A Microsoft technician says your accounts are hacked — then the FBI calls to move your money
A three-phase scam — fake tech support installs remote access software, a fake banker confirms 'account compromise,' then a fake government agent directs you to wire funds, buy gold, or hand cash to a courier — to empty your savings.
Also known as: phantom hacker scam, three-phase tech support scam, fake government safe-account scam, Microsoft FBI account-transfer scam, tech support to government transfer scam
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Hang up immediately — no legitimate handoff from tech support to a bank to a government official ever happens by phone
- 2 Never wire money, buy gold, or send cryptocurrency at the direction of any unsolicited caller, no matter what agency they claim to represent
- 3 The Federal Reserve, FBI, FTC, IRS, and SSA do not operate 'safe' or 'escrow' accounts where civilians can park money — no such account exists
- 4 Call your actual bank directly using the number on the back of your card or on your official statement — not any number the caller provides
- 5 Tell a trusted family member immediately — the instruction to keep it secret is itself the biggest red flag
- 6 If a courier has arrived and you feel unsafe, do not open the door; call 911
- 7 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 8 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ You are contacted first — by pop-up, cold call, or text — claiming your computer or bank account is at risk
- ⚠ After the tech support call, a second caller presents as your bank's fraud department, confirming the 'breach'
- ⚠ A third caller, claiming to be the FBI, Federal Reserve, FTC, or Treasury, says to move your money to a 'government-secured account'
- ⚠ No government agency ever operates 'safe' or 'escrow' accounts for civilians — any such instruction is the scam itself
- ⚠ You are told to keep the entire matter secret from family and bank employees — secrecy is the scam's most important tool
- ⚠ The caller stays on the phone while you withdraw cash, wire funds, or visit a gold dealer
- ⚠ A courier may arrive at your home or a parking lot to collect cash or gold bars
- ⚠ You receive official-looking documents, case numbers, or fake government letterhead by email to build credibility
Sources
- FBI IC3 PSA230929 — 'Phantom Hacker' Scams Target Senior Citizens and Result in Victims Losing their Life Savings (Sep 2023)
- FBI IC3 — 2025 Internet Crime Annual Report: tech support scams at $2.1B, Phantom Hacker dominant variant (Apr 2026)
- DOJ District of Arizona — California Man Pleads Guilty to Role in Phantom Hacker Scheme Targeting Elderly Victims (2026)
- Fox News — FBI warns seniors about billion-dollar phantom hacker scam; AI driving surge (2026)
- AARP — Five of the Biggest Scams to Watch for in 2026: Phantom Hacker top senior threat
- HCSK Senior Scam Alerts — Phantom Hacker scheme active reports 2026
- Fortra — FBI warns seniors are being targeted in three-phase Phantom Hacker scams (2026)