Incident Response — Military Family Targeting (During Deployment / Training)

The phone call sounds real. The caller knows the unit. The caller knows the deployment location. The caller has a name and a rank and an office. The story has urgency built in — your soldier is hurt, transport is happening now, the bill has to clear before the plane lifts. None of that is evidence the call is real. Every detail can be scraped, purchased, or socially engineered out of an FRG group in an afternoon. What separates a real notification from a scam is not what the caller knows. It is how the call is delivered, and what the caller asks you to do.

This page is for the spouse, parent, or partner who just hung up — or who is still on the line and reading this on a second device. Read the first box. Then act.

If those three facts contradict what the caller said, the call is a scam. There is no exception. There is no special “expedited” process. There is no overseas variant. The DoD has not, in its history, called a family to collect money for medical care, transport, leave, or paperwork. If you remember nothing else from this page, remember that.

A scam caller will push back when you say you are hanging up. They will escalate — “ma’am, there is not time, he is on a stretcher right now, the plane is on the tarmac.” That escalation is the tell. A real casualty assistance officer would never pressure a family member to stay on the phone or send money. The pressure exists because the scammer knows the moment you hang up, the spell breaks. Hang up anyway. If your soldier is genuinely in trouble, the verified channels will tell you within an hour. You have not “missed” anything.

Write down the caller-ID number even if it looked spoofed (it almost certainly was — common spoofs are 703 area code Pentagon-adjacent, 910 Fort Bragg/Liberty, 706 Fort Benning/Moore, or the actual published number of a real unit office). Spoofed numbers still get logged by your carrier and can be subpoenaed.

How they got the info

OPSEC failed somewhere in the chain. That is not a moral failure on anyone’s part — modern unit life leaks information through dozens of channels, most of them well-meaning. Common sources:

Public social media post (yours, the unit’s official page, a deployment ceremony, a fundraiser).
A pre-deployment “honor flight” or “send-off” event that was open to the public.
A spouse Facebook group / FRG group that was infiltrated by a scammer (this happens routinely — vet new members).
A unit roster that leaked.
Purchased data-broker info plus public records.
Romance scammer who befriended you (or another spouse) over months specifically to build target packages.

The order matters less than the realization that the target package on you was probably assembled weeks or months ago. The casualty-affairs call is the payoff phase of a longer operation. Anything you can do now to interrupt the next phase — additional calls, additional fake-officer pivots, attempts on extended family — is worth doing.

It is also worth assuming that if you were targeted, other spouses in your unit may be on the same list. Mention the call to your FRG leader. They should warn the group. Scammers work batches.

Lock down OPSEC right now

Friends-only your social profiles. Untag deployment ceremony photos. Stop posting “finally said goodbye” or “X months down, Y to go” countdowns.
Untag your husband’s unit, location, deployment dates in past posts. Yes, going back.
Audit FRG and spouse-group memberships. Confirm with the FRG leader that any new joiner is legit. If you administer a group, require verifiable info before approval (last name + soldier’s full name + unit).
Remove yourself from data brokers — see the Big Ass Data Broker Opt-Out List (linked from /cybersecurity/prevention).
Set Google Alerts for your name + husband’s name + unit to catch new public mentions.

The countdown posts are the single biggest leak. “Halfway through!” tells a scammer the deployment length and approximate redeployment window. “He leaves Sunday” tells them the absence has started. Posting from the airport hangar tells them the unit and date. None of these are bad on their own; aggregated, they assemble the target package the scammer uses to sound credible.

Treat photos with the same caution as text. A picture of your soldier in uniform at the send-off ceremony is a high-resolution source of unit patches, rank, name tape, and ceremony location. Even if your account is locked, that photo has likely been shared by someone else’s unlocked account. Audit not just what you post but what tagged-you posts exist.

