The Scam That Starts With a Pop-Up and Ends With an Empty Account

It begins with something completely mundane. A window opens on the screen while she's reading the news — a security warning, the right shade of blue, the right logo, an alarm sound, and a phone number to call because her computer has been compromised.

Four days later her retirement account is empty, and she believes she did the right thing.

The FBI calls this the phantom hacker scam. It's an evolution of the ordinary tech support scam, and it is among the most financially destructive things happening to older Americans right now. Tech and customer support fraud was the second-largest loss category for adults 60 and over in the FBI's 2025 data, at $1.04 billion — behind only investment fraud. The Bureau has issued repeated public warnings about this specific pattern, and the reason is that it doesn't take a few hundred dollars. It takes the whole account.

Understanding the structure matters more than memorizing warning signs, because the structure is what makes it so hard to resist.

Three impersonators, one continuous call

The FBI describes it as a three-phase scheme. What makes it different from a garden-variety tech support scam is the handoffs — each phase legitimizes the next.

Phase one: the technician

The contact arrives as a pop-up, a call, an email, or a text, and it directs her to a number. Whoever answers is calm, competent, and helpful. He asks her to install a program so he can look at the machine — remote access software, the same kind IT departments use legitimately, which is precisely why it doesn't feel alarming.

He runs what looks like a scan. He reports bad news: the computer has been accessed by someone overseas. Then he asks her to log into her financial accounts to check for unauthorized activity.

That last step is the real purpose of phase one. He isn't looking for fraud. He's watching her screen, reading her balances, and deciding which account is worth taking. Everything before it was staging.

Phase two: the bank

Shortly after, someone calls from her financial institution. Fraud department. He already knows things — the name of her bank, roughly what she has, the fact that she's been dealing with a computer problem. That knowledge is the entire persuasive engine, and it feels like proof of legitimacy because how else would he know?

He tells her a foreign actor has access to her accounts and her money is not safe where it sits. It must be moved. There's a government-protected account it can go to, and he'll walk her through it. Wire transfer, or cryptocurrency, or in some versions cash or gold bars handed to a courier at the door.

He also tells her not to discuss this with anyone. There may be an insider at her branch. The investigation is confidential. Her family shouldn't be burdened.

Phase three: the government

If she hesitates — and many people do — a third voice arrives. Federal agency. Sometimes the Federal Reserve, sometimes an agency name she half-recognizes. If she's still uncertain, she receives a letter or an email on convincing government letterhead confirming everything the other two told her.

By this point she has been inside a single, continuous, coherent story for hours or days, told by three separate, professional, patient people whose accounts all corroborate each other. Nothing has contradicted anything. And she has been instructed, by all three, not to check it against anyone outside.

Then she moves the money, sometimes across multiple transfers over weeks, to protect it from a hacker who never existed.

Why intelligent, careful people say yes

This is the question families ask afterward, usually in a tone that doesn't help anyone. The answer isn't comfortable, but it's important.

It recruits caution, not carelessness. The pitch is not you've won a prize. It's your savings are under attack and you must act to protect them. The FTC has specifically flagged how these schemes turn older adults' vigilance about their own money into the lever that moves them. The people best positioned to be caught are the ones who take financial security seriously.

Nobody is ever left alone with a doubt. The continuous call is the design. In a normal decision of this size, a person would sleep on it, mention it at dinner, call a son. None of those intervals exist here — the phone doesn't hang up, and the moment doubt appears, there's a voice already in her ear ready to resolve it.

The corroboration is manufactured but feels earned. Three independent sources agreeing is, in ordinary life, extremely strong evidence. That instinct is well-calibrated for the world she grew up in. It is exactly the instinct being exploited.

The secrecy instruction is delivered as responsibility. Not "don't tell anyone" but "this is an active investigation and we need to control the information." She isn't hiding it out of shame at that stage. She thinks she's cooperating.

None of this requires cognitive decline, and framing it that way is both wrong and corrosive. Federal agents, bank executives, and attorneys have lost money to this scheme. It's a professionally operated social engineering script, refined across thousands of calls, and it is very good.

The four hard rules

Everything above collapses into a small number of rules that require no ability to judge whether a caller sounds real — which is the point, because they all sound real.

1. Never call a number that appeared on your screen. A pop-up that gives you a phone number is a scam essentially without exception. Legitimate operating system and antivirus warnings do not ask you to call anyone. Close the browser; if it won't close, hold the power button and restart. Nothing is lost.

