Stalking America’s elderly

Fraudsters are targeting seniors with an emerging and sophisticated scam. From January to June, $542M was stolen through Phantom Hacker scams — a fraud that uses layers of social engineering to exploit a victim’s trust and pinpoint the most lucrative accounts to drain. According to the Internet Crime Complaint Center (IC3), people aged 60 or older were targeted in nearly half of reported cases and shouldered 66% of losses — often their entire life savings. Fraudsters are readily embracing this emerging typology — financial institutions need to recognize how Phantom Hacker scams operate and understand why a collaborative approach is crucial for decisive action.

Layers of social engineering

Phantom Hacker scams combine elements of tech support scams, financial institution imposter scams, and government imposter scams into a trilogy of events to trick victims into transferring funds into accounts under criminal control. Each stage adds another layer of social engineering, making the scam increasingly believable and difficult for real authorities to intervene.

Initially, a scammer posing as a tech support representative will contact the victim, gain remote access to their computer, and claim to uncover an active hacking threat against the device. The scammer then convinces the victim to log into their bank accounts to check for unauthorized charges. In fact, the fraudster is identifying the most valuable account to target before forwarding the victim to another fraudster.

Next, the victim is contacted by a different scammer who claims to be calling from the victim’s financial institution’s fraud department. The victim is told that their bank accounts have been completely compromised by the hacker, and funds must be evacuated to a safe account at a government agency, such as the Federal Reserve — often by wire and to overseas accounts.

Another scammer, roleplaying as an employee of the Federal Reserve or other government agency, may also contact the victim to reiterate the threat against their assets and add further legitimacy to the scam.

Collaborative insights essential

Through cunning use of social engineering, Phantom Hacker scams are highly effective and resistant to intervention — victims may be wholly convinced they are working with genuine experts and their funds are truly at risk. To prevent loss, financial institutions cannot rely on customer call-backs, or conventional fraud approaches that do not consider the full picture of payee risk. To combat this sophisticated scheme, an approach that analyzes your institution’s own valuable data, and uses insights from across a network of institutions to analyze the payment counterparty, is essential.

Combining behavioral evidence with these insights allows you to truly understand the risk associated with a payor and payees who do not bank at your institution. When combined with real-time interdiction, your institution gains the ability to take decisive action against fraudulent payments across commonly exploited channels such as wire.

As bad actors employ increasingly sophisticated and evolving methods, like Phantom Hacker scams, financial institutions require innovative and collaborative approaches to identify criminal activity and protect unsuspecting customers.