The phone call that empties a savings account

In 2025, people aged 60 and over reported losing $7.75 billion to the FBI's Internet Crime Complaint Center, a 59 percent rise in one year, and 12,444 of them lost more than $100,000.

That is not evidence that older people are easier to fool. The Federal Trade Commission's data shows adults 60 and over report losing money to fraud at a lower rate than younger adults. What differs is the size of the loss, because what is taken is savings, and savings can be emptied in an afternoon.

The pattern

The Social Security Administration describes every scam it sees in four moves:

1. The caller pretends to be from an agency or company you trust.
2. They say there is a problem, or a prize.
3. They pressure you to act immediately.
4. They tell you to pay in a specific way.

The fourth move is the one nobody warns about. The criminal chooses the payment method because it decides whether the money can ever be recovered.

Everything here comes from federal agencies and federal law; states add protections of their own, and a few now have laws on cryptocurrency machines that the federal rules do not. This guide is educational information, not legal or financial advice, and the last section gives a source for every figure.

The FBI calls the most expensive version of this the Phantom Hacker. It runs in three acts, with three different voices.

1. Technical support. A pop-up or call about a problem with your computer, in the name of Microsoft or Apple. The person who answers connects to your computer, says your accounts have been hacked, and asks which accounts you hold. This is reconnaissance.
2. The bank. A second caller, from your own bank's fraud department, says the money must be moved to a safe account while the investigation runs: by wire, in cash or in cryptocurrency, and told to nobody.
3. The government. A third caller, from the Federal Reserve or another agency, adds letterhead and keeps the pressure on until every account is empty.

Each hand-off adds authority, and each keeps you on the phone. A voice raises the fear, and it stops you talking to the one person who would see through it.

Scammers name the payment method because protection follows the rail the money travelled on, not the story that was told. Social Security lists the methods criminals insist on: gift cards, precious metals, prepaid cards, wires, cryptocurrency and mailed cash, chosen because they are hard to trace. The table gives the federal floor for each; a state law, a card network or a bank's own agreement can add to it, never subtract.

The FBI sorts its complaints by type. For people 60 and over in 2025, five categories accounted for almost all of the money.

The slow investment scam looks least like a scam. It opens with a friendly or misdirected message, builds a relationship over weeks, then mentions an investment, usually in cryptocurrency. The FBI recorded $2.76 billion in cryptocurrency investment losses among people 60 and over in 2025. The site you are shown exists. The balance on it does not.

The cloned voice is built from recordings found online, and the FBI's answer is a family code word that a real relative in trouble would know and a recording would not.

Each line below is from the agency's own published rules.

Recovery is measured in hours. The money is chased first, the report second, and the police report can wait until evening.

First, the company that moved the money

• Bank or credit union, for a transfer, a debit card or Zelle: call the number on the back of the card, say a scammer tricked you or, if it is true, that you did not initiate the transfer, and ask for a reversal.
• Bank, for a wire: ask for a recall and a hold-harmless letter, the document the receiving bank needs before it returns funds.
• Gift card: call the number on the back, say it was used in a scam, and ask for the balance to be frozen and refunded. Keep the card and the receipt.
• Cryptocurrency: call the exchange, or the machine's operator, whose number is printed on the machine.
• Cash in the mail: request a Package Intercept at usps.com before delivery, then report the fraud to the Postal Inspection Service at 1-877-876-2455.

Second, the reports that trigger action

• ic3.gov, the FBI's complaint center. This is what can start the Recovery Asset Team on a wire; it froze $507 million in 2025, and only when reports arrived fast.
• ReportFraud.ftc.gov, or 1-877-382-4357, which offers an interpreter.
• oig.ssa.gov/report if the caller claimed to be Social Security, and 1-800-633-4227 if they claimed to be Medicare.
• IdentityTheft.gov if you gave out a Social Security number or account details. Its plan is for protecting your identity and credit, separate from getting the money back, and the identity theft report it generates unlocks a seven-year fraud alert and a four business day block on accounts opened in your name, both under federal law.

Most of this is a phone call or a conversation, and all of it happens before anything has gone wrong.

• Place a security freeze at all three credit bureaus. Under federal law it is free, placed within one business day by phone or online, and lifted within one hour when you need it. It stops new accounts being opened in your name; it does nothing to stop a payment already underway, which is what the same-day rule is for. Equifax 1-800-685-1111, Experian 1-888-397-3742, TransUnion 1-888-909-8872.
• Agree a family code word with every relative who could ever call you for money, and never write it online.
• Agree the same-day rule with the household: no money moves on the day of the call that asked for it. A real bank, agency or relative can wait until tomorrow. A criminal cannot, and will say so.
• Turn on two-factor authentication on your email first, because it is the key to every other password reset, then on each bank login.
• Save the National Elder Fraud Hotline, 1-833-372-8311, under a name you will find while upset, and confirm it at justice.gov if a year or two has passed.
• Write the number from the back of each bank and credit card on one sheet by the phone.
• Keep your Medicare card and Social Security number out of your wallet unless you need them that day, and give the numbers to your doctor and no one else.
• Set social media accounts to private, which the FBI advises to starve the cloned voice of material.
• Turn on your phone company's call blocking, and let unknown numbers go to voicemail.
• Check Medicare summary notices against your own calendar, and query any service you did not receive.
• Decide now which one person you would call first if money had just left, and tell them so.

Every 2025 figure for people 60 and over, and the $507 million frozen
FBI Internet Crime Complaint Center, 2025 Internet Crime Report. Retrieved September 1, 2026.

The lower loss rate for older adults and the three opening lies
Federal Trade Commission, "Protecting Older Consumers 2024-2025", December 1, 2025, and Data Spotlight, "False alarm, real scam", August 7, 2025. Retrieved September 1, 2026.

What the FTC never does, the gift card rule, and the steps for each payment method
Federal Trade Commission, testimony to the Joint Economic Committee, March 2026; "Avoiding and Reporting Gift Card Scams"; "What To Do if You Were Scammed", June 2026. Retrieved September 1, 2026.

The Phantom Hacker, what the U.S. government never asks for, the family code word, the wire recall, and the credit bureau numbers
FBI Internet Crime Complaint Center, "Phantom Hacker" and generative AI announcements, and "Elder Fraud". Retrieved September 1, 2026.

The four moves, the payment methods criminals insist on, and the July 29, 2026 notice on transferred calls
Social Security Administration and Office of the Inspector General, "Protect Yourself from Social Security Scams". Retrieved September 1, 2026.

How the IRS and Medicare make contact, and 1-800-633-4227
Internal Revenue Service, "How to know if it's really the IRS"; Medicare.gov, "Reporting Medicare fraud and abuse". Retrieved September 1, 2026.

The $50 credit card cap and the definition of unauthorized use
15 U.S. Code sections 1643 and 1602(p). Retrieved September 1, 2026.

The $50 and $500 caps, the definition of an unauthorized transfer, the exclusion of wires, and deception-obtained credentials
12 CFR 1005.6, 1005.2(m) and 1005.3(c)(3); Consumer Financial Protection Bureau, Electronic Fund Transfers FAQs. Retrieved September 1, 2026.

The free security freeze, the seven-year fraud alert, and the four business day block
15 U.S. Code sections 1681c-1 and 1681c-2. Retrieved September 1, 2026.

Package Intercept, the Postal Inspection Service, and the National Elder Fraud Hotline
U.S. Postal Service; U.S. Department of Justice, Office for Victims of Crime. Retrieved September 1, 2026.