Imagine this call. Your granddaughter says, “Grandma, I’m okay, but I need you to listen.” You recognize the little catch in her voice. She says she was in a car accident. A man takes the phone, introduces himself as her attorney and offers to send someone for bail money. You reach for a pen. Then comes the instruction that gives you pause: “Keep me on the line while you go to the bank.”

This is a hypothetical scenario. You could spend the next ten minutes listening for a mechanical note in the voice. A better use of the next ten seconds is to hang up and call your granddaughter at the number you already have. If she really needs help, you can still help her. If a stranger has borrowed her voice, you have just taken away the stranger’s most important advantage: control of whom you talk to next.

What older Americans actually reported losing

During 2025, people aged 60 and older filed 201,266 complaints with the FBI’s Internet Crime Complaint Center (IC3), reporting about $7.75 billion in losses. Investment schemes accounted for roughly $3.5 billion, followed by tech and customer support scams at about $1 billion. Confidence and romance fraud accounted for $584 million, business email compromise for $568 million, and government impersonation for $413 million. These are complaints about internet crime. The figures do not tell us how many involved AI. [1]

The FTC’s October 2026 report gives a different view of the same year. Adults 60 and older reported approximately $3 billion in fraud losses to its reporting system. Roughly 74% of older adults’ fraud reports indicated no monetary loss. Many people saw the approach, recognized what was happening and reported it. [2]

How much was actually lost? Nobody has a complete count. The FTC modeled underreporting and estimated a range of $13.3 billion to $119.5 billion for 2025. The wide spread reflects uncertainty about how often losses go unreported, particularly large ones. The upper figure is an estimate under a set of assumptions. The FBI and FTC collect different reports that can overlap, so adding their totals would produce a misleading answer. [2]

A family emergency, complete with a familiar voice

Hypothetical. A caller who sounds like your son says his phone broke in an accident. A second caller supplies a badge number and a court reference. The first call is meant to frighten you. The second is meant to make sending money feel like the responsible thing to do. A short recording from a public video can supply material for a voice imitation. A real photograph, surname and hometown can supply the rest of the scene. [3]

Real operations used this script long before voice cloning became widely available. In July 2026, federal prosecutors in Massachusetts reported four guilty pleas in a Dominican Republic call-center operation. Investigators identified more than 400 victims, with an average age of 84, and losses exceeding $5 million. The case documents organized family impersonation. The DOJ account does not establish voice cloning in those calls. [4]

Call your relative using a saved number. If they do not answer, try a second family contact. Verify any alleged detention directly with the relevant agency using its published number. If you believe someone is in immediate physical danger, call 911. If a courier is on the way to collect cash, stay inside, contact local police and avoid confronting the person.

When a video call seems to settle the question

Hypothetical. Someone claiming to be your retirement adviser invites you onto a short video call. The face matches the firm’s website. The caller says a transfer must clear before the markets close and sends new wiring instructions. A recognizable face may answer “Who does this look like?” It cannot answer “Who controls this account or where will my money go?”

The FBI describes criminals using generated video to impersonate executives or authorities and generated images to support fictitious identities. A synthetic identity can combine real details with invented ones. A professional biography and several social profiles can all belong to the same fiction. In a separate campaign reported in May 2025, the FBI documented AI-generated voice messages impersonating senior government officials. That campaign targeted officials and their contacts, illustrating the technique rather than measuring its prevalence among retirees. [3] [5]

End the meeting and ring the office using a statement already in your possession. Ask whether the named person requested that specific amount and destination. A second video on the same messaging account proves little. If you have already signed or sent instructions, call the institution’s fraud desk immediately and ask it to hold the transaction and check for changed contact details.

A new companion who remembers everything

Hypothetical. A person you meet in an online gardening group remembers your appointment on Thursday and asks how it went on Friday. Weeks later they offer to show you how they invest. They never ask you to send money to them personally. Instead, they help you open an account on a convincing investment site that they chose. The relationship and the website are two parts of the same request.