2. Never let an unsolicited caller onto your device. No legitimate company calls out of the blue and asks to install remote access software. If someone is on the machine and you didn't initiate the contact, that alone is the answer.

3. There is no such thing as a safe account. No bank, agency, or investigator will ever ask anyone to move money to protect it. Not the Federal Reserve, not the FBI, not the Treasury, not the fraud department. The government does not take custody of citizens' savings for safekeeping, and it does not accept wire transfers, cryptocurrency, gift cards, cash by courier, or gold. This one rule, on its own, ends the scam at phase two.

4. Secrecy is the tell. Any instruction not to tell family is disqualifying, full stop, regardless of how sensible the reason sounds. It's the one element that appears in nearly every large-loss case, because the scheme cannot survive a second opinion. Teach it as an absolute: if they tell me not to tell you, that's when I call you.

What families can do that actually helps

Have the conversation before anything happens, and make it about the mechanic rather than the danger. Walking a parent through how the three phases hand off is far more protective than warning them that scams exist. People resist being told they're vulnerable. Most people quite enjoy being shown how a con works — it's interesting, and it doesn't imply anything about them.

Establish the callback rule as a household default. Any call about money, from anyone, gets hung up and returned on a number from a statement or the back of a card. Framed as policy, it isn't a comment on anyone's judgment. And it defeats this entire category.

Be genuinely available. The isolation is what does the damage, so make the interruption cheap. A parent who knows they can call at nine at night and ask does this sound right? without being made to feel foolish is dramatically safer than one who's been warned repeatedly. Every eye-roll about a forwarded phishing email raises the cost of that call, and the cost of that call is the thing that determines whether it gets made.

Add friction at the bank. Most institutions will set alerts on large transfers, add a verbal password, or flag an account for extra verification on wires. Some will note a trusted contact on file. These are ordinary retail banking features and they buy the one thing the scam is designed to eliminate: time.

If it's happening right now

If you have arrived at this page because a parent is currently on a call, or has just moved money:

• Get them off the phone. Not persuaded off — off. The frame doesn't break while the voice is still talking.
• Call the bank immediately, on a number from a statement. Wires can occasionally be recalled within a short window. Speed is genuinely the variable.
• Treat the computer as compromised. Disconnect it from the network and don't log into anything from it until it's been examined.
• Change the email password first, then the bank's, from a different device. Email is the master key to everything else.
• Report it at ic3.gov and ReportFraud.ftc.gov, and file with local police for the report number your bank will ask for.
• Expect the follow-up attempt. Victims are frequently re-contacted by "recovery" services promising to retrieve the money for a fee. Same operators, second harvest.

And when the practical part is handled, the conversation you have will determine whether they tell you next time. Not how did you not see it. Something closer to: these people do this full time, they had a script, and you were their job today. That's true, it's kind, and it's the only version that keeps the channel open.

---

Frequently asked questions

Will my parent's bank refund the money? It depends heavily on how the money moved. Transactions the customer authorized — even under deception — are generally treated differently from unauthorized ones, and wires, cryptocurrency, and cash are the hardest to recover. Report immediately anyway; institutions have discretion, some transfers are recallable inside a short window, and the report is a prerequisite for anything else.

How do I tell a real security alert from a fake one? Real ones never ask you to call a phone number. That's the whole test. Legitimate operating system and antivirus warnings appear inside the software itself and are dismissible; fake ones appear in a browser, resist closing, often play a sound, and always want you on the phone.

Is antivirus software enough to prevent this? No, and the assumption is a liability. Nothing is being installed by an attacker in phase one — your parent installs it voluntarily, in response to a phone conversation. This is a social engineering attack that happens to involve a computer, so the countermeasures are behavioral.

My parent has already lost money once. Are they more likely to be targeted again? Yes, meaningfully. Contact information for people who have paid once circulates among fraud operators, and recovery-scam follow-ups specifically target prior victims. This is the point at which added structure — transfer alerts, a second set of eyes, an agreed callback rule — is most worth the awkwardness of setting it up.

---

Ommpo Care gives a parent someone to call before they act, and gives families visibility into recurring charges and unusual billing at a parent's household. Plans from $49/month.

General information, not legal or financial advice. Sources: FBI Internet Crime Complaint Center public service announcements on phantom hacker and tech support scams; IC3 2025 Annual Report; FTC data spotlight on imposter scams, August 2025.