Impersonation Scams: Bank, Utility, Tech-Support, and Government

the costume changes, the skeleton does not

The impersonation scam map

Every impersonation scam has the same skeleton: a fake emergency or threat, a demand for money, codes, or remote access, and pressure to act now without checking. One habit beats all of them.

1. The skeleton"Something is wrong with [trusted thing]"Bank, utility, tech support, government, or family: the script is always a trusted name plus an instant demand. Real banks, utilities, and agencies never need an instant decision from a cold call, text, or pop-up.
2. The one ruleVerify independently, alwaysHang up or ignore, look up the official number yourself, and call back: "Did you contact me?" If it is real, they will be glad the parent checked. That single habit defeats every costume on this page.
3. The tells by costumeRead-back codes, gift cards, remote accessYour bank never needs a code read aloud; utilities never demand gift cards or crypto; tech companies never scan your computer and call about it; government never threatens arrest over the phone; a family member who needs money and secrecy is the grandparent scam or a voice clone.
4. After a targetReport, reassure, set the ruleNothing lost: report (7726 and the FTC), reassure the parent they did nothing wrong, and set the one rule: "if a call asks for money, codes, or account info, we hang up and call back on a number we looked up." Codes or account info shared: treat accounts as compromised.

Send this Print this

The one rule that beats all of them

Whatever the costume, the scam is always: "Something is wrong with [trusted thing] and you must act right now." Real banks, utilities, and agencies never need an instant decision from a cold call, text, or pop-up. So the universal defense is the verify-independently habit: hang up or ignore, look up the official number yourself, and call back. If it's real, they'll be glad you checked.

Bank impersonation

• The script: "This is the fraud department at your bank: we see suspicious activity on your account. To confirm you're the owner, read us the code we just texted you."
• The tell: your bank already knows who you are. It never needs you to "confirm" by reading a one-time code aloud: the code is the key to your account. Anyone asking you to read one back is taking your account, full stop.
• The defense: hang up. Call the number on the back of your card (not the one in the call, text, or email). Ask: "Did you contact me about suspicious activity?"

Utility impersonation

• The script: "This is [power/water/gas company]. Your service is being disconnected unless you pay the past-due balance immediately: here's how to pay with gift cards/crypto/Zelle."
• The tell: utilities don't demand gift cards or cryptocurrency, ever. They also send written notices: real disconnection is a documented process, not a 10-minute phone ultimatum.
• The defense: don't pay. Look up your utility's official customer-service number (from a past bill) and ask about the account.

Tech-support impersonation

• The script: a pop-up or call claiming "your computer is infected" with a number to call, where a "technician" asks for remote access and payment to "fix" it.
• The tell: real tech companies (Microsoft, Apple, Google) don't scan your computer and call you about the results. They never ask for remote access or payment to remove a "virus" they found.
• The defense: close the pop-up or hang up (don't call the number). If someone already got remote access, disconnect from the internet, then have a trusted professional remove the software and change passwords from a different device.

Government impersonation

• The script: "The IRS/Social Security is filing charges / suspending your number unless you pay now": usually demanding gift cards, wire, or crypto, and threatening arrest.
• The tell: government agencies don't call demanding immediate payment by gift card, and they don't arrest people over the phone. The real IRS and SSA communicate by mail first.
• The defense: hang up. Report to the FTC (reportfraud.ftc.gov), and for Social Security impersonation specifically, ssa.gov/scam has the official guidance.

Family impersonation (the one with your voice)

• The script: "Grandma, it's me: I'm in jail / the hospital / I need bail. Don't tell Mom and Dad. Send money." Sometimes the caller uses an AI voice clone of a real family member.
• The tell: the urgency, the secrecy, and the demand for untraceable payment (gift cards, wire, crypto).
• The defense: a family safe word: a code word only your family knows. No safe word, no money. And call the family member at their real number, not the one in the message.

What to do when a parent has been targeted

• If nothing was lost: report it (forward texts to 7726, report to the FTC), reassure them they did nothing wrong, and set the one rule: "if a call asks for money, codes, or account info, we hang up and call back on a number we looked up."
• If codes or account info were shared: treat accounts as compromised: change passwords, sign out of other devices, call the company's fraud line.
• If money was sent: report immediately (timing matters for recovery) to the FTC and, if a crime occurred, FBI IC3. Gift-card companies and banks have specific recovery processes: call them first.
• If your parent is being repeatedly targeted or pressured by someone they know: contact your local Adult Protective Services. The Eldercare Locator (1-800-677-1116) can point you to local help.

The full first-hour response, including what to say to your parent so they report the next one instead of hiding it: is in the suspicious-text-and-call playbook.

Prevent the next one

• Set up a family safe word: the defense against voice impersonation.
• Silence unknown callers on iPhone or Android: most impersonation calls simply stop ringing.
• Set up a family password vault, so a shared code can't become a stolen code.
• Run the Scam Risk Check: paste a suspicious message before acting on it; it works in the browser and keeps a copy of nothing.

Sources & verification

This page is checked against the standards in our editorial policy, preferring government sources for scam patterns. Reviewed August 2026:

• FTC: How To Avoid a Scam (retrieved August 2026)
• SSA: Protect Yourself from Social Security Scams (retrieved August 2026)
• FBI Internet Crime Complaint Center: IC3 (retrieved August 2026)
• FTC: How to Spot, Avoid, and Report Tech Support Scams (retrieved August 2026)

Found an error? Report it: we log and correct material mistakes publicly.