Impersonation Scams
Scammers pose as a bank, brokerage, government agency, tech support or a known business to make victims move money to 'safe' accounts, pay fake debts, or hand over access.
What it is
Imposter scams have been the most-reported fraud category in FTC data for years. In 2025 the FTC logged more than 1 million imposter reports and over $3.5B in losses. Its 2026 data highlight notes that the largest reported losses came from criminals posing as financial institutions, with some individual losses over $1M. Victims were told to move whole bank balances, IRAs or 401(k)s to "protect" them.
Every version borrows authority, manufactures urgency and demands secrecy. The pretexts differ:
| Persona | Typical pretext | Typical ask |
|---|---|---|
| Bank, brokerage or fraud department | "Your account is compromised" | Move funds to a "safe account"; read out an OTP; approve a "reversal" |
| Government (FTC, FBI, IRS, SSA, FinCEN, courts) | Crime accusation, missed jury duty, frozen assets, back taxes | Pay a "fine" or "bond"; move money "for safekeeping"; hand cash to a courier |
| Tech support | Hacked computer, refund owed, subscription renewal | Remote access; "refund overpayment" returned; gift cards |
| Retailer or brand | Order problem, prize, refund | Gift cards; card details; account takeover of rewards or marketplace balances |
| Family or friend | Emergency, arrest, accident | Cash courier, wire, gift card (see Elder Financial Exploitation) |
The "phantom hacker" pattern (FBI IC3 PSA, September 29, 2023) chains three personas:
- A tech-support impostor gets the victim to install remote-access software, "finds" a compromise, and has the victim open their financial accounts. That reveals which account is worth targeting.
- A bank or brokerage impostor says a foreign hacker is in the accounts. The victim is told to move funds to a "safe" third-party account, often in several transfers over days or months, and to tell no one.
- A government impostor (often claiming to be from the Federal Reserve) sends official-looking letters to keep a hesitant victim moving money.
The FBI counted about 19,000 tech-support scam complaints in the first half of 2023, with over $542M in estimated losses. Nearly half of reporting victims were over 60, and they accounted for about two-thirds of losses. Cash-outs ran through wires (often overseas), cash, crypto, and gift or prepaid cards. FINRA's 2026 oversight report flags imposter websites and social profiles that impersonate firms, representatives and FINRA itself.
APP vs ATO. If the victim moves the money, it's an APP scam (Authorized Push Payment (APP) Scams). If the victim hands over credentials or OTPs and the criminal moves it, it's an Account Takeover (ATO) driven by social engineering. Often both happen in the same call. Your labeling and your Reg E posture must handle both (Regulation E and Unauthorized Transfers).
How it works
The scam depends on controlling the victim's attention during the transaction: keeping them on the phone, telling them what to answer when the bank asks, and pre-empting warnings ("the bank employee may be in on it").
