{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-fbi-phantom-hacker-alert-three-persona-scam-drains-seniors-life-savings"},"incident":{"title":"FBI 'Phantom Hacker' alert: three-persona scam drains seniors' life savings","date":"2023-09-29","date_precision":"day","victim_org":"US senior citizens (multi-victim campaign)","sector":"Consumer","country":"United States","primary_vector":"Tech Support Scam","secondary_vectors":["Vishing (Voice Phishing)","Callback Phishing (TOAD)"],"ai_involvement":"No AI reported","ai_notes":"The advisory does not describe AI-generated voice or content in this campaign.","outcomes":["Wire Fraud / Financial Loss","Cryptocurrency Theft"],"loss_usd":542000000,"loss_note":"IC3 received 19,000 tech support scam complaints between January and June 2023 with estimated victim losses over $542 million; nearly half of victims were over 60 and accounted for 66 percent of losses.","records_affected":19000,"threat_actor":null,"summary":"On 29 September 2023 the FBI's Internet Crime Complaint Center warned about the Phantom Hacker scam, an evolved tech support fraud that layers three impersonated personas to move a victim's entire savings. IC3 logged 19,000 tech support complaints in the first half of 2023 with losses above $542 million, with people over 60 making up nearly half of victims and 66 percent of losses. By August 2023 losses had already exceeded the whole of 2022 by 40 percent.","how_it_worked":"Phase one is a supposed technology company representative reaching the victim by call, text, email or pop-up, who obtains remote access, shows fabricated virus scan results and reviews the victim's financial accounts to find the largest balance, then warns that the institution's fraud department will be in touch. Phase two is a caller posing as that bank or brokerage saying a foreign hacker has accessed the accounts and the money must be moved to a safe government account by wire, cash or cryptocurrency, with instructions to keep it confidential. Phase three is a purported Federal Reserve or government employee, sometimes sending official-looking letterhead, who confirms the story and presses the victim to complete the transfer.","lessons":"The confidentiality instruction is the diagnostic tell; bank staff trained to treat customer secrecy plus urgent large outbound transfers as a scam indicator, and mandatory cooling-off holds, break the chain.","confidence":"Confirmed","sources":[{"title":"'Phantom Hacker' Scams Target Senior Citizens and Result in Victims Losing their Life Savings","url":"https://www.ic3.gov/PSA/2023/PSA230929","publisher":"FBI Internet Crime Complaint Center"}],"entry_type":"campaign","slug":"2023-fbi-phantom-hacker-alert-three-persona-scam-drains-seniors-life-savings","year":2023,"loss_kind":"aggregate","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2023-fbi-phantom-hacker-alert-three-persona-scam-drains-seniors-life-savings"}}