scammer may instruct the victim to send multiple transactions over a span of days or months.
The scammer tells the victim not to inform anyone of the real reason they are moving their money.
Finally, the victim may also be contacted by another scammer posing as an employee at the Federal Reserve or another U.S. Government agency. If the victim becomes suspicious of the government imposter, the scammer may send an email or a letter on what appears to be official U.S. Government letterhead to legitimize the scam.
The scammer continues to emphasize that the victim's funds are "unsafe" and that they must be moved to a new "alias" account for protection until the victim concedes.
Red flags
While this scam continues to be highly effective, there are several red flags that should tell the target they are being taken for a ride.
- Unsolicited contact: The pop-up is the first contact, sometimes claiming to be from Microsoft tech support. Microsoft has said it does not contact consumers in this way.
- Urgency: The victim is told they must act immediately to prevent the loss of their money.
- Device access: The victim is told they must download software and give complete strangers access to their financial accounts. This should never be done.
- Funds transfer: The victim is told they must move money in an unusal and untraceable manner, using either a wire transfer, cryptocurrency or gift cards.
- Secrecy: The victim is told not to tell anyone what they are doing. There is no reason for this, other than to prevent the victim from getting practical advice from a friend or family member.
The FBI reminds the public to beware of Phantom Hacker , where cyber criminals use a 3 prong attack against victims using tech support, financial institution, & government impersonation simultaneously, the FBI said in a post on X.
Posted: 2025-07-25 12:01:35