Transaction footprint
| Stage | What you see in the data | Decision point |
|---|---|---|
| Contact | Inbound calls spoofing your number; SMS with links; search-ad clicks to look-alike sites; spikes in "did you call me?" contacts to your support | Spoofing and brand-abuse monitoring; support-contact trend alerts |
| Credential leg (hybrid) | OTP requested and entered moments after a customer call; password reset; new device enrollment; contact changes | Account Change Events; Passkeys and Phishing-Resistant Authentication removes shareable OTPs |
| Staging | Transfers between the customer's own accounts; investment liquidations; limit-increase requests; new payee added | Treat as scam precursors even when they look like routine self-transfers |
| Payment | Large first-time wire, P2P or RTP to a new payee (often an individual rather than a business); payment memo that echoes the script | Payee Confirmation and Payment Friction; typology-specific warning; hold-and-call |
| Off-digital | Large cash withdrawal at a branch; cashier's check; gold or precious-metal purchase; kiosk deposits | Teller scripts; Trusted Contact and Senior Investor Holds |
| Gift-card leg | Bursts of high-denomination gift-card purchases across retailers; fast redemption | Retail POS and issuer velocity (Gift Card Fraud) |
| After | Victim reports; caller ID evidence; repeat-victimization attempts | Classify as bank, government or business impostor (ScamClassifier); protect the account against re-contact |
Common variants
| Variant | What's different | Where it shows up |
|---|---|---|
| Safe-account transfer | The victim believes the destination is theirs or protected | Banks, neobanks, brokerages |
| OTP or approval capture | The victim reads out or approves; the criminal transacts | Any app with OTP-based step-up; see MFA Bypass and OTP Interception |
| Phantom hacker / multi-persona | Two or three personas over days | Older adults; large balances |
| Government or law-enforcement extortion | Arrest threats, jury duty, licenses (incl. professional licenses) | IC3 counted nearly 61,000 complaints and over $1.6B (January 2025–July 2026) |
| Courier and gold | Cash or precious metals collected in person | Older adults; Elder Financial Exploitation |
| Search-ad / SEO poisoning | Victim searches for support and lands on a criminal number | Banks, payroll, health savings accounts (IC3 2025) |
| Brand impersonation for rewards | "Points expiring," "refund owed" lures aimed at loyalty or marketplace accounts | Rewards apps, retailers; see Loyalty and Rewards Redemption Fraud |
Where it shows up
- Neobanks and Consumer Fintech and Payments and P2P: the main venue for safe-account and OTP variants. Instant rails make the decision window seconds long.
- Brokerage and Investing: victims are told to liquidate and move retirement assets. FINRA Rule 2165 lets firms hold disbursements for specified adults, and proposed Rule 2166 would extend fraud delays to all adults.
- Retail and Ecommerce: frontline staff are the last control for gift-card and gold purchases. Retail brands are also among the most impersonated.
- Cashback, Coupons and Rewards: impersonating the app's support to take over accounts holding cashback balances, and gift-card payouts used as the scam rail.
Impact
- FTC 2025: imposter scams over 1M reports and over $3.5B in losses. Bank transfers and crypto produced the highest aggregate losses.
- IC3 2025: government impersonation 32,424 complaints and about $798M; tech support 47,794 complaints and about $2.13B. Adults 60+ lost about $1.04B to tech support and $413M to government impersonation.
- Hybrid ATO: IC3's November 2025 PSA counted more than 5,100 impersonation-linked account-takeover complaints and over $262M since January 2025. Funds were wired quickly to accounts often tied to crypto wallets.
- Firm cost: reimbursement (voluntary, network-driven, or regulator-driven), complaint handling, brand damage when your name is the bait, and higher support volume.
Red flags
- Customer is on an active call while transacting, or remote-access software is present → Remote Access Tool Detection, Session Behavior Anomalies
- OTP or approval issued and used around an inbound call the customer believes came from you → Customer Contact Signals, Phone Risk Signals
- Customer says "the bank" or "the FTC" told them to move money; insists on secrecy; is visibly stressed → Scam Victim Indicators
- Funds staged from savings or investments, then a first large payment to an individual → Transaction Pattern Anomalies
- Payee or wallet seen in other victims' reports → Payee and Counterparty Risk, External Intelligence Feeds
- Recent contact or security changes before payout → Account Change Events
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Customer Education and Scam Warnings: clear promises ("we will never ask you to move money or read a code"), repeated in-app at the moment of risk | Gives victims a rule that contradicts the script |
| Prevent | Velocity and Exposure Limits on first payments to new payees and on same-day limit increases | Caps the safe-account transfer even when the warning is ignored |
| Prevent | Passkeys and Phishing-Resistant Authentication | No code for the victim to read out |
| Prevent | Customer Support Verification Protocols + outbound-call verification (in-app "is this really us?") | Lets customers check a caller against your systems |
| Detect | Real-Time Transaction Risk Scoring with call-in-progress and remote-access context | Scores the customer's situation along with the payment |
| Detect | Brand-abuse and spoofing monitoring | Early warning of campaigns using your name |
| Respond | Hold-and-call by trained specialists; Trusted Contact and Senior Investor Holds | Interrupts the scammer's control of the victim |
| Respond | Rapid recall (IC3 Recovery Asset Team, receiving-bank outreach) | Wires reported quickly have the best freeze odds |
Emerging variants and adversary adaptation
- More layers, more channels. The FBI's September 2026 PSA notes scammers using fake uniforms, mock government offices and AI-enabled video calls, and demanding payment through prepaid cards, couriers, wires, crypto and kiosks. It counted nearly 61,000 government-impersonation complaints and over $1.6B in losses from January 2025 to July 2026.