Common deployment-targeted scam patterns

Casualty / medical-transport co-pay scam (Jen’s case)
Phantom command demanding “emergency leave money” for the soldier
Romance scam: dating-app account claiming to be a deployed soldier, targets lonely civilians (often older women) for hundreds of millions of dollars in aggregate annually
“Care package” / “support the troops” charity scams (always verify a charity on Charity Navigator or BBB Wise Giving Alliance before donating)
Investment / “guaranteed military discount” fraud targeting BAH-receiving families
PCS-move scams — fake moving companies, “VA-approved” mortgage rate scams
Real estate / rental scams using stolen listing photos
“Soldier locked out of country needing wire” — variant of romance scam

The casualty co-pay scam is one of the most psychologically effective because it weaponizes the exact fear that defines a deployment. The emergency-leave variant works because spouses know real emergency-leave processes exist and don’t know the details. The romance scam works because the impersonator does the work over months — by the time money is requested, the target is emotionally invested in someone who does not exist.

If a member of your family has been talking with a “deployed soldier” online for weeks and you have never met him, never video-called him, and he has reasons he cannot — that is a romance scam. The reasons are always plausible (operational security, restricted bandwidth, unit policy). Real soldiers can video-call. The “operational security” excuse is the impersonator’s shield.

Money already sent — partial reversal

Bank wire: call your bank IMMEDIATELY — some consumer wires reversible within hours via BSA fraud flag.
Cash App / Zelle / Venmo / PayPal: usually NOT P2P-reversible, but file in-app fraud report AND have your bank dispute it as unauthorized.
Wire service (Western Union, MoneyGram): some have same-day reversal — call the service immediately.
Gift cards: call the issuer (Apple, Google, Amazon, Steam) for freeze of unredeemed balance.
Crypto: report to the exchange in case the destination is on their platform; almost never recoverable.
File FBI IC3 report at ic3.gov.

The speed of the bank call matters more than anything else. Consumer-protection windows are short — often measured in hours, not days. If you sent the money this morning and call before close of business, your chances are dramatically better than if you call tomorrow.

Do not skip the IC3 report even if you believe the money is unrecoverable. IC3 reports feed the joint task-force intelligence that eventually shuts down the operations behind these scams. The report you file today helps the next family.

Pre-deployment family security checklist

The things every spouse should have BEFORE the soldier leaves. If you are reading this mid-deployment, do as many as you can now and treat the rest as a list for next time.

Family safe word agreed across everyone (parents, siblings, kids old enough). See /cybersecurity/incident-response/voice-clone-scam.
FRG leader, Rear-D commander, and branch Casualty Operations numbers saved in every adult family member’s phone.
General Power of Attorney AND medical Power of Attorney executed at a JAG office (free).
Joint bank accounts with daily withdrawal limits set.
Account-activity alerts enabled on all financial accounts.
Social media privacy locked down on both sides (yours and soldier’s).
Background check on any financial advisor — verify via FINRA BrokerCheck (brokercheck.finra.org).
Important documents (deployment orders, will, insurance) scanned and stored in encrypted cloud (Cryptomator over Dropbox, etc.) with access shared via password manager.

The safe word is the cheapest, most effective control on this list. A four-word phrase agreed across the family — something no scammer would guess, nothing that appears in your public history — defeats voice-clone scams, ransom scams, and any “this is your husband, I need help” call. If the caller cannot produce the safe word, the call is a scam. Period.

JAG legal services are free for service members and their dependents. The Powers of Attorney are not optional paperwork — they are the things that let you handle the emergencies that actually do happen (a car title transfer, a medical decision, a lease signature) without being blocked by the absent spouse’s signature. Walk into the JAG office before the deployment, not during.

Free military-family support resources

Most spouses learn about these after the crisis is over. They are free. Use them.

Military OneSource — 1-800-342-9647 — 24/7, all branches, FREE legal, financial, counseling, child-care assistance.
Military Family Life Counselor (MFLC) — free, confidential, non-medical counseling at every installation. Walk in or call.
Branch-specific family support:
- Army Community Service (ACS)
- Navy Fleet & Family Support
- Air Force Airman & Family Readiness (A&FR)
- USMC Marine & Family Programs
- CG Work-Life
- Space Force uses A&FR
Service-specific Aid Societies (emergency loans, often interest-free):
- Army Emergency Relief (AER) — armyemergencyrelief.org
- Navy-Marine Corps Relief Society (NMCRS) — nmcrs.org
- Air Force Aid Society (AFAS) — afas.org
- Coast Guard Mutual Assistance — cgmahq.org
Tragedy Assistance Program for Survivors (TAPS) — taps.org — if a real loss occurs.

