The call
Here’s how a call like this might sound.
Your phone rings. The caller says he’s a federal agent. He knows your business name and the bank you use. He says funds are missing, gives you a case number, and tells you the matter has to be handled today. He sounds professional, perhaps a little impatient. Then he says not to discuss it with anyone because the investigation is ongoing.
Nothing about that has to sound obviously wrong in the moment. A title, specific details, and a deadline can make a call feel official. The instruction to keep it secret is the biggest red flag. The pressure to act today is not a coincidence. It is how the caller tries to keep you from checking with someone you trust.
A specific warning reported by KATV on October 3, 2026, came from Little Rock police in Arkansas, not Arizona. Police said callers were impersonating FBI agents, U.S. Marshals, and other law enforcement personnel, and demanding payment for supposedly missing business funds. Read the report.
The short answer
A caller who knows your business name, your bank, and the name of a real federal agent has not proved who they are. Caller ID can be spoofed, real agent names can be found, and business details can surface in ordinary communications or public records. None of those details proves a breach or proves the caller is genuine.
Legitimate federal agencies will not call demanding payment, threatening arrest, or requesting financial information. If someone does that, it is not a legitimate agency, regardless of what the caller ID shows.
Decide on a written rule while you’re calm: no payment or account information based on an incoming call; independently verify urgent requests using a number you look up yourself; and require a second person to approve payment changes. Tell the whole team, including whoever handles the checkbook.
Why this works on normal people
This kind of call is built around ordinary human reactions. That doesn’t make the person receiving it gullible.
- Authority: A title does a lot of work. Most people haven’t spoken with a federal agent and have no familiar call to compare it with.
- Urgency: A deadline is meant to push aside the step you would normally take: pause and check.
- Secrecy: “Don’t tell anyone” cuts off the person who might say, “That doesn’t sound right.”
- Real details: A business name, owner’s name, bank, employee name, or actual agent’s name can sound convincing. Some details are public; others can appear in routine business interactions. Knowing them does not prove there was a data breach.
- Spoofed caller ID: The FBI and the FBI’s Internet Crime Complaint Center (IC3) warn that scammers can spoof real government phone numbers and use real employee names and credentials. Displaying a number is not the same as calling from it.
This can work on experienced owners, accountants, and bookkeepers. Being targeted is not a character flaw. A convincing identity plus pressure is designed to make a sensible person act before checking. The FBI’s IC3 public service announcement on law enforcement and government impersonation describes these tactics, including callers who urge people not to consult family, financial institutions, or law enforcement.
The rule that works: decide it before the call
Put these rules in writing and make sure everyone who handles money knows them.
- No payment or account information because of an incoming call. No transfer, wire, gift card, cryptocurrency, or banking details. No exceptions for titles.
- Hang up and verify independently. Find the agency’s official number on its own website and call that number. Don’t use a callback number supplied by the caller or rely on caller ID.
- Know what verification proves. Confirming that an agent with that name exists does not prove that person called you. Contact the agency through a number you sourced yourself and ask whether someone from that office is trying to reach you.
- Require two people for money movement. Any change to bank details, wire instructions, or payee information needs a second person’s approval through a separate channel. One person acting alone on an urgent request is exactly the vulnerability this rule is meant to close.
- Reject secrecy. “Do not tell anyone” is disqualifying. Tell your bookkeeper, business partner, or insurer.
- Post the rule and make reporting safe. Put a one-page copy at the front desk and in the finance area. Make sure anyone can report a strange call without being blamed or embarrassed. A rule in the owner’s head is hard to recall under pressure.
| The pressure tactic | The rule that defeats it |
|---|---|
| “There is a case number and a deadline today.” | No decision is made on an incoming call. |
| “Do not discuss this with anyone.” | Secrecy is disqualifying. Report the call immediately. |
| “Here is the number to call me back.” | Call only a number you looked up yourself. |
| “I have your company and bank details.” | Details are not verification. |
| “This must be handled today.” | Move money only with a second approval. |
The wider pattern
This is one version of a familiar attack: fake vendor invoices, fake bank fraud departments, a fake CEO messaging a bookkeeper, payroll diversion, and AI-cloned voices of real owners. The common thread is a trusted identity combined with urgency and secrecy. Voice cloning can make an identity sound more convincing, but it doesn’t change the defense: stop, verify through a number you found independently, and get a second person involved in payment changes. You can read more about this broader pattern in our guide to social engineering and why it matters.
What to do in the next ten minutes
Write this six-line rule and post it at the front desk and in finance:
- An incoming call never authorizes a payment or disclosure of account information.
- Hang up and find the organization’s official number yourself.
- Never rely on caller ID or a callback number provided by the caller.
- Confirming a real person’s name does not confirm they called.
- Banking or payee changes need two approvals through separate channels.
- Report suspicious calls immediately. You will not be blamed for raising a concern.
Then tell whoever moves money that no incoming call authorizes a payment, and they will never be in trouble for reporting one. Confirm that two approvals are required for banking changes. Save ic3.gov and the FBI’s public number, 1-800-CALL-FBI (1-800-225-5324), where the team can find them without searching under pressure. Add the rule to new-hire onboarding so it doesn’t remain tribal knowledge.
If someone has already responded, stop communicating with the caller. Contact your financial institution promptly if money or account details were involved, and report the attempt even if no money moved. The FBI directs people to report these impersonation scams to IC3 or call 1-800-CALL-FBI.
Which stage are you in?
- Stage one: Money can move on one person’s judgment, and there is no written rule. The team is relying on instinct under pressure.
- Stage two: The owner and bookkeeper know about the risk, but the rule is unwritten and there is no second-approval step.
- Stage three: There’s a one-page written rule, independent verification uses numbers the team looked up, payment changes require two approvals, and reporting a suspicious call is routine and blameless.
Where we come in
This is mostly about policy and people, and much of the fix costs nothing. Technology can help with the parts that are difficult to manage by hand: multi-factor authentication for email and accounting systems, restricting who can change bank details, alerts for unexpected forwarding-rule or account-setting changes, and records of who had access to what.
For a business asked by an insurer or auditor to show its controls, those records can help provide evidence of the process. That’s one practical role for Managed IT services Phoenix businesses may use alongside clear procedures and staff training. The FBI and IC3 recommendations above remain the key: verify independently and report the attempt.
Takeaways
- Don’t make a payment or share account information because of an incoming call, regardless of the caller’s title.
- Verify by calling a number you looked up yourself. Caller ID proves nothing.
- Confirming that a real agent exists does not prove that agent called.
- Require a second approval through a separate channel for banking or payee changes.
- Treat “do not tell anyone” as disqualifying, and make reporting blameless.
A written rule gives your team something steady to rely on when a caller is trying to rush them. If you’d like to talk through practical controls for your business, schedule an introductory call.
