Never Pay (or Move Money) to Protect Money

Seconds

No bank, agency, or company will ever ask you to move, withdraw, convert, or hand over your money to keep it safe, so any such request identifies the person making it as the threat.

How to do it

  1. 1Learn the shape of the ask, because the story changes and the shape does not: someone warns that your money is in danger (hackers, a corrupt employee, an investigation, a suspicious transaction) and then tells you where to move it (a "safe" account, cryptocurrency, gold, gift cards, a courier, a "federal locker").
  2. 2Stop at the first mention of moving money. Do not evaluate the story; the story is the product.
  3. 3Say that you will contact the institution yourself, end the contact, and use the callback rule on a number you find independently.
  4. 4If you are told to keep the transfer secret from your bank, your family, or the teller "because they may be involved", that instruction is itself the confirmation of a scam. Tell exactly the people you were told not to tell.
  5. 5If money has already moved, call your bank's fraud line immediately and report to law enforcement (in the US, ic3.gov and reportfraud.ftc.gov). Fast reports sometimes allow transfers to be recalled; slow ones almost never do.

What to say

  • My bank does not need me to move my money to protect it. I will call them myself.
  • If my account is compromised, freeze it. I am not transferring anything anywhere.

When to use it

  • A "fraud department", "government investigator", or "tech support agent" says your accounts are compromised and offers to help you secure the funds.
  • A pop-up or call reports a hacker on your computer and then connects you to your "bank".
  • You are told a transaction is under investigation and you must cooperate quietly, including by withdrawing cash or handing it to a courier.

Counters

Evidence and how strong it is

The "move your money to protect it" script is the core of what the FBI calls the Phantom Hacker scam, a three-stage impersonation (a tech-support agent, then the bank, then a government agency) whose 2023 public service announcement reported that tech-support-scam complaints in the first half of that year alone involved more than $500 million in losses, most of it from people over sixty. The FTC's consumer guidance states the rule in almost these words: nobody legitimate will ever tell you to move your money to protect it. The rule works because it does not require the target to detect a lie; it converts a persuasive, well-rehearsed story into a single observable act, and the class of legitimate requests it forbids is empty. Evidence strength: regulator and law-enforcement consensus grounded in complaint data; there is no trial evidence, and none is needed for a rule with no legitimate exceptions.

Cautions
  • The rule covers moving money "for safety". Banks do legitimately freeze cards, block transactions, and ask you to confirm activity, but they do it through the app, the number on your card, or a branch, and they never need you to transfer, withdraw, or buy anything.
  • Scammers now coach targets on what to tell bank staff who ask questions. If you find yourself rehearsing a cover story for your own bank, stop; that is the scam talking.
  • Shame keeps people from reporting after money has moved. Report anyway and quickly; partial recovery is sometimes possible, and the report protects the next person.
  1. Federal Bureau of Investigation, Internet Crime Complaint Center (IC3) (2023). "Phantom Hacker" Scams Target Senior Citizens (Public Service Announcement I-092923-PSA). ic3.gov
    Description of the three-stage impersonation scam built around moving money to "protect" it, with first-half-2023 loss figures.
  2. US Federal Trade Commission (2024). How To Avoid a Government Impersonator Scam. FTC consumer advice
    The guidance that no legitimate agency or company will ask you to move money to protect it, and that gift cards, cryptocurrency, and couriers are scam payment signals.
  3. Hadnagy, C. (2018). Social Engineering: The Science of Human Hacking (2nd ed.). Wiley
    The pretexting mechanics (authority plus urgency plus a helpful role) that the protect-your-money script relies on.
Last reviewed

More in Scams and social engineering

Out-of-Band Verification

Confirm any request that arrives through one channel (email, text, chat, a phone call) by reaching the supposed sender through a different channel you already trusted before the request existed.

The Callback Rule

When anyone contacts you claiming to be your bank, a government agency, a utility, or a company you deal with, hang up and call back on the number printed on your card, statement, or the organization's official website, never the number they gave you.

Gift Cards Mean Scam

Treat any demand to pay a debt, fine, fee, bail, or "security deposit" with gift cards, cryptocurrency, a wire to a stranger, a payment app, or cash handed to a courier as proof of fraud, because no legitimate institution collects money that way.

Tell Someone Before You Send Money

Before sending money or sharing account details in response to any unexpected request, describe the situation out loud to one person who is not involved, because scams depend on the target deciding alone.

Verify, Then Trust (for Authority Claims)

Separate the symbols of authority (a title, a uniform, a badge, a confident tone, an official-looking letterhead) from the fact of authority, and check the fact through a source the claimant does not control before you comply.

Multi-Factor Authentication and Passkeys

Turn on a second factor for every account that matters and prefer phishing-resistant forms (passkeys or hardware security keys), so that a password typed into a fake page or talked out of you on the phone is not enough to take the account.