- Search and ads as the lure. Criminals buy search ads and poison results so victims call them when looking for support (IC3, November 2025). That gets around "don't trust inbound calls" education.
- Impersonating the defenders. The FBI has warned about scammers impersonating the IC3 itself. FinCEN warned in December 2024 about schemes abusing its name, including fake "FinCEN alerts" claiming accounts were frozen.
- AI voices and faces. Voice cloning makes "your bank" and "your grandson" sound right. See Generative AI and Deepfake Fraud.
- Adaptation to passkeys. As OTPs disappear, expect more pure APP (the victim sends the money) and more off-digital cash-outs (couriers, gold), which shifts the burden to payment-level and branch controls.
Related mechanisms
- Authorized Push Payment (APP) Scams: parent hub
- Elder Financial Exploitation: most high-loss impersonation victims are older
- Phishing and Credential Harvesting, MFA Bypass and OTP Interception, Account Takeover (ATO): the hybrid credential leg
- Gift Card Fraud, Money Mules: payment and receiving rails
- Investment Scams (Pig Butchering): shares the "recovery" and law-enforcement personas
Real-world examples
- Case Study - Zelle Scam Liability Disputes (2024-2025): impersonation-driven P2P losses at the center of US liability fights
- Case Study - UK APP Scam Reimbursement Rules (2024): impersonation is a major share of UK APP claims
- Case Study - Arup Deepfake Video Call (2024): executive impersonation by deepfake video (corporate)
- Case Study - Coinbase Support Insider Breach (2025): insider-leaked balances and history made exchange-impersonation calls convincing
- 2026-09-17 FBI updates its warning on government and law enforcement impersonation scams: over $1.6B reported lost from January 2025 to July 2026, paid by wire, prepaid card, courier and crypto kiosk
Sources and further reading
- FBI IC3 PSA I-091223-PSA: "Phantom Hacker" Scams Target Senior Citizens and Result in Victims Losing their Life Savings (September 29, 2023): three-phase persona chain, H1 2023 tech-support complaint and loss figures, age distribution, payment methods
- FTC testimony to the Joint Economic Committee (March 2026): imposter scams over 1M reports and over $3.5B in 2025
- PaymentsJournal: FTC reports record fraud losses, warns of bank imposter scams: bank-impersonation "move your money" pattern and losses over $1M
- FBI IC3 2025 Internet Crime Report: government impersonation, tech support, gold courier and 60+ figures
- FBI IC3 PSA I-091726-PSA: Scammers impersonating law enforcement and government officials: 2025–2026 figures, payment methods, AI-enabled video calls
- FBI IC3 PSA I-112525-PSA: Account takeover via impersonation of financial institution support: hybrid ATO, SEO poisoning, $262M
- FinCEN Alert FIN-2024-Alert005 on schemes abusing FinCEN's name: government-impersonation red flags
- FBI IC3 PSA: FBI Warns of Scammers Impersonating the IC3 (July 20, 2026): impersonation of the FBI's own complaint center (title and date confirmed via the IC3 PSA listing)
- FINRA 2026 Oversight Report: Cybersecurity and cyber-enabled fraud: imposter sites and account impersonation at broker-dealers
- Federal Reserve ScamClassifier model: bank, government and business impostor types for labeling