Fraudsters with an official title
Fraud by fake officials explained by Ilia Zavialov: the call, the script and the rule that stops it
A voice on the phone says it is the IRS, a federal agent or a fraud investigator from the bank working with law enforcement. It knows the company name, the director's name and a recent invoice. It needs a payment today to prevent a freeze, a penalty or an arrest. The script is old, and it is still one of the most reliable ways to take money from American businesses and households. The FBI center recorded 32,424 complaints and 797,943,193 dollars of losses from government impersonation in 2025, and the Federal Trade Commission counted 920 million dollars lost to impersonation of government bodies, with reports rising by 40 percent in a year. This piece explains how the call is built, what it already knows about you, and the single verification rule that defeats every version of it.
English version for the United States.
01
Why an official name works so well
A call from a stranger asking for money fails almost every time. A call from somebody who says they are the tax authority, the police or the financial regulator succeeds far more often, because it borrows an authority the listener has been trained to obey since childhood.
The title does three jobs at once. It explains why the caller knows things about the company, it explains the urgency, and it makes refusing feel like obstruction of an official process rather than ordinary caution.
Companies are a particularly good target. Somebody in finance handles payments every day, is used to acting on instructions from above, and does not want to be the person who delayed a legal matter that later turned out to be real.
The fraud works on the procedure rather than on the individual. A careful employee who follows an instruction from a convincing official is doing exactly what they were hired to do, which is why the defense has to be written into the procedure too.
The same script is aimed at households, and it lands differently there. A private person loses savings, while a company loses money that belongs to its payroll, its suppliers and its tax bill, and the loss then becomes a story that clients and the bank hear about.
02
The four scripts that repeat
The tax script: an unpaid liability, a penalty accruing daily, and an offer to settle today to avoid an audit or a freeze on the company account. The payment goes to a special account supposedly used for settlements.
The investigation script: a director or an employee is named in a criminal case, a colleague is supposedly under suspicion, and the company is asked to cooperate confidentially by moving funds to a safe account while the case is examined.
The regulator script: an inspection, a license problem or a compliance breach, resolved by paying a fee or by confirming account details on a portal that looks official.
The protected account script: somebody from the bank, working with the police, reports that the company account is compromised and that the money must be moved at once to a secure account they control. All four end in the same place, a transfer the company initiates itself.
03
What the caller already knows
The detail that convinces people is usually public. Company registration numbers, directors' names, the address and the accountant's name are available in registries and on the company's own website.
Leaked data adds the rest: an employee's personal number, a recent invoice, the name of the bank. None of it proves the caller is an official. It proves the caller did research, which fraudsters do and officials rarely need to.
Spoofed numbers complete the picture. The caller identification can show the real number of a police station or a tax office, and it proves nothing, because the displayed number is chosen by the caller.
So the rule for staff is simple to state. Knowledge about us is not evidence of authority. The only evidence is a call that we initiated ourselves, to a number we found ourselves.
It helps to know how the research is done, because it tells you where it can be interrupted. Most of it comes from three places: the public registry entry, the team page on the company website and professional network profiles that list who works in finance. None of those can be hidden entirely, and the realistic aim is to make sure that knowing a name never unlocks a payment.
04
The numbers in the United States
Government impersonation is one of the costliest categories the FBI center tracks. In 2025 it recorded 32,424 such complaints with 797,943,193 dollars of reported losses, from California and Texas to New York and Florida.
The consumer protection agency sees the same trend from another angle. It counted 920 million dollars lost to people pretending to be government bodies, with reports up 40 percent in a year, partly driven by messages about unpaid road tolls.
Impersonation as a whole is the largest single category the agency tracks: more than a million reports and 3.5 billion dollars of losses, close to one report in three.
Most attempts fail. In four impersonation reports out of five no money was lost, which is the useful part: the call is common and the defense works when it is applied.
05
The verification rule for the company
End the call and ring back through a published number. Not the number the caller gives, not the number shown on the screen, but the number from the agency's official website or from previous correspondence you already hold.
No official body requires payment by gift card, cryptocurrency, a transfer to a named individual or a transfer to a so called safe account. Any of those requests ends the matter regardless of what came before it.
Apply the two person rule to any payment requested by an outside authority. The person who took the call does not approve the payment, and the approver verifies independently before anything moves.
Real agencies put demands in writing through formal channels and allow time to respond. A demand that must be paid within the hour, with a warning not to tell anybody, describes the fraud and not the agency.
Treat the call back as routine rather than as suspicion. Staff find it much easier to say we always ring back through the published number than to say I think you might be a fraudster, and a genuine official will never object to the first.
