Impostor Scams: Government, Business, and Family Impersonation Explained

The mechanism behind every impostor scam

Every impostor scam runs on three parts in sequence: borrowed trust, an invented emergency, and an irreversible payment. Take away any one of them and the scam stops working, which is why the defense is always aimed at the parts rather than at the story.

The Federal Trade Commission describes it plainly: a scammer lies and pretends to be someone they are not to get money, access to financial accounts, or personal information.

Borrowed trust is the setup. A caller ID that shows a familiar name, an email address a character off from the real one, a logo copied from a real website, a voice that sounds like a grandchild. None of that is hard to fake, and none of it is evidence. It only has to survive the first ten seconds.

The invented problem is the engine. A warrant, a frozen account, a suspicious charge, an arrest, a package held at customs, a refund sent by mistake. It is always urgent and it always arrives without warning, because a problem you have time to check is a problem that falls apart.

The payment that cannot be undone is the point. Gift cards, wire transfers, cryptocurrency, payment apps, cash handed to a courier, and gold shipped to an address are not a stylistic preference. The FTC notes that scammers use these methods precisely because the money is hard to track and just as hard to get back.

Government impersonation

Government impersonation is the version where the caller claims authority over you: an agent, an officer, a case number, and a consequence. The FTC’s guidance on government impersonation scams states that government agencies will never call, email, text, or message you on social media to ask for money or personal information.

The threats follow a small script. Arrest. A revoked license. A frozen benefit. Deportation. Sometimes the reverse, a refund or a grant you never applied for. The FTC also warns about a newer turn: the caller says you must move your money to protect it, or withdraw cash or buy gold and hand it over for safekeeping. Nobody who works for the government says that.

Three agencies are impersonated often enough to have their own reporting routes. Calls claiming to be Social Security go to the SSA Office of the Inspector General, which handles both misuse of Social Security numbers and impersonation of the agency. Anything claiming to be the IRS goes to [email protected] for email and to the Treasury Inspector General for Tax Administration at 800-366-4484 for calls, both on the IRS reporting page; the seasonal versions are covered in tax scams. And anyone claiming to be the FTC itself is lying by definition, since the FTC does not call people to demand money.

A related cousin wears a private uniform instead of a public one: the debt collector who threatens arrest or refuses to put the debt in writing. Real collectors have obligations they cannot skip, and a demand that arrives without them is the answer.

Business impersonation

Business impersonation uses a company you actually deal with, so the message lands in a mental folder that is already open. A retailer, a bank, a delivery carrier, a streaming service, a utility, an antivirus company. The company whose name is being used is a victim here too, not the author of the message.

The story is usually one of four. There is a problem with your account. There is a charge you did not make. Your subscription renewed and here is how to cancel. Your package could not be delivered and a small fee will release it. Each one is built to make you call a number or open a link the message supplies, which is the only step that matters to the sender.

Two variants deserve naming because of where they lead. In the first, described in refund scams, the caller says a refund was processed for too much and asks you to send the difference back, often after installing a screen sharing program that makes a bank balance look changed. In the second, covered in package delivery scams, the entire purpose of the small delivery fee is to collect a card number.

A charity appeal can work the same way, borrowing the name of a real organization after a disaster, which is why charity scams treats verification as the whole task. The FTC also collects current examples of business impersonators, including fake invoices and orders placed with sellers that do not exist.

Why remote access changes the risk

If a caller asks to connect to your computer or phone to fix, verify, or refund something, the conversation has stopped being about money and started being about access. The FTC’s page on tech support scams describes the pattern: the caller scares you about a problem, takes remote control, and then asks to be paid in gift cards, wire transfers, cryptocurrency, or a payment app. Disconnect the device from the internet and remove the program before anything else.

Family and friend impersonation

The third family drops the institution entirely and uses a person. A grandchild in jail, a daughter who lost her phone and is messaging from a new number, a friend whose account was taken over and who now needs help with a payment.

This version has no logo to inspect and no policy to look up, so it leans harder on two things: emotion and secrecy. The FTC’s page on fake emergencies notes that the scammer might tell you it is important to keep it secret, because they do not want you talking to other family members and realizing it is a scam. The instruction not to tell anyone is itself the warning.