Military OneSource is the single most underused resource in the entire military family ecosystem. The legal consults alone — fraud, identity theft, landlord disputes, debt — would cost hundreds of dollars an hour on the civilian side. The counseling is non-medical and does not enter the service member’s medical record, which removes the clearance and career anxiety that keeps many spouses from talking to anyone.

MFLCs rotate through installations and embedded units. They take walk-ins. They are not chaplains and they are not in your command’s reporting chain. They exist specifically for situations like the one you just experienced.

Aid Societies issue emergency loans for the categories of crisis that the DoD does not formally cover — emergency travel, utility shut-offs, unexpected medical expenses, funeral travel. The application is fast. The loans are interest-free or near-zero. They are designed for the gap between “this is an emergency” and “the formal process will take weeks.”

Reporting

Scenario	First call	Secondary	Legal/regulatory
Active scam call (no money sent yet)	Hang up; verify via FRG + Rear-D	Service Casualty Operations + service CID	—
Money sent	Your bank/app fraud line	FBI IC3 ic3.gov	FTC ReportFraud.ftc.gov; service CID
Romance scam impersonating a servicemember	FBI IC3	AARP Fraud Watch 1-877-908-3360	Service CID (1-844-276-9243 Army; NCIS, OSI, CGIS by branch)
OPSEC leak (FRG infiltrated, roster posted, etc.)	Unit S2/intel + Rear-D	Service CID	—
Crisis — spouse mental health	Military OneSource 1-800-342-9647	988 (or 988 + press 1 for Military Crisis Line)	—
Suspected foreign-intelligence-entity (FIE) contact	Local CI element / Army CI 1-800-CALL-SPY	DCSA; DOD IG 1-800-424-9098	SAEDA

Report even if you think the scam was obvious and you did not engage. The aggregate reporting is what lets investigators correlate calls across families, time zones, and units. A single report looks like an isolated incident; one hundred reports of the same caller-ID range and the same script becomes an operation that can be disrupted.

For romance-scam impersonation specifically: if you can, screenshot the impersonator’s profile, the dating-app conversation, and any photos used (the photos are almost always stolen from a real soldier’s social media — that soldier deserves to know their identity is being abused). Submit those with the IC3 report.

Suspected foreign-intelligence-entity contact is its own category. If the caller’s questions drifted past “send money” into specifics about unit movement, equipment, schedule, or capabilities — that is no longer a financial scam. SAEDA (Subversion And Espionage Directed against the Army, or branch equivalent) reporting is mandatory and protected. Call the CI line. Do not try to assess whether the contact “rises to the level” on your own.

Pivot to

/cybersecurity/incident-response — the general incident-response landing page with adjacent playbooks.
/cybersecurity/incident-response/voice-clone-scam — the safe-word setup and the AI-voice variants that target families.
/cybersecurity/incident-response/servicemember — the servicemember-side playbook if your spouse is the one being targeted directly.
/cybersecurity/incident-response/clearance-holder — if you or your spouse hold a clearance, foreign-contact and reporting obligations attach to incidents like this.
/cybersecurity/threats/social-engineering — the broader pattern that this scam fits into.
/cybersecurity/prevention/dfp-guide — digital footprint reduction, including the data-broker opt-outs that cut the supply of target-package data.

The call was designed to make you feel like there is no time. There is time. The verified channels exist precisely for moments like this — the FRG, the Rear-D, the Red Cross, branch Casualty Operations — and they answer the phone twenty-four hours a day, every day of the year. Use them. They will tell you within the hour whether anything is actually wrong. If your soldier is fine, you have lost nothing but the hour. If your soldier is genuinely hurt, the real process moves faster than the scammer’s fake urgency ever could.