06
Why smaller companies are hit hardest
A large company usually has a treasury function, dual approval built into its banking and a security team that has seen this call before. A company of twenty people often has one person who pays the bills, the director's phone number on the website and no written rule at all.
That is not a criticism, it is the reason the fraud targets them. The caller needs one person with authority to move money and nobody positioned to question them, and small firms supply that combination by default.
The fix costs nothing and takes an afternoon. A written call back rule, a second approver for any payment requested from outside and a named person told about every such call close the gap that the script is built to use.
07
Who to call and where to report in the US
The IRS makes first contact by mail rather than by phone, and it does not demand immediate payment by gift card, cryptocurrency or wire. A call that opens with a demand is the scheme.
Report attempts and losses to the FBI Internet Crime Complaint Center at ic3.gov and to the Federal Trade Commission at ReportFraud.ftc.gov. Impersonation of the IRS can also be reported to the Treasury Inspector General for Tax Administration.
Call your bank through the number on its website, not the one in the message, and ask for the transfer to be recalled. For wire transfers the first hours decide whether anything can be stopped.
If the caller claimed to be local police or a state agency, call the department's non emergency line from its official website and ask whether the officer and the case exist.
08
What the finance team should write down in advance
A one page instruction for anybody who handles payments: official bodies are verified by calling back through a published number, and no payment requested by phone is made the same day.
A named person who is told about every approach of this kind, including the ones that were refused. Patterns repeat, and the third call to a company is usually better prepared than the first.
A list of the real agencies the company actually deals with, with their published contact details and the name of the usual contact. Having the real number to hand removes the temptation to use the one supplied.
A rule that confidentiality requested by a caller is itself a warning. Genuine investigations do not rely on an employee hiding a payment from their own management.
A short rehearsal once a year. Ten minutes in which somebody plays the caller with a convincing script and the payments team practices ending the call and ringing back turns a rule on paper into a reflex, and the reflex is what works under pressure.
09
If money has already gone
Call the bank immediately through the number on its website or on a card, and ask for the payment to be recalled and the receiving account to be flagged. Hours matter here more than completeness.
Write down everything while it is fresh: the numbers, the names and titles used, the exact wording of the demand, the time of each call and the account details supplied.
Report to the police and to the agency whose name was used. Agencies track impersonation of themselves and use the reports to warn others and to trace the accounts.
Expect a follow up call offering to recover the money, sometimes from a supposed second official. It is the same operation returning to a company it now knows will pay.
| Who they say they are | What they claim | What the real agency does |
|---|---|---|
| IRS agent | Unpaid tax, arrest or account freeze today | Writes first, never demands gift cards or crypto |
| FBI or federal agent | The company is part of an investigation | Does not ask anybody to move money to protect it |
| Social Security Administration | A number is suspended for fraud | Does not suspend numbers or threaten by phone |
| Bank fraud team with police | The account is compromised, move funds | Never asks you to transfer to a safe account |
| State regulator or licensing board | A license problem solved by a fee | Uses formal notices and published payment routes |
| Toll or motor vehicle agency | Unpaid toll with a link to pay | Uses its own official site, not a text link |
| Customs or border agency | A parcel held until a fee is paid | Does not collect fees through a message link |
Questions and answers
The caller knew our director's name and a recent invoice. Doesn't that prove it is real?
No. Directors' names come from public registries and invoices from leaked or intercepted email. Knowledge proves research, and officials rarely need to prove anything by reciting your details.
The number on the screen was the real number of a police station. Is it genuine?
Not necessarily. Caller identification can be spoofed, so the displayed number is chosen by the caller. Only a call you place yourself to a number you found yourself proves who is on the line.
They told us not to tell anybody because the investigation is confidential. What does that mean?
It means the call is a fraud. Genuine investigations do not rely on an employee hiding a payment from their own management, and secrecy is requested precisely because a second person would stop the transfer.
What single rule protects a company best?
End every call that asks for money and ring back through a published number, with a second person approving any payment requested by an outside authority. That rule defeats every version of the script.
Can the IRS call a company and demand payment today?
Not in the way this scheme does it. The IRS makes first contact by mail and does not demand immediate payment by gift card, cryptocurrency or wire transfer. A call opening with a same day demand is the fraud.
Where should an American company report an impersonation attempt?
To the FBI Internet Crime Complaint Center at ic3.gov and to the FTC at ReportFraud.ftc.gov, and to the agency whose name was used. Reports of attempts that failed are useful too, because they show where the next calls will come from.