The useful answer is that an official agency notice identifies an impersonation campaign by naming the specific behaviors no genuine employee would ever use. In its 2026 alert, the FTC describes callers who claim to be FTC officials, read out a fake badge ID, and threaten to deactivate the recipient's phone number. The notice then lists the specific promises and threats that a real FTC employee will never make, which is the clearest signal a reader can check against a live call.
What the notice says the callers do
According to the alert, the caller claims a phone was registered under the recipient's name and number and is being used to commit scams in another country (c01). To build credibility, the supposed official reads off a badge ID, which the notice says is fake (c02). If the person does not cooperate, the caller threatens to deactivate the phone number (c03).
The script then escalates. The caller transfers the person to a supposed police officer to file a report (c04). If the person hesitates, the caller may suggest calling the police department directly, and tells them what to search online to find the number (c05, c06). The notice is explicit that this feels like independent verification but is part of the scheme, because the people who answer that number are involved in the scam (c07, c08).
Why the callback is the trap
The callback step matters because it exploits a reasonable habit: checking a claim against a second source. The notice describes the second source as planted, so the appearance of confirmation is manufactured (c07, c08). The campaign then asks for ID and other personal information for a "report" and tells the person to keep everything secret (c09). Later comes the claim that the person is under arrest for the scams tied to the phone number and must travel to another country — unless they send money for a security deposit (c10, c11).
The official red flags the FTC lists
The notice gives four statements framed as absolute. These are the comparison points a reader can hold against any call, message, or message thread claiming to be from the agency.
- A real FTC employee will never reach out to ask for money, and will never connect the person to someone who says to send money (c12).
- A real FTC employee will never threaten to disconnect the phone (c13).
- A real FTC employee will never tell the person to keep the conversation secret (c14).
- A real FTC employee will never text a photo of their employee ID to "verify" their identity (c15).
Read together, these four points describe a pattern: demands for money, pressure through service loss, isolation by secrecy, and self-authentication through a document. A notice that names these behaviors is doing the work of separating an agency's real practices from a script that borrows its name.
A short checklist for any identity claim
The following checklist is a reading aid built from the notice's own language, not a tested verification method.
- Does the contact ask for money or a security deposit? The notice says a real employee never will (c12).
- Is there a threat to disconnect a phone? That is listed as something a real employee never does (c13).
- Is secrecy requested? The notice says a real employee never asks for it (c14).
- Is a photo of an employee ID being sent to prove identity? The notice says a real employee never does that (c15).
- Is a "verification" callback arranged by the caller, with search instructions supplied? The notice describes that as part of the scheme (c06, c07, c08).
Announcement versus implementation
This is a consumer alert about a reported pattern, not a new rule, a court action, or an enforcement outcome. The notice announces what the agency says it is hearing and states what its employees will never do. It does not describe arrests, charges, or recovery of funds, and nothing in the source indicates that any particular caller has been identified.
What the source does not say
The alert does not name the scammers, the countries involved, or the phone numbers used. It does not say how many people received these calls, how much money was lost, or whether any investigation is open. It does not describe a technical method for confirming a caller's identity, and it does not address cryptocurrency, wallets, or platforms of any kind. It also does not state that a similar script is being used by other groups or under other agency names.
Reading an official notice for your own files
For someone documenting a suspicious contact, the notice's value is its structure. It separates the reported script — the fake badge, the transfer, the callback, the arrest claim, the deposit demand — from the agency's stated practices. That separation is what makes a notice usable as a comparison: a reader can note which described behaviors appeared in the contact at hand and which did not. The notice does not, on its own, establish that any given call was fraudulent; it establishes what the agency says it does and does not do.
A reasonable takeaway is to treat the four "never" statements as the load-bearing part of the alert. They are short, specific, and phrased in a way that can be checked against what a caller actually said. The rest of the notice explains how the script builds trust, and it is that explanation — not a name match — that gives the red flags their context.