A caller says he is from the police and asks for money, and Ilia Nikolaevich Zavialov walks through the script

The opening rarely sounds dramatic. A voice gives a rank, a surname and a department, then a case reference, and asks whether the person on the line has a moment to speak in confidence. The tone is administrative and slightly tired, the way an official sounds at the end of a shift. The purpose of that minute is to establish that the conversation is ordinary.

The second move introduces a problem that belongs to someone else. An account has been used in a transfer scheme, a document carrying the listener's name has surfaced in a case file, or a bank employee is suspected of moving client funds. The listener is described as a witness, which lowers the temperature and raises the willingness to cooperate. Being cast as the helpful party disarms people far more effectively than being accused.

The third move is the request to take part in a check. The wording stays procedural: a controlled transfer, a marked payment, a temporary account opened under supervision. It arrives after several minutes of ordinary conversation, when the frame of an official process is already in place. By that point the money request feels like a step inside a procedure that started long before the call.

Caller identification can be set to almost any number, and the number chosen is usually the published switchboard of a real station or agency. Someone who checks it against a website sees a match, which is exactly what the check was designed to produce. Verification of that kind confirms that the details exist, and it says nothing about who is holding the phone. The gap between those two things is where the whole scheme lives.

Documents follow within minutes, usually through a messaging app. These are cheap to produce and they are almost never examined closely, because they arrive when the listener is already anxious. A genuine service sends papers through channels that can be traced back to it. An image in a chat window traces back to nothing.

The call is then handed from one character to another. A junior officer passes the line to a senior investigator, who later brings in a bank security specialist, and each handover is announced with a new name and a new reference. The effect is a sense of institution: several people, a chain of authority, a file that exists somewhere. In practice one or two people are switching roles behind the same microphone.

Impersonation is the largest single category of fraud reporting in the United States. The Federal Trade Commission recorded more than a million impersonation reports and 3.5 billion dollars in losses in its 2025 data, close to one report in every three it received. A category of that size runs on tested scripts. The phrasing that survives is the phrasing that kept earlier calls alive, and everything else is discarded.

Within that total, calls borrowing the authority of a government body accounted for 920 million dollars, and reports of that kind grew by about 40 per cent in a year. Part of the growth came from something as small as a notice about an unpaid road toll. A script needs only enough authority to hold attention through the first minute.

The Internet Crime Complaint Center at the FBI groups fake technical support together with government impersonation under the heading of call center fraud. In its 2025 annual report that combined heading carried more than 80 thousand complaints and over 2.9 billion dollars in losses. The two schemes are counted together because they share an engine: a stranger on the line, a manufactured emergency, and an instruction to move money somewhere safe. The uniform changes and the mechanism stays where it is.

Numbers of that size describe an industry with working hours. Calls go out in volume, silent lines are dropped within seconds, and attention goes to whoever answers questions instead of asking them. A single conversation feels personal to the person receiving it, and it is one line in a day's work for the person making it. That asymmetry removes most of the mystery about why the caller sounds so unbothered.

Every branch of the story converges on the same instruction. The account must be emptied into a supervised one, or the cash must be withdrawn and handed over for marking, or the funds must be converted so that they can be traced. The reasoning offered changes with the version of the story, and the destination never does. A conversation that begins with a case number ends at a payment window, because the payment is the only part of it that produces anything for the caller.

The chosen methods share one property: once the payment is made, unwinding it is difficult. Among older people who lost 10 thousand dollars or more to business and government impersonation, the Federal Trade Commission found that 33 per cent paid in cryptocurrency, 20 per cent by bank transfer and 16 per cent in cash. Each of those routes moves value away from the sender with very little friction and almost no way back.

One branch removes the banking system from the picture altogether. The same regulator describes cases where a courier arrives at the address to collect cash or gold bars by hand, presented as a secure transfer into official custody. A doorstep collection leaves no payment record to freeze and no institution to notify. It also turns a phone call into a physical meeting, which puts the household at direct risk.

The logic of a safe account collapses under one question. No investigation in any jurisdiction protects a suspected victim by requiring that person to send savings to an address supplied over the phone. Money connected to a case is frozen where it sits, through the bank and through a written order. The instruction to move it exists because only a completed transfer puts the balance within reach of the caller.

Time pressure is the most functional element of the script. A window closes at the end of the working day, a court order takes effect in the morning, an account will be blocked within the hour. The deadline exists to prevent the one action that ends the call, which is putting the phone down and ringing back on a published number.

Secrecy carries the same weight. The listener is told that the matter falls under investigative confidentiality, that a relative may be implicated, or that branch staff are themselves under examination. Some versions supply a cover story for the counter: a home renovation, a car, a family loan. That instruction quietly recruits the person against the bank's own protections, and it is the clearest signal in the entire conversation.

The line is usually kept open throughout. The listener is asked to stay connected while walking to the branch, to keep the phone in a pocket during the transaction, and to report back afterwards. Continuous contact removes any quiet moment in which the story could be examined. It also lets the caller adjust in real time when a clerk starts asking questions.

