Imposter scams were the most-reported type of fraud in the United States in 2025, and the Federal Trade Commission says the costliest ones often start with something that looks like a helpful warning: a fake security alert. This article explains what the latest FTC figures show, how the technology behind these scams works, and which habits interrupt them.
What do the FTC’s 2025 numbers show?
In a June 15, 2026 release, the FTC reported that people told it they lost $3.5 billion to imposter scams in 2025. Reported losses from this category have nearly tripled since 2020. Imposter scams accounted for nearly one in three fraud reports, making them the most-reported fraud category of the year.
They sit inside a larger picture. According to the FTC, total reported fraud losses reached about $16 billion in 2025, the highest on record and roughly 25% above the 2024 figure. These are reported losses only. Many people never file a report, so the real totals are likely higher.
| Measure (2025, as reported by the FTC) | Figure |
|---|---|
| Imposter scam losses | $3.5 billion |
| Business impersonator losses | Nearly $1 billion (2024: $866 million) |
| Government impersonator losses | About $920 million (2024: $789 million) |
| All reported fraud losses | About $16 billion |
How big a slice of fraud is this?
A little illustrative arithmetic helps put the numbers in proportion.
- Imposter scams as a share of all reported fraud losses: $3.5 billion divided by $16 billion is about 0.22, or roughly 22%.
- Business and government impersonation combined: nearly $1 billion plus about $920 million is close to $1.9 billion, a little over half of the $3.5 billion imposter total.
- Year-over-year change for government impersonation: $920 million minus $789 million is $131 million, an increase of about 17% on the 2024 level.
Because the business figure is given only as “nearly $1 billion,” these calculations are approximations, not exact values. The pattern is still clear: impersonating a trusted institution is a large and growing source of losses.
How does a fake security alert work?
The FTC describes a common script. A scammer poses as a bank and sends a security alert, often claiming that suspicious activity has been spotted on an account. The alert creates urgency. The victim is then persuaded to move money in order to “protect” it. The FTC notes that losses in these cases are often limited only by how much money the victim has available.
The logic of the scam is psychological rather than technical. It borrows the language people expect from real fraud teams, such as “unusual login,” “blocked transaction” or “secure your funds.” Then it flips the usual relationship: a real bank protects money where it is, while the scammer needs the victim to send it somewhere the scammer controls. Any instruction to transfer money to a “safe” account is the central warning sign.
Which channels do scammers use to reach people?
The FTC says scammers reach targets by text message, phone call, email, social media and search engine results. That list matters, because it covers almost every way a person receives information on a phone or computer.
- Text messages and calls. A short message with a link, or a call that appears to come from a known number, can feel instantly credible. Caller information can be made to look like it comes from a bank or an agency, so a familiar name on the screen is not proof of identity.
- Email. Messages copy logos, colors and phrasing. The sender name can say anything.
- Social media. Fake support accounts and direct messages can target people who have just complained publicly about a service.
- Search results. A sponsored or look-alike listing may lead to a page that imitates a company’s support line or login page.
None of these channels is unsafe in itself. The common thread is that the scammer starts the contact, sets the pace and tries to keep the victim from stopping to verify.
Why do the scams keep working?
Three features help explain their persistence.
- Authority. People are conditioned to respond quickly to banks, tax agencies and government offices.
- Urgency. A threatened loss, whether frozen funds or a legal problem, pushes people to act before thinking.
- Plausible detail. Scammers often know enough, such as a name or a bank the target actually uses, to sound legitimate. The FTC’s description of search results and social media as channels is a reminder that personal details are often easy to find or guess.
Technology also lowers the cost of trying. A message can be sent to a very large number of people at almost no expense, so a scammer needs only a small percentage to respond. For more on how automated tools are changing what software can do on a person’s behalf, see our explainer on what AI agents can actually do today, and our opinion piece on why AI chatbot use is outpacing trust.
What does the FTC advise people to do?
The FTC’s guidance in the release is short and practical.
- Be wary of fake security alerts, especially ones claiming to come from a bank, and of anyone who pressures you to move money to “protect” it.
- Remember the FTC’s own line: “The FTC will never demand money, make threats, tell you to transfer money, or promise you a prize.”
- Report government impersonation scams at ReportFraud.ftc.gov.
Those points translate into a few habits that work across all channels:
- Pause before acting. Real institutions rarely require a decision within minutes.
- End the contact and start your own. Hang up or close the message, then reach the organization through a phone number or app you already trust, not the one in the message.
- Treat any request to move money as a red flag. Moving funds to a “safe account” is how the scam works.
- Tell someone. A second opinion from a friend or relative can break the urgency.
Stronger sign-in methods also reduce the damage if a login is tricked out of someone. Our guide to what passkeys are and whether to use them explains why a sign-in tied to the genuine site is harder to hand over to a fake page.
What is being done to stop imposters?
The FTC finalized its Impersonation Rule in 2024. Since then, it says, it has brought about a dozen enforcement actions and obtained more than $70 million in redress for consumers. Recent cases involved an IRS imposter scheme, a government imposter health insurance scheme, a business imposter money-making scam, a phantom debt scheme and a debt relief scheme aimed at older adults. In April 2026, the FTC sued Innovative Partners, alleging it impersonated the government and large insurers to sell health plans that lacked the coverage consumers wanted.
The agency also joined the Department of Justice, the Department of Health and Human Services and members of the Elder Justice Coordinating Council in the “Never Ever” awareness campaign, which ran from June 15 to June 26, 2026, around World Elder Abuse Awareness Day. Partners included the American Bankers Association, USTelecom, Google and Microsoft.
Enforcement and awareness campaigns help, but they work after the fact or at the margins. The first line of defense remains the person who receives the message.
Are new technologies making this harder?
Newer tools are changing how fraud looks and feels, from more convincing writing to synthetic voices. The FTC release does not quantify the role of any specific technology in the 2025 losses, so it would be wrong to claim a precise effect. What can be said is that the channels the FTC lists are broad, and that anything which makes a message more polished makes visual cues, such as spelling mistakes, less reliable as a test.
That shifts the focus from how a message looks to what it asks for. A request to move money, share a code, install software or act in secret is suspect no matter how professional it appears. The same logic applies to future threats: our look at post-quantum encryption and what it means for you shows how security advances protect data in transit, but no cryptography stops a person from willingly sending money to a stranger.
What to remember when the next alert arrives
The FTC’s data make the stakes plain: $3.5 billion in reported imposter losses in 2025, with banks and government agencies among the most-copied names. The scam depends on speed and fear, and it dissolves when the recipient slows down, ends the contact and checks independently. No legitimate security alert needs money to be moved to a new place in a hurry.
This article is general information, not legal, financial or personal security advice. Figures are as reported by the FTC as of June 2026; reported losses likely understate actual losses.
Sources: Federal Trade Commission
