A Chicago hairstylist lost $20,000 to a Phantom Hacker scam. A caller claiming to be Bank of America said a hacker was draining her account, so she wired her own money to the scammers. His number matched the one on the back of her card. ABC7 Chicago reported the case in January 2025 under the FBI's "Phantom Hacker" label. The $20,000 is her own figure, and none of it has come back.
Social Engineering Examples·4 sources
The account comes from ABC7 Chicago, whose I-Team published it on January 16, 2025. A hairstylist on Chicago's North Side picked up a call in the middle of a client's appointment. The man said he was with Bank of America and that something suspicious was happening on her account.
She did what she'd been taught. She checked the number against the customer-service line on her card, and it matched. Only then did he name a figure. A hacker was trying to take $20,000, he said, and they had to move fast.
Next she was handed to a second person, who talked her through "how to potentially stop the fraud," in her words. She logged in to online banking and wired $20,000 to an account that, she was told, would keep the money safe.
Seconds after the wire went through, something felt off. She went into a Bank of America branch, where staff told her it had been a scam.
The FBI's Internet Crime Complaint Center described the Phantom Hacker scam in a public service announcement on September 29, 2023. The pattern stacks three impostors, each one building trust and edging closer to the victim's biggest account. It is a form of pretexting and impersonation delivered mostly by phone.
| Element | FBI pattern | This case |
|---|---|---|
| Phase 1: tech support | A pop-up, text, or call talks the victim into installing remote-access software | Not here. No computer, no download, no remote access |
| Phase 2: bank | A "fraud department" caller says a hacker got in and tells the victim to move money to a "safe" account | Yes. A caller claiming to be Bank of America told her to send a wire |
| Phase 3: government | A fake Federal Reserve or agency employee, sometimes with official-looking letterhead | Absent |
| Entry path | The victim is nudged into making the first call | The other way round. She got the call |
| Typical victim | The FBI says the scam is significantly impacting senior citizens | Doesn't fit. She's described as a working parent saving to open a business |
The only layering here is the handoff to a second person partway through the call. Calling it a Phantom Hacker case is ABC7's framing, and this library's filing choice. The FBI never said so. Phase 1 on its own is a tech-support scam.
What matters is the order things happened in. She ran the check most of us are taught, and it gave the caller exactly the answer he needed. After that, the check didn't test anything. It just gave permission for everything that followed.
No source explains how the numbers came to match. FBI Special Agent Rachel LaRocque told ABC7 that scammers "may even be able to spoof that bank's phone number." Spoofing is the likely answer. Still, that's an inference, not something anyone reported.
The same weakness powered the iSpoof caller-ID spoofing service, which rented banks' real numbers to 59,000 registered users. In the Wells Fargo impersonation wire fraud, a caller also displayed the bank's real 800 number.
| Date | Event | Source |
|---|---|---|
| Sep 29, 2023 | The FBI's IC3 puts out its Phantom Hacker public service announcement | FBI IC3 |
| Oct 20, 2023 | FBI Phoenix warns people about the same scam | FBI Phoenix |
| Feb 29, 2024 | An FBI podcast episode walks through the three phases | FBI |
| 2024 (inferred) | The call and the $20,000 wire, dated only as "a few months" before the report | ABC7 Chicago |
| Jan 16, 2025 | ABC7 Chicago runs the story, with Bank of America's response | ABC7 Chicago |
| Sep 2026 | Later coverage turns up no recovery, arrest, or charge | Library review |
| Item | Amount | Basis |
|---|---|---|
| Wired by the account holder | $20,000 | What she told ABC7 Chicago. It's her figure, not a filing or a bank statement |
| Recovered | Zero | As reported |
| Restored by the bank | Zero | Bank of America says it tries to recover money but can't promise it once a client has authorized the transfer |
| Arrests or charges | None found | Based on later coverage through September 2026 |
What failed was treating caller ID as proof of who's calling. A matching number is just something on a screen. It isn't a credential. The safe move is to hang up on any unexpected call about suspicious activity and ring the number on the card yourself, on a new call.
The request itself was the second chance to stop. Bank of America told ABC7 it will never call and ask a client to send money through Zelle or a wire transfer. So a call that ends with instructions to move money rules itself out.
For the verification steps in more detail, see how to prevent vishing and the vishing case library.
Every detail of this case rests on one bylined ABC7 Chicago report, which quotes her on the record. Nothing contradicts it. But no court filing, charge, or second newsroom backs it up either.
The three FBI sources describe the scam in general. They don't mention this case, this woman, or this bank. How the scammers got her number isn't known.
Social Engineering Examples. “Phantom Hacker Scam (2024): A Fake Bank of America Call Cost a Chicago Stylist $20,000”. Accessed 22 October 2026. https://socialengineeringexamples.com/phantom-hacker-scam-bank-of-america-impersonation-2024
How the scammers obtained her phone number is not publicly known. No source describes data-broker records, breach data, robocalling or any other sourcing method, and nothing in the reporting indicates she was researched or selected as a named individual. The only on-record characterization points the other way, from FBI Special Agent Rachel LaRocque: "Scammers do not discriminate against anyone. They want money from anyone they can take it from."
No source establishes how her number was obtained, so there is no specific sourcing channel to close here. The controls that actually bear on this case act on the call itself, at Stages 2 through 7.