Voice cloning has made the audio more convincing. The FTC explains that a short clip of a person’s voice, possibly taken from something posted online, plus a voice cloning program, is enough for a caller to sound like a family member. That is unsettling, and it also changes nothing about what to do, because the defense was never recognizing the voice. It was hanging up and calling the person on the number you already have. The full version, including the family password, is in grandparent scams.

One more variant belongs here: the message announcing that you have won something, where a fee, a tax, or a shipping charge stands between you and the prize. See lottery and prize scams for why the fee is the whole scam.

How the payment request gives it away

The single most reliable signal is the payment method, because a scammer needs money that cannot be clawed back and a real organization does not. The FTC’s advice is a flat rule: never transfer or send money, cryptocurrency, or gold to someone you do not know in response to an unexpected call or message.

• Gift cards. Nobody legitimate is paid in gift card numbers. If cards were already bought, call the issuer using the number on the back immediately, and read gift card scams.
• Wire transfers to a person. A real bill goes to a company account through normal channels, not to an individual through a wire service.
• Cryptocurrency and crypto ATMs. No agency, utility, or bank collects payments this way, and the transaction does not reverse.
• Payment apps between individuals. Treated as a payment you approved, which makes it much harder to dispute than a card charge.
• Cash or gold, handed over or shipped. A stranger coming to collect, or an address to ship to, is not a collection procedure any real institution uses.

The same logic works in reverse and catches the trickiest version. When someone tells you to move money out of your own account to keep it safe, the request only makes sense if the person receiving it plans to keep it.

How to verify a contact without using anything they gave you

Verification means checking through a channel the other person did not supply. Every phone number, link, email address, and case reference in the original message has to be treated as part of the message, not as proof of it.

1. End the contact first. Hang up, close the message, do not reply. Nothing is lost by stopping. If it were genuinely urgent, it would survive ten minutes.
2. Find the contact details yourself. The back of your card, the last paper statement, the app you already had installed, the agency’s own website typed in by hand. Not the number in the message and not the first search result.
3. Ask the organization directly whether the contact was real. Give them the reference the caller used and let them look it up. A real case exists in their system.
4. For a relative, call the number you already have. If there is no answer, reach them through another family member or a friend before doing anything else.
5. Say the sentence out loud to one other person. Secrecy is a requirement of the scam, so breaking it usually ends it.

Caller ID deserves one sentence of its own: it shows what the caller chose to send. A familiar name or a local number on the screen is not verification, it is decoration.

What to do if you already paid or shared information

Call whoever moved the money first, because that is the only party with a chance of stopping it, and then file the official reports. Speed matters more than getting the order of the agencies perfect.

If money moved, contact the bank, card issuer, payment app, gift card issuer, wire company, or crypto exchange the same day, and say clearly that you were tricked into the payment. The full sequence, including what recovery realistically looks like for each payment method, is in how to report a scam and try to recover your money.

If personal information moved instead, the risk is a different one. A Social Security number, a date of birth, or account logins can be used to open accounts, and the federal recovery process starts at IdentityTheft.gov. If financial accounts are involved, a complaint to the Consumer Financial Protection Bureau is the route that most often produces a written answer from a company.

If the person targeted is an older adult, or if a relative or caregiver is somehow part of it, the resources are different and are covered in elder financial abuse.

One thing worth saying plainly: these scripts are written and rehearsed by people who do this full time, tested on thousands of calls, and timed to arrive when someone is tired, busy, or worried. Falling for a professional performance is not a character flaw.

Where to report an impostor scam

Report to the FTC first, then to the specific agency or company being impersonated, because that second report is what lets them warn other people using the same name. Reporting an attempt you did not fall for is just as useful as reporting a loss.

• Federal Trade Commission at ReportFraud.ftc.gov, the general federal intake for fraud.
• FBI Internet Crime Complaint Center at ic3.gov for anything that arrived by email, text, or online.
• The impersonated agency. Social Security to the SSA Inspector General, the IRS through its reporting page, anything by mail to the U.S. Postal Inspection Service.
• The impersonated company through its real fraud or abuse address, so it can take down accounts and pages using its name.
• Your state attorney general or consumer protection office, listed at usa.gov/state-consumer, which can act against businesses operating in your state.

Expect no personal follow up from the federal reports. They are used to map campaigns and build cases, not to answer individual complaints, and a report that names a phone number and a website still being used is worth filing for that reason alone.

Impostor scam FAQ