Clients in the years just before retirement are sitting on the largest balances of their working lives. Decades of contributions have matured, the mortgage is often paid down, and the 401(k) or rollover IRA represents real, accessible money.
Scammers know this. The frauds aimed at this group are designed around one outcome: getting a client to authorize the movement of retirement funds, willingly, under a story that feels urgent and real.
Advisors sit at exactly the chokepoint these schemes need to pass through, which makes the pre-retirement years a place where one informed conversation can prevent a catastrophic, often unrecoverable loss.
Why this stage draws the most damaging scams
Older adults report fraud less often than younger people, but when they lose, they lose far more. The Federal Trade Commission reports that total fraud losses among adults 60 and older roughly quadrupled between 2020 and 2024, reaching about $2.4 billion, driven largely by individual losses over $100,000 tied to investment scams, romance scams, and impersonation. Investment scams now cause more reported losses among older adults than any other category.
This is the moment when a single successful scam can erase a retirement that took 30 years to build, with little working runway left to recover it. The money is liquid, the stakes are emotional, and the timeline to rebuild is short. That combination is what fraudsters are pricing into their approach.
Unlike the fraud aimed at younger clients, these schemes don’t attach to a transaction the client started. There’s no home purchase or job offer to exploit. The scammer manufactures the urgency from nothing, then works to capture the client’s trust over days or months.
The phantom hacker scam
The phantom hacker scam, a term coined by the FBI, follows three tiers. The first impersonator poses as tech support and warns that an account has been compromised. They hand the victim to a second, posing as a bank or brokerage official, who confirms the threat. A third then steps in claiming to be from a federal agency, lending the scheme official weight.
Each tier reinforces the last, which is what makes the story believable and what sets it apart from the single-caller impersonation scams most clients have heard about.
The pitch is consistent: the client’s money is in danger, and the only way to protect it is to move it. Victims are told to transfer savings into a “safe” account, convert it to cryptocurrency or gold, or wire it somewhere for protection. The FTC has documented older adults clearing out bank accounts and 401(k)s this way, with six-figure losses climbing sharply in recent years. One case involved a 76-year-old retired lawyer who lost $740,000 in 2024 after a caller posing as a federal fraud investigator convinced him his accounts were under attack, then walked him through moving the money out himself.
The defining feature, the one worth teaching every client, is simple. No legitimate bank, brokerage, or government agency will ever instruct someone to move money to keep it safe. That sentence alone defeats the scheme.
Investment and advisor impersonation cons
Pre-retirees planning their final savings push are receptive to investment pitches, and scammers tailor offers to that mindset. Many schemes now begin on social media and move to private messages, promising returns that outpace the market, frequently through cryptocurrency. Some fraudsters impersonate real, registered financial professionals, building fake websites and profiles to lend credibility.
Our Horsesmouth member survey captured how often advisors break the spell.
One advisor described a client preparing to pull retirement funds for a gold “investment” recommended by a wealthy friend. The advisor researched the company, pulled up a satellite image of its supposed headquarters, and showed the client it was a mailbox storefront next to a bail bonds office. The client walked away whole. The friend who made the referral, and the friend’s family, did not.
Romance and relationship-driven fraud
Pre-retirement years often coincide with life transitions—divorce, a partner’s death, children leaving home—that scammers exploit through relationship-driven fraud. These schemes run long, and the financial request arrives only after trust is established. Because the victim feels emotionally invested, this fraud is among the hardest for an outside party to interrupt.
Horsesmouth members have intervened here repeatedly.
In one survey response, an advisor and their back office assembled enough research to prove to a client that an online relationship was a scam. In another, a client was steadily drained by a “new friend” until the advisor contacted compliance, froze the accounts, and brought in family.
Advisors who notice the pattern early—the unexplained withdrawals, the new name in the client’s life, the reluctance to discuss a transfer—are often the only check in the system.
What advisors can do
Verification discipline carries across every stage of the client lifecycle, and it matters here too: Any large or out-of-character distribution request deserves a pause and an independent confirmation. But the defense that distinguishes this stage is structural, built into the account before a scam ever begins.
Several Horsesmouth members described requiring verbal confirmation, often using a phone number and passcode established in advance, before processing any distribution. Others place restrictions on accounts so that out-of-pattern withdrawals route through a second set of hands. A named trusted contact gives the advisor an authorized person to call when something looks wrong, and an account-level hold creates time to verify before money moves.
These controls work precisely because the phantom hacker scam depends on speed and isolation. A mandatory second step breaks both.
When a request does raise concern, partnership beats suspicion. Asking to verify the details together, slowing the transaction by a day, or offering to research the recipient gives the client room to step back without feeling accused. A single probing question, asked with genuine curiosity rather than alarm, is often enough to surface the fraud.
Red flags advisors should watch for
A sudden, large, or out-of-character distribution request is the clearest signal, particularly when the client is reluctant to explain its purpose.
Mentions of moving money to “protect” or “keep it safe” should stop the conversation cold, because that language is native to the phantom hacker script. Watch for new people in a client’s life who seem connected to financial decisions, and for investment opportunities introduced through social media or messaging apps.
Pressure to act immediately, paired with a request for secrecy, is a reliable marker across nearly every scheme that targets this group.
Protecting what they’ve spent a career building
Pre-retirees have done the hard part. They’ve saved, planned, and arrived at the threshold of the retirement those savings were meant to fund.
The frauds aimed at them are engineered to undo that work in a single transaction, and they succeed by convincing the client that moving the money is the responsible thing to do.
An advisor who builds the safeguards in advance, teaches the one rule that defeats most of these schemes, and treats an unusual request as a moment to pause becomes the line standing between a client and an unrecoverable loss.
Checklist: Protecting pre-retiree clients from fraud
During client meetings:
- Treat any large or out-of-pattern distribution request as a verification trigger.
- Ask about new investment opportunities, especially those introduced via social media or a new acquaintance.
- Confirm a trusted contact is named on every account.
Client education topics:
- No bank, brokerage, or government agency ever tells you to move money to keep it safe.
- Legitimate investments do not arrive through social media direct messages.
- Guaranteed or above-market returns are a fraud signal, not an opportunity.
Account safeguards:
- Verbal confirmation, ideally with a pre-set passcode, before processing distributions.
- Restrictions routing out-of-pattern withdrawals through a second review.
- A standing pause-and-verify protocol for any wire or transfer request.
Red flags:
- “Move your money to a safe account” language.
- Reluctance to explain the purpose of a withdrawal.
- A new relationship tied to financial requests.
- Pressure for immediate action combined with secrecy.