She answered a call while working with a client. In her account to ABC7 Chicago: "I answer the phone, and it was a man who tells me that, 'This is Bank of America,' and that there was suspicious activity." Note that this entry path differs from IC3 PSA 230929, whose sequence opens with a tech-support persona and a lure that makes the victim place the call. No computer, software download or remote access appears anywhere in her account.
An unsolicited call reporting suspicious activity is the cheapest place to stop the whole sequence, because everything downstream depends on the customer staying on a call she did not initiate. The rule that holds regardless of what the caller says is to hang up and dial the institution back on a number the caller did not supply.
She checked the caller's number against the customer-service number printed on the back of her genuine Bank of America card, found that they matched, and concluded on that basis that the call was legitimate (ABC7 Chicago, January 16, 2025). No source establishes how the match was produced. What is on the record is the capability, stated conditionally by LaRocque: scammers "may even be able to spoof that bank's phone number, so the number on your caller ID or cell phone might show that it's the bank."
A caller ID, or a match against the number printed on a card, is not proof of identity, because a displayed number can be spoofed. FBI guidance is explicit that consumers should independently dial the number on their card or statement rather than trust a displayed or supplied number, which is the step that would have exposed this call.
Only after the number checked out did the caller name an amount. She was told a hacker was trying to steal $20,000 from her account and that they needed to act fast to prevent it (ABC7 Chicago). The order is the instructive part: her verification step was spent before the alarming claim arrived, so the check licensed the escalation instead of testing it.
A specific figure paired with a deadline is a pressure device, not information. Bank and FBI consumer education flags extreme urgency about moving money as a fraud hallmark and recommends a hard pause: hang up, and consult the bank or a family member before acting.
Her account includes a transfer to another party mid-call: "I then get transferred, and they walk me through how to potentially stop the fraud." This is the only evidence in the record of more than one persona, and it is the closest this incident comes to the layered structure IC3 PSA 230929 describes.
Being transferred to a second, more authoritative-sounding party adds no legitimacy, since both personas sit inside the same unsolicited call. Treating a mid-call handoff as corroboration is exactly the trust-building effect the FBI describes in the wider pattern.
She recounted the caller's line as "Okay we only have this amount of time. I want to make sure we block this and prevent this from happening to you," and described her own state at that moment as "My anxiety is going up."
A personal rule of never moving money during the call that raised the alarm defeats time pressure directly, because the scam depends on compressing the decision. No legitimate fraud process requires a customer to act within minutes on an inbound call.
She was told to log into her online banking account and wire $20,000 to a different account where her money would be protected, and she sent the wire (ABC7 Chicago). The destination account was controlled by the scammers.
Bank of America has stated publicly that it will never call and ask a client to send money through Zelle or a wire transfer, ever. That statement is unconditional and is not limited to "safe" account framing, so any inbound call that ends in a transfer instruction is disqualifying on its face.
Within seconds of completing the transfer she felt something was wrong, went into a Bank of America branch, and staff confirmed it was a scam. The funds were gone.
Once a customer personally authorizes a wire, Bank of America told ABC7 it attempts to get the money back but cannot guarantee recovery. The controls that remain are bank-side, meaning anomaly detection and holds on unusual large wires, plus immediate reporting to the bank and to IC3 to attempt a recall, rather than anything the customer can do after the fact.
Browse by what this case has in common with others in the library.
SCE reported $131,464 collected by scammers across its 2025 customer fraud complaints. Its warnings describe immediate-disconnection and meter-removal threats as…
Russian GRU-linked Forest Blizzard (APT28/Fancy Bear) used OpenAI's GPT-4-family LLM services to research satellite communication protocols and radar.
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a…
Scheme participants posed as veteran finance professionals inside private WhatsApp investment groups to lure at least 18 U.S. retail investors…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
Two unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
A Singaporean businessman transferred at least S$4.9 million after WhatsApp and email lures citing the Strait of Hormuz crisis drew…
A Pakistan national in Sydney allegedly ran a vishing scheme impersonating telecommunications support, using maintenance or upgrade pretexts to obtain…
Authorities alleged that a 16-person Colombian network called and WhatsApp-messaged bank customers while posing as fraud-prevention officers, persuaded mostly over-50…
A single phishing email opened by an Anthem subsidiary employee in Feb 2014 seeded a nation-state intrusion that quietly stole…
Scammers hijacked a real invoice thread between an Arkansas school district, its contractor, and its architect, then used a lookalike…
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a…
Attackers hijacked a staff email account and used fake solar-panel invoices to trick the US charity into wiring $997,400 to…
A scammer posing as GCI's CFO emailed payroll and, after the employee's initial pushback, persuaded them to hand over 2015…
A fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to…
A Rapid7 penetration tester tailgated into a client's building using door-holding reciprocity and a cloned-looking badge, rode an elevator up…
Vidoc Security Lab, a Polish-founded, US-headquartered cybersecurity startup, says two job candidates using fabricated identities reached interviews for a Poland-based…
Fraudsters impersonating an Ascend Laboratories executive convinced Alkem Laboratories to wire USD 6,161,336 (about Rs 51.30 crore) to a fraudulent…
Fraudsters spoofed Barclays' real phone number and hold music, posed as the bank's fraud team in a two-caller vishing script,…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
In the PG&E scam, a caller claiming to be from the utility threatens to cut the power today. Then a…
A caller posing as a Standard Bank representative persuaded the 18-year-old account holder to move her R438,900 education trust fund…
Social Engineering Examples