AI-generated portraits, translation and chatbot-assisted replies can help one operator sustain several conversations. A real person may also be writing every word. Automation makes it cheaper to maintain many personas and hands a practiced human persuader conversations that are already warm. Neither polished prose nor a bad video connection will settle the matter. Pay attention when affection becomes conditional on secrecy, a loan, an emergency payment or a move to a particular financial platform. [3]

Keep financial decisions separate from the relationship. Show the actual messages to someone you trust before sending money. A reverse-image search can reveal a stolen photograph, but a search with no matches cannot authenticate a new one. If you have paid, save the chat, account identifiers and receipts, contact the payment provider and report the profile. A helpful first response from family is, “I’m glad you told me. Let’s call together.”

The bank, the retirement account and the investment that always goes up

Hypothetical. A sponsored video appears to show a well-known investor recommending a trading service. Your small deposit grows on screen. You can even withdraw a little. When you try to take back a larger sum, a representative says you must deposit more to cover a tax. The dashboard is controlled by the people asking for the next payment. Its balance is no independent record of assets.

A second version begins with a bank fraud alert. The caller knows your name and the last few digits of an account, then tells you to move savings to a “safe account.” A transfer you initiate can leave your control just as surely as a transfer made with a stolen password. A request to liquidate retirement holdings also deserves a conversation with the custodian about consequences before any sale.

Sign in through your usual app. For an investment pitch, look up the person and firm through FINRA BrokerCheck or the SEC’s Investment Adviser Public Disclosure and call the firm using independently obtained details. Criminals borrow the names and registration numbers of real professionals. If money moved, tell the sending institution exactly how and where. For cryptocurrency, give the exchange the wallet address and transaction ID. Decline anyone demanding an advance fee to recover it. [6] [7]

A government badge, a Medicare number and a threat

Hypothetical. A “Medicare employee” says your card must be replaced today and asks you to read its number aloud. Other scripts say your Social Security number has been suspended, the IRS wants immediate payment, or a sheriff will arrest you for missing jury duty. The goal may be a benefits identifier for fraudulent claims, an account takeover, or immediate cash. A spoofed local number and a convincing badge image lend a stranger borrowed authority.

In September 2026 the FBI warned about law-enforcement impersonators threatening arrest over missed court appearances or jury service. Its count covered all ages. One revealing instruction is to stay on the phone and avoid discussing the payment with anyone. A caller who supplies both the accusation and the number to “verify” it controls both ends of the investigation. [8]

Use the number on your Medicare card, your existing Social Security account, IRS.gov, or the court’s official directory. If you gave away a Medicare number, tell Medicare and review your claims for unfamiliar services. If you disclosed a Social Security number, begin an identity-theft recovery plan and consider freezing your credit separately with all three nationwide credit bureaus. A freeze helps prevent new credit accounts. You still need to protect existing accounts. [7]

The support technician who hands you to the bank

Hypothetical. A full-screen warning with a Microsoft or Apple logo says your device is infected. You call the displayed number. A technician asks you to install a screen-sharing tool, then transfers you to someone who appears to work for your bank. The second person describes exactly what appeared on your screen. That knowledge can come from the first person watching you.

In May 2026, a federal court sentenced Zhao Wang to 151 months in prison for leading a fraud and money-laundering operation. DOJ described how supposed support numbers reached scam call centers, while people in the United States collected victims’ money. Investigators identified over $27 million in losses during 2021–2023. At sentencing, Judge Robert S. Huie said of the choice of victims, “Their vulnerability was not incidental.” The evidence here shows a division of labor between call centers and cash collectors. [9]

Close the alert and contact support through your normal route. If you granted remote access, disconnect that device from the internet. Use another device to call your bank and secure your email. Have a trusted technician inspect the affected equipment, including tools configured for unattended access, before using it for banking again.

A message with just enough truth

Hypothetical. An email names your former employer and refers to a genuine retirement-plan change. It sends you to a benefits portal asking for your password and the code that just arrived by text. The code may be real because the criminal is trying to sign in at the real provider while you type into the imitation.

