Is that person asking for your information who they say they are? If something feels off, it probably is. Here’s how to tell.
Quick takeaways
Picture this: You receive an email with an alarm-ringing subject line about your account. The message goes on to say your account will be suspended unless you act immediately via a provided link. It seems odd your account would be canceled, but you also don’t want to lose access.
Do you click the link?
While our hyperconnected world makes it easy to take care of financial tasks in just a few clicks, it also requires greater vigilance about who we share information with, what we respond to, and, yes, which links we click.
While you may have a strong password and generally follow cybersecurity best practices, we can all be vulnerable to imposter scams.
What is an imposter scam?
$3.5B
The amount consumers reported losing to imposter scams in 2025, making it the most-reported type of fraud.
An imposter scam is when a fraudster pretends to be a trusted person, company, government agency, financial institution, coworker, family member, or friend to convince you to send money, share personal information, or grant access to your accounts. Impersonation can happen through phone calls, text messages, email, social media, messaging apps, search ads, video calls, and AI-generated voice or video content. In short, that person is not who they say they are. Fortunately, there are ways to detect these scammers and prevent a financial setback.
Let’s go over ways to protect yourself together.
According to the Federal Trade Commission (FTC), fraudsters most commonly impersonate well-known businesses and government agencies—such as the Social Security Administration, IRS, and Medicare—accounting for $3.5 billion in losses for consumers in 2025.
While phone calls remain a common tactic, scammers increasingly use text messages, email, social media, and other digital channels to reach potential victims. One increasingly common scam starts with a text message that appears to come from your bank, warning of suspicious activity on your account. The message may urge you to call a number, click a link, or even move your money to a "safe" account. If you receive a message like this, pause before taking action and contact your financial institution directly using a trusted phone number or website.
Other common imposter scams include:
- Fake package delivery or unpaid toll notices
- Tech-support alerts claiming your device has been compromised
- Employment and remote-work opportunities that require personal information or upfront payments
- Cryptocurrency recovery services that promise to help recover lost funds
- Social Security, Medicare, or other government benefit verification requests
- Messages appearing to come from company executives requesting money, gift cards, or sensitive information
- Family emergency scams, including those that use AI-generated voices to sound like someone you know
- Fake account security alerts, subscription renewals, or prize notifications designed to create urgency
No matter the approach, scammers often try to create a sense of fear, urgency, or excitement to get you to act without stopping to verify the request. Taking a moment to slow down and confirm who you're communicating with can help you avoid becoming a victim of fraud.
You can learn more about trends in scams on the FTC’s website.
As technology evolves, so do scammers' tactics. Fraudsters are finding new ways to make their messages, calls, and requests appear more convincing.
One emerging tactic is AI voice cloning, where scammers use publicly available audio from social media, videos, or other sources to mimic the voice of a family member, friend, or coworker. They may call claiming to be in an emergency and ask for money right away.
Consider creating a family verification phrase or asking a question only the real person would know the answer to before taking action.
Scammers are also using AI-generated audio and video, sometimes called deepfakes, to impersonate executives, government officials, or customer service representatives. These messages can appear authentic and may be used to request sensitive information or urgent payments.
Another growing tactic is social media impersonation. Fraudsters may create fake profiles that look like legitimate businesses, financial professionals, charities, or even people you know. They often use these accounts to build trust and encourage victims to share personal information or send money.
There are some telltale signs of an imposter scam, whether occurring through phone, text, social media, video call, or another digital channel. Watch for these warning signs:
- Pressure to act immediately. Scammers often create fear, urgency, or excitement to get you to act before you have time to verify the request.
- Unexpected requests involving money. Be cautious if you're asked to wire money, buy gift cards, send cryptocurrency, use a payment app, or move funds to a "safe" account.
- Requests for sensitive information. Never share passwords, account credentials, Social Security numbers, MFA codes, one-time passcodes, or other security verification codes.
- Messages about account problems that require immediate action. Fraudsters frequently claim there's suspicious activity, a billing issue, or a risk of account closure, then direct you to click a link, call a number, or log in through a provided message.
- Requests to download software, grant remote access, or share your screen. These tactics are often used to gain control of devices and accounts.
- A request that seems unusual or out of character. Even if it appears to come from a family member, coworker, or trusted organization, pause and verify through a separate, trusted channel.
- Someone asking you to trust a voice or video alone. AI-generated voices and deepfake videos can be used to impersonate people you know or organizations you trust.
- Requests to keep the conversation secret. Scammers often tell you not to discuss a request with family members, coworkers, your financial institution, or anyone else who might help verify it.
If something feels off, it probably is. Some tips to stay safe include:
- Confirm the legitimacy of who is trying to reach you. Avoid clicking links or calling phone numbers provided in a message. Instead, contact the organization using information from its official website, your account statement, or the back of your card.
- Don’t rely on caller ID, email display names, or social media profiles. Scammers can impersonate phone numbers, email addresses, and online accounts to appear trustworthy.
- Never share passwords, account credentials, verification codes, or MFA codes. Legitimate companies generally won’t ask for this information unexpectedly.
- Be cautious of requests involving urgent payments, gift cards, cryptocurrency, or moving money to another account. These are common tactics used in imposter scams.
- Take a pause before acting. Scammers often count on people reacting quickly rather than verifying the request.
- Enable multi-factor authentication and account alerts when available. These tools can help protect your accounts and notify you of suspicious activity.
- Talk to someone you trust if you're unsure about a request. A second opinion can help you spot warning signs you may have missed.
- Report scams. You can report all types of fraud to the FTC and notify any organization being impersonated.
Security for your retirement accounts at Principal®
Principal offers a customer protection guarantee to reimburse participants of employer-sponsored retirement accounts for losses from unauthorized activity occurring through no fault of their own.
If you suspect someone is impersonating Principal, call our fraud hotline at 800-642-3788 or report unethical or fraudulent activity online.
What’s next?
If you haven’t already, check that you have access to your account at Principal and set up multi-factor authentication as an added layer of protection. To strengthen security on your account at Principal, you can now set up login using a passkey. A passkey is a fingerprint, facial recognition, or PIN that allows you fast access to your information. To set up your passkey, log in with Principal and follow the on-screen instructions on your dashboard.