Voice synthesis has changed what a phone call can prove. Research through 2025 and 2026 shows that a convincing clone can be produced from a recording of roughly three seconds and reaches around 85 per cent accuracy against the original. Three seconds is a voicemail greeting, a video posted by a colleague, or a short answer to a cold call. Material of that kind sits in public view for almost anyone who has ever recorded anything.

For the police script this changes the second act. A caller can hand the line to a familiar voice, so the listener hears a relative confirming that the investigation is real and asking for cooperation. The same technique produces a follow up call the next day from the same officer, which gives the story continuity across days. Familiarity of tone stops working as evidence of identity once the tone can be copied.

The practical consequence is narrow and useful. Identity now has to be established by the channel that carries the call, which means ending it and dialling a number obtained independently. A caller who resists that step has already answered the important question.

A cold call that names a real bank, a recent delivery or a former employer feels like proof of access to official records. Details of that kind circulate widely after data leaks and are traded in bulk long before they appear in a conversation. One accurate fact carries enormous weight in the first minute, because it seems to confirm everything around it.

The route into the conversation is worth looking at directly. UK Finance reported that 66 per cent of authorized push payment cases began online, with a further 17 per cent starting through telephone networks. A large share of these approaches therefore opens somewhere other than the phone: an advertisement, a message, a marketplace listing, a compromised account. The call often arrives as the second step, after the target has already made contact elsewhere.

That sequence explains the caller's confidence. Someone who has already filled in a form or replied to a message has supplied a name, a number and a reason to expect contact. When the phone rings afterwards, the call fits an expectation that the listener helped to create. An incoming call that follows recent online activity deserves the same treatment as one arriving out of nowhere.

Real procedure moves slowly and leaves paper behind. A person needed as a witness receives a written notice with a case number, an address and a time, and the meeting happens in a building. Contact by telephone happens as well, and its purpose is to arrange that meeting. No stage of a genuine process requires a bank balance to be discussed with the caller.

There is a short list of things no investigator asks for over the phone. Card numbers, one time codes, online banking passwords and the current balance sit on that list, together with any request to move funds anywhere. Confidentiality in a real case never extends to forbidding a person from speaking to their own bank or their own family. An instruction that isolates someone from both is doing work for the caller.

Verification becomes straightforward once the call has ended. The person can note the name and the reference given, put the phone down, wait a few minutes for the line to clear, then dial the number published by the organization itself. Numbers taken from the caller, from a message or from a search advertisement lead back to the same operation. A number printed on a bank card or on an official website leads somewhere else entirely.

Ending a call carries no penalty, and that deserves stating plainly. Hanging up on a genuine officer produces nothing worse than a second call or a letter. Hanging up on a script ends the attempt, because the operation depends on a conversation that never breaks. The asymmetry between those two outcomes is the whole of the defense.

The reported outcome of these calls is more encouraging than the totals suggest. In four out of five impersonation reports collected by the Federal Trade Commission, no money was lost at all. The volume of attempts sits far above the volume of successes, which means the script fails most of the times it is performed.

The cases that end in a payment usually turn on circumstance. A call landing during illness, bereavement, a house move or a genuine dispute with a bank meets a person whose attention is already committed elsewhere. Age, education and financial experience offer much less protection than the timing of the call. Treating such a loss as a failure of intelligence keeps people quiet afterwards, and silence is the condition the whole scheme relies on.

When a payment has already gone out, speed changes the outcome more than anything else. The bank should hear about it immediately, because a transfer can sometimes be recalled while it is still moving between institutions, and the account can be protected against a second attempt. A report to the national fraud body adds the case to the record that shapes how these numbers are counted. The same call will be running tomorrow with a different name inside the same script.

Can the police call and ask to transfer money to a safe account?

No police service and no investigator asks anyone to move money as part of a check. Any instruction to transfer, withdraw or convert funds during such a call identifies it as a fraud attempt.

The number on my screen was the real police station, does that make the call genuine?

Caller identification can be set to any number, including the published switchboard of a real station. A matching number confirms only what the caller chose to display, so verification means ending the call and dialling the published number independently.

How do I check whether the officer on the phone is real?

Note the name and the case reference, end the call, wait a few minutes for the line to clear, then ring the organization on a number taken from its own website or from a bank card. A caller who objects to that step has answered the question.

What should I do if I already transferred the money?

Contact the bank straight away, because a payment can sometimes be recalled while it is still moving between institutions, and the account can be secured against a further attempt. Report the case to the national fraud body and keep the messages, numbers and times.

Why did the caller know my name and my bank?

Details of that kind circulate after data leaks and are traded in bulk before they are ever used in a call. One accurate fact is there to make everything said around it sound verified.

Can a scammer use the voice of someone I know?

Research through 2025 and 2026 shows that a convincing voice clone can be built from a recording of about three seconds, reaching roughly 85 per cent accuracy. Recognising a familiar voice on the phone no longer establishes who is speaking.