Public posts, public records and previously exposed data can supply names, relationships and affiliations. Generative tools can rapidly tailor messages and translate a convincing exchange for a wider audience. The FTC found that older adults reporting investment scams often described contact through social media. That supports the importance of the channel. It does not establish how often scammers mined public records or a year-over-year increase in that particular targeting technique. [2] [3]

A 2026 USENIX Security study illustrates the economics. In an experiment with 7,700 participants, researchers used web searches to personalize emails. Personalization cost about three cents per email and nearly tripled clicks compared with generic phishing. The study measured clicks, not money lost, and did not establish an older-adult victimization rate. [14]

Open your bookmarked benefits site or call the number on your statement. If you entered credentials, change the password on a trusted device, end other sessions, and review recovery addresses and multifactor settings. Tell the provider if you approved a sign-in or shared a one-time code, even if you have already changed the password.

The QR sticker, the delivery text and the convincing second call

Hypothetical. A delivery text asks for a small redelivery fee. You enter a card number. A caller claiming to be from the card issuer then identifies the exact fee and offers to reverse it if you approve a notification. The amount was small because the valuable part was your card and the chance to earn your trust on the follow-up call.

A QR code can lead to the same sort of checkout. Michigan’s attorney general warned in January 2026 about criminals substituting QR codes that direct users to malicious sites. A printed sticker or sponsored search ad can misdirect you before you ever see a familiar logo. Track a delivery from the original order. At a meter, use the operator’s published app or another posted payment method. If you entered card details, call the issuer, ask about replacement and monitor transactions. [10]

10 Warning Signs That Someone May Be Trying to Scam You

  1. They give you a deadline shorter than the time needed to make one independent call.
  2. They insist that you keep the conversation secret from family or bank staff.
  3. They say hanging up will endanger someone, cancel benefits or trigger an arrest.
  4. They tell you to move money somewhere new to “protect” it.
  5. They ask for gift-card numbers, cryptocurrency, a wire or a payment-app transfer to resolve an unexpected problem.
  6. They ask you to read back a sign-in code or approve a notification you did not initiate.
  7. They need control of your screen to diagnose an unsolicited alert or issue a refund.
  8. They coach you on what to tell a teller, including a false reason for a withdrawal.
  9. An investment demands fresh money before it will release your own balance.
  10. Every route they offer for verification leads back to people or links they supplied.

What to Do in the First 30 Minutes If You Think You've Been Scammed

First, interrupt the transaction. End the call. From a trusted device, call the fraud number on your card or statement. Say what happened plainly: “I was tricked into sending this payment.” Give the time, amount and destination. Ask whether the institution can stop it, request a wire recall, notify the receiving bank, or open a dispute. Ask for a case number. Speed can help, but reversal depends on the payment and its status. [7]

Reach the service that moved the money. For a payment app, report inside the app and notify the linked bank or card issuer. For gift cards, contact the issuing company and keep the cards and receipts. For a package of cash, contact the carrier immediately about interception. For a pending retirement distribution, contact the custodian directly. If a courier is outside or someone is threatening you, prioritize physical safety.

Secure access and preserve evidence. From a clean device, secure email and financial sign-ins. If your phone suddenly lost service, contact the carrier about an unauthorized SIM change. Save messages, phone numbers, receipts, account details and transaction IDs. File reports at ReportFraud.ftc.gov and IC3.gov. For exposed identity information, use IdentityTheft.gov. These steps still matter if hours or days have passed.

A family safety checklist to save, print or share

  • Choose a private verification phrase together. Keep it out of social posts and group chats. If it is forgotten or disclosed, use an independent callback.
  • Save two family contacts and your bank’s fraud number. Practice ending an unexpected call and dialing one yourself.
  • Agree that anyone can pause an urgent transfer and ask for a second opinion, without embarrassment.
  • Set alerts for withdrawals, new payees, address changes and retirement distributions. Ask your financial institution about naming a trusted contact. That role alone does not grant authority to spend your money. [11]
  • Turn on multifactor authentication for email, banking and retirement accounts. Use a passkey or security key where supported. Keep recovery information somewhere safe. [12]
  • Review who can see family videos, travel plans, contact details and relationships. Ask relatives before posting identifying information about them.
  • Keep account and support addresses bookmarked. Refuse unsolicited remote access. Verify a new adviser and any change in payment instructions independently.
  • Share this list with a parent, grandparent, friend or caregiver. Make the first practice call today, while everyone has time to answer.