Phantom Hacker Crews Still Talk Victims Into Wiring Away Their Savings as Tech-Support Fraud Losses Clear $2.1 Billion

The hacker in the story never has to touch the bank. That is the design the FBI named the Phantom Hacker scam, and it is why the losses keep landing in a column that looks, on a spreadsheet, like the customer did it. A pop-up, a remote-control session, a second voice claiming to be the bank, and a third voice waving a federal seal: by the time a real fraud desk calls back, the victim has already wired the money to a “safe” account that is not safe and does not belong to the government.

The 2025 Internet Crime Report, released by the bureau in April 2026, puts a number on the parent category. Tech and customer-support fraud produced $2,134,675,818 in reported losses from 47,794 complaints. That made it the third-largest loss type in the file, behind investment fraud at about $8.65 billion and business-email compromise at about $3.05 billion. Outlets briefing the Phantom Hacker warning in August 2026 pointed at that $2.1 billion tech-support line. The bureau’s own September 2023 public-service announcement had already put the three-phase pattern itself above $1 billion. The method did not get a new name. It got a bigger receipt. (FBI, IC3 public service announcement)

Older adults take a disproportionate share of both the complaints and the dollars. People 60 and older filed 201,266 complaints in the 2025 report and reported about $7.7 billion in losses, up 37 percent from 2024, more than any other age group. The Phantom Hacker script is built for that group: calm voices, real balances on a shared screen, and a story that hanging up would be the reckless move.

Phase one inventories the richest account

It starts as tech support. A browser window locks. A text or an email says the machine is infected. A phone number sits in the corner like a help desk. The person who answers walks the target through AnyDesk, TeamViewer, or a lookalike with a name that sounds like a vendor the bank might actually use. Once the session is live, the operator “checks” bank and brokerage pages for charges that are not there. The real work is a list. Whichever account holds the retirement money gets marked for the next call. (WAPT)

Nothing in that first hour has to feel like a stickup. The tone is patient. The balances on the screen are real, because they are the victim’s own pages. The lie is that someone else is already inside. Fear does the authorizing.

Phase two splits the wire so the bank stays quiet

The second actor calls on a different number and claims to work for the victim’s bank, credit union, or brokerage. The script says an overseas crew is draining the account and the only protection is a transfer into a holding account run by the Federal Reserve, the Treasury, or a “recovery unit.” A single six-figure wire can trip a hold. Five smaller wires across a week look like a careful customer. When a teller starts asking questions, the script shifts to cash drop-offs or a conversion into cryptocurrency. (News 5 Cleveland)

New York’s attorney general put the same sequence in a statewide alert aimed at seniors. Credit unions keep reprinting one sentence: no real institution will ask you to move money in order to keep it safe. The sentence is easy to print on a poster. It is harder to remember when a stranger is watching the screen and a second stranger is reading the routing number back out loud. (New York Attorney General)

Phase three is a badge printed at home

The closer claims to be from the FBI, the Secret Service, or another federal office. Mock letterhead arrives. Spoofed caller ID makes the inbound number look local or official. Voice tools let the crew match a tone from the earlier call, so the third person sounds like a continuation instead of a new stranger. The request is always the same: the window is closing, do not call anyone else, move the funds now.

FBI Agent Charles Johnston, speaking to Cleveland television, put the psychology in one line: “They sound very legitimate and when a victim believes that their financial accounts are in jeopardy, they’re willing to take steps that they probably wouldn’t take if they thought it through.”

GuideStone Financial Resources spent early August 2026 warning retirement-plan members after it stopped a fraud attempt aimed at one of them before any money moved. That is not a new scheme. It is the same scheme reaching a benefits desk that was paying attention. In May 2026 the FBI’s Boston office described a separate shutdown of an India-based call-center operation that had targeted older victims with tech-support fraud. Different crews, same costume. (GuideStone)

A specialty product inside a record year

IC3 logged 1,008,597 complaints in 2025, the first time the center crossed a million in a single year, with reported losses of $20.877 billion. That is a 26 percent jump. About 453,000 of the complaints were cyber-enabled fraud, and those accounted for roughly 85 percent of the dollars. Cryptocurrency showed up in 181,565 complaints and more than $11 billion in losses. For the first time, the annual report carved out an artificial-intelligence section: 22,364 complaints and nearly $893 million, much of it voice clones and deepfakes bolted onto investment pitches and family-emergency calls. (SecurityWeek)

Phantom Hacker crews use the cheap end of that toolkit. They do not need a perfect deepfake of a celebrity. They need a number that looks like the branch and a sentence that makes delay feel like negligence. The FBI has used Operation Level Up to warn people who appear to be mid-scam, an effort it has credited with cutting losses by hundreds of millions of dollars. Operation Winter SHIELD, launched in 2026, is the follow-on campaign aimed at households and businesses that keep getting impersonation calls.

The AEGIS Alliance has tracked the neighboring racks: the romance-scam ledger the FTC put at $1.3 billion, the $21 million grandparent-scam indictment, the IRS-impostor mail that dropped remote-access tools on thousands of inboxes, and the 700Credit breach that put car-buyer Social Security numbers into a claims process. Different doors. The account ends up in someone else’s hands. More of that file lives under Hacker News and US News.

The only tell that still works

Do not call the number painted on a pop-up. Do not install software because a stranger said the machine is sick. Do not hand over remote control so someone can “check for fraud.” If a message claims the bank is on the line, hang up and dial the number on the back of the card or on a statement that was already in the house. A real bank will not ask for gift cards, a crypto conversion, or a wire to the Federal Reserve to “protect” a balance.

If a wire already left, the same day is the only useful day. Ask the sending institution for a recall. Some recalls land. Most do not once the receiving account has been emptied into a mule chain or a mixer. File at IC3.gov. People 60 and older can also call the Justice Department’s National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311). AARP’s Fraud Watch Network Helpline, 877-908-3360, puts a specialist on the line without a product pitch. A credit freeze at Equifax, Experian, and TransUnion is cheap insurance after any session in which a stranger watched account numbers.

Banks lose a lot of these disputes because the customer authenticated the transfer. The production quality of the call is no longer the tell. Spoofed IDs and cloned voices can look and sound official. The tell is the instruction: move the money somewhere new, right now, and do not check with anyone who actually knows you. Two billion dollars in a single tech-support year is not a rounding error in a retirement system. It is life savings walked out the door by the person who earned it, on the advice of a phantom who was never in the computer. If a window locks the screen, the safest next move is the power button.