Government impersonation scams - how to tell if a message is really from a government agency

A message arrives saying you owe money, missed jury duty, or that your Social Security number has been linked to a crime. It sounds official. The caller ID matches. There is a case number.

The good news is that you do not have to judge how convincing it is. Real agencies behave in ways scammers cannot copy, and the mismatch is easy to check.

Quick answer

Four demands are always fraudulent, no matter who appears to be making them:

1. Pay in gift cards, cryptocurrency, wire transfer or a payment app
2. Move your money to a "safe" or "protected" account
3. Withdraw cash and hand it to someone, or leave it somewhere
4. Buy gold or another precious metal and give it to a courier

The FTC's own wording, from a July 2025 alert: "No one from the government will ever tell you to buy and deliver gold bars, move your money, or give cash to anyone."

If a message contains any of those four, you are finished — it is fake, and no further analysis is needed.

What is a government impersonation scam?

A government impersonation scam is a fraud in which someone pretends to represent a government agency in order to take money or personal information. The impersonated body supplies the authority; the story supplies the urgency.

In the US, the FTC names the agencies most often imitated: itself, the Social Security Administration, the IRS, Medicare, local sheriffs' offices, courts and immigration authorities. Invented bodies appear too — the FTC cites a non-existent "National Sweepstakes Bureau", and the FBI's 2025 alerts describe a fictional "International Financial Trading Commission".

This is not a small category. People reported losing $920 million to government impersonators in 2025, up from $789 million in 2024, within $3.5 billion lost to imposter scams overall. Government impersonation was among the most reported complaint types in the FBI's 2025 Internet Crime Report.

How the scam works

The sequence rarely varies:

1. Unexpected contact — a phone call, text, email, or social media message.
2. An authority claim, backed by a case number, a badge photo, a spoofed caller ID, or a lookalike email domain.
3. A problem with consequences — an unpaid debt, a suspended number, a warrant, a missed jury summons, a benefits error, a compromised account.
4. A deadline, usually today, sometimes within the hour.
5. Isolation — do not hang up, do not tell your bank the real reason, this is a confidential investigation.
6. A payment or disclosure instruction in a form that cannot be undone.

Step 5 is the one to watch for. Genuine officials have no interest in what you tell your family or your bank. Secrecy exists only to keep other people from interrupting the script. Authority scams covers why the badge works even on people who know better, and urgency manipulation covers the deadline.

The four highest-loss versions

The "move your money to protect it" call

Someone from a bank, then a federal agency, tells you your accounts are compromised or your identity is tied to a crime. To protect the funds during the investigation, you must transfer them to a secure government account.

There is no such thing as a government safekeeping account for private money.

The gold and cash courier

The same story, one step further. You are told to withdraw cash or buy gold bars from a legitimate dealer, then hand them to a courier or federal officer who will keep them safe. The Social Security Administration's Office of the Inspector General issued its own alert in July 2025 about criminals impersonating SSA OIG agents to collect cash, gold and other untraceable assets.

Nobody from any government collects valuables from your home.

The suspended Social Security number

A recorded or live call says your Social Security number has been suspended because of suspicious activity. As the FTC puts it, "the real Social Security Administration won't threaten you or suspend your Social Security number." Numbers are not suspended. The concept does not exist.

Tax, fines and legal threats

Threats of arrest, deportation, licence suspension or immediate court action over an unpaid tax bill. The FTC's line: "The IRS will never email, text, or message you on social media with threats or demands." Real tax disputes arrive as letters and come with appeal rights, not thirty-minute deadlines.

How to check a .gov address

US federal, state, local and tribal government bodies use the .gov domain, which is restricted — you cannot buy one without proving you are a government organisation. The UK equivalent is gov.uk. That makes the domain one of the few reliable signals in a message.

Read it correctly. The part that matters is immediately before the first single slash:

https://ssa.gov-benefits-review.com/verify
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
              the real domain — a .com

ssa here is just a word at the front, chosen by whoever registered gov-benefits-review.com. Anyone can put an agency name in that position. The same rule applies to email: noreply@irs.gov-refunds.net is not the IRS.

Watch for these shapes:

• An agency name on .com, .us, .org, .net or .co — irs-refund.us
• A hyphenated near-match — social-security-gov.com
• .gov appearing anywhere except at the end of the domain
• Free mail domains — a real agency does not email you from Gmail or Outlook.com

The safest habit skips the inspection entirely: never follow a link in an unexpected official message. Type the agency's address yourself. If you are not sure of it, in the US you can search from usa.gov, which lists real agency sites. How to check if a link is safe goes deeper on reading URLs.

What real government contact looks like

Since April 2024 the FTC has enforced a rule specifically prohibiting the impersonation of government bodies and businesses, which is why you now see agencies publishing "we will never" statements so bluntly. They are worth reading as a checklist rather than a disclaimer.

The one verification step

Two things make it hard, and both are engineered:

They tell you not to hang up. A real official does not mind. Anyone who objects to you verifying them has answered the question.

They know things about you. Your address, the last four digits of an account, your employer, a recent purchase. Data breaches and data brokers make this cheap. Knowing details is not authority — it is pretexting.

What to do if you already paid

Not a failure of intelligence. These scripts are refined against thousands of calls, and the FTC's data shows they work on people of every age and background.

1. Contact whoever moved the money, now. Bank, card issuer, wire company, gift card issuer, payment app or crypto exchange. Keep gift cards and receipts — the FTC advises calling the issuer and explaining that a scammer tricked you into giving them the number and PIN.
2. Report it at ReportFraud.ftc.gov and, for internet-based contact, IC3.gov. If a large wire went out in the last day or two, file at IC3 immediately — the FBI's Recovery Asset Team works on fast reports.
3. If you shared a Social Security number or identity document, go to IdentityTheft.gov, which produces a personal recovery plan, and consider a free credit freeze.
4. Change passwords on anything you disclosed, starting with email, and turn on two-factor authentication.
5. Expect a recovery approach. Someone will offer to get the money back for a fee. That is the second scam.

For the full order of operations, including which agency does what with your report, see how to report an online scam.

Outside the United States

The agency names change; the structure does not. Every version still fails the same test — no tax authority, police force or benefits agency in any country takes payment in gift cards, or sends someone to collect cash from your home.

Report to your national body: Action Fraud in the UK, Scamwatch in Australia, the Canadian Anti-Fraud Centre in Canada. If your country is not one of those, find its official consumer protection or cybercrime body and go to it directly, typed into the address bar — never through a search advert, which is itself a route to fake reporting sites.