The Costliest Scams of 2025 Didn't Hack Your Computer. They Called You.
Americans 60 and older lost $7.7 billion last year. The fastest-growing playbook skips your accounts' locks entirely: it convinces you to empty them yourself, by sounding exactly like the people you'd turn to for help.
One number is doing the rounds this spring: $20.9 billion. That's what Americans reported losing to internet crime in 2025, according to the FBI's Internet Crime Complaint Center, up 26 percent in a single year, across more than a million complaints.
It's a big, abstract figure. The number that matters more if you're over 60 is smaller and closer to home: about $38,500. That's the average amount each older victim lost.
Who got hit, and how hard
People aged 60 and up reported $7.7 billion in losses last year — more than a third of the entire national total, from a single age group. That's roughly a 59 percent jump over the year before, spread across more than 201,000 reported victims. By comparison, everyone in their 30s and 40s combined reported $4.6 billion.
It would be easy to read that and assume it's about being out of step with technology. The scams driving those losses barely touch the technology at all. They go after something else.
The threat isn't a break-in. It's an introduction.
When people picture internet crime, they picture someone cracking a password or slipping past a firewall. The most expensive scams of 2025 worked the opposite way. Nobody forced a lock. Someone was let in — politely, over the phone or by email — because they sounded like exactly the right person to trust.
Look at where the money actually went for older victims. Investment fraud took the largest share, around $3.5 billion. Tech-support scams took roughly $1 billion more. Romance and confidence schemes accounted for another half a billion. Underneath, the engine is the same: a stranger earns your trust over days or minutes, then tells you what to do with your money. And you do it, because by then they feel like an ally.
How the "Phantom Hacker" scam plays out
The FBI has a name for the version that drains the most retirement accounts: the Phantom Hacker. It works in three acts, each one handing you off to the next.
It usually opens with a warning. A pop-up freezes your screen, or a call comes in, claiming to be tech support from a name you recognize. Your computer has been compromised, they say. They need remote access to check.
Then comes the handoff. The "technician" says the breach has reached your bank, and connects you to someone posing as your bank's fraud department. This second voice confirms the bad news and adds a twist: your savings are in danger, and the only way to protect them is to move the money somewhere safe.
The third voice makes it official. Someone claiming to be from the government — often the Federal Reserve or another agency you'd never question — vouches for the whole thing and tells you the transfer is legitimate. By the time the money moves, three trusted-sounding authorities have all agreed it's the right call. Victims have lost entire banking, retirement, and investment accounts this way, believing the whole time they were protecting them.
Why careful people fall for it
The people losing money here are not careless. The scam is built to beat caution itself.
It borrows the voices of the institutions you're supposed to trust — your bank, tech support, a federal agency. It arrives wrapped in urgency, which is the enemy of clear thinking. And it flatters your instinct to act responsibly: you're not being robbed, you're told, you're protecting yourself. Every move feels like the cautious choice. That's the trick.
The newest wrinkle makes the voices more convincing still. For the first time, the FBI's report this year broke out a separate section on AI-assisted crime — more than 22,000 complaints and $893 million in losses. Some of it is cleaner, error-free scripts. Some of it is cloned voices: a few seconds of audio is now enough to fake a grandchild calling in a panic, or a familiar customer-service rep.
What actually stops it
Because these scams need you to act in the moment, a few steady habits defeat the whole category, whichever version comes for you.
- Hang up and call back on a number you find yourself. Not the number they give you, not the one on the pop-up. Find your bank's number on your card or statement and dial it directly. A real institution will never mind.
- Remember the one rule that breaks the whole script: no legitimate bank or government agency will ever ask you to move money to "keep it safe." That sentence is the scam, every time, with no exceptions.
- Real tech support doesn't call you first. Microsoft, Apple, and your bank do not cold-call about a virus on your computer. A pop-up with a phone number is never genuine.
- Give yourself 24 hours on anything urgent. Real emergencies survive a day's pause. Scams don't. The pressure is the product.
- Set a code word with your family. If a "grandchild" calls in trouble and can't say the word, you have your answer, no matter how real the voice sounds.
None of this requires being good with computers. All it takes is slowing down at the exact moment someone is working hard to speed you up.
If this is useful, the most valuable thing you can do is forward it to one person who'd want it. The protection works best before the call ever comes.
Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report and Phantom Hacker public advisory; AARP, "Older Adults Hit Hard by Fraud in 2025."