Features
Part of Which comes first after a scam: reporting it, or preserving evidence?
Recovery checklists work best ordered by what expires first
A recovery checklist ordered by what expires: calls that work only in the first hours, evidence lost the moment you tidy up, and the week-later pass.
Recovery advice is usually written as a list of good ideas. The problem with a good idea is that it has no deadline attached, and half of what matters here expires.
So this checklist is ordered by what is going away. The first group has hours. The second disappears the moment anything is deleted. The third is where people think they have finished and have not. Work down it, and skip the parts that do not apply rather than reading the whole thing first.
What to take away
- Money and recovery settings are the two things that decay fastest, and both come before anything tidy.
- Deleting messages, accounts, or apps destroys the evidence that a bank or a platform will ask you for.
- The pass most people skip is the one a week later, because access is often held quietly rather than used at once.
Group one: things with hours on them
- Call the payment provider.Say you were defrauded, name the transaction, and ask what is possible for that payment type. Do this before anything else, including before you understand what happened. Card disputes usually have to be raised within 60 days of the statement under the Fair Credit Billing Act. A bank transfer can sometimes be recalled within 24 to 72 hours, and rarely after that.
- Stop any payment still in progress, including a final one described as releasing the rest. There is always another fee. The window to stop one is short, often hours rather than days.
- Check the recovery email and recovery phoneon any account involved. Whoever has access changes these first, and once they are theirs a password reset does not get you back.
- End other sessionson the affected account and on the email behind it, then change those two passwords in that order.
- Tell one person.Not for comfort. It is the fastest error-correction available, and every later stage of this works better when somebody else knows.
Where a code was shared or a password typed, treat this as an account compromise rather than a payment problem, and the full order is in account security.
First hours: do these in order
- Call the payment provider first
- Stop any payment still in progress
- Check recovery email and phone
- End other sessions, then change passwords
- Tell one person
Group two: things that vanish if you clean up
The instinct after a loss is to delete everything. It is the single most expensive mistake in this whole process.
Save these before you remove anything:
- The message thread, including the first contact and any payment request.
- Transaction IDs, amounts, wallet addresses, and the name on the receiving account.
- Profile URLs and usernames for every account involved.
- Screenshots with the date and time visible.
- Emails, including full headers, plus any attached invoice or receipt.
Save before you delete anything
- Full conversation
- Profile or account name and link
- Payment references and dates
- Email headers
- Phone numbers used
- Screenshots of listing or message
Put it in one folder with a plain name. Your bank, the platform, and any report will run on that folder.
Report inside the platform before blocking, because blocking hides the account from you and leaves it working on everybody else.
Group three: the reports
Reports do less for your own money than people hope and more for everything else than people expect. Do them anyway, and do them once you have the folder.
Which report goes where
Consumer fraud?
FTC reporting route
check the next case
In the US, consumer fraud goes to the Federal Trade Commission's reporting route, internet-enabled crime goes to the FBI's complaint center, and identity misuse has its own recovery process at IdentityTheft.gov. Local police matter where there was a physical meeting, a threat, or a domestic account. Keep every reference number in the same folder.
The FTC route at ReportFraud.ftc.gov returns a report number when you file. The FBI complaint center is IC3, at ic3.gov, and returns a complaint ID. IdentityTheft.gov builds a recovery plan and gives a plan number. The FTC consumer line is 1-877-382-4357.
In Canada, report to the Canadian Anti-Fraud Centre on 1-888-495-8501 or at antifraudcentre-centreantifraude.ca. Ask for the reference number, then give it to your bank's fraud line. Privacy complaints go to the Office of the Privacy Commissioner of Canada.
Outside the US and Canada, the equivalents are your national fraud reporting body and your data protection authority. The reasoning for which report does what is in reporting and recovery.
Group four: the week after
This is the pass that catches the incidents that come back, and where documents were exposed it runs alongside the checks in identity verification.
| What to check | Why it is on this list |
|---|---|
| Recovery email and recovery phone | Attackers change these first, which blocks your own password reset. |
| Active sessions | A live session outlives a password change until you end it on every device. |
| Forwarding rules | A rule that copies your mail elsewhere keeps running after the account looks clean. |
| Credit freeze | A US credit freeze is free at Equifax, Experian and TransUnion and stops most new accounts in your name. In Canada, ask Equifax Canada and TransUnion Canada. |
| Statements and transaction list | A small test charge shows here first and often comes before a larger one. |
| The saved folder | Check that it still opens, and add anything new. Banks and platforms ask again weeks later. |
The week-after pass
- Recovery email and phone, again
- Sign-in history or active sessions
- Forwarding rules and app permissions
- Statements and card alerts
- Anything opened in your name
- New contact referencing the incident
What not to do, in order of how much it costs
Four moves feel productive and set you back.
Four costly moves to avoid
The move
- Paying a recovery offer
- Second loss
- Engaging to gather evidence
- Gains nothing
- Deleting account or app
- Destroys the record
- Waiting to call the bank
- Backwards
What it costs
- Paying a recovery offer
- No agency charges you
- Engaging to gather evidence
- Costs weeks
- Deleting account or app
- Unrecoverable
- Waiting to call the bank
- Call buys time
Paying anyone who contacts you offering to recover the money is reliably the second loss. No agency charges you to investigate a crime against you.
Continuing to engage to gather evidence gains nothing and costs weeks, and deleting the account, the app, or the conversation destroys the record.
Waiting to call the bank until you understand what happened is backwards, because the call is what buys time to understand it.
The risks that arrive after an incident, including the approach that offers to fix it, are mapped in phishing scams risks.
The short version
If you can only do five things:
- Call the payment provider now.
- Screenshot everything before you delete anything.
- Fix the recovery phone and email, then the password.
- File one report and keep the reference.
- Tell one person, and check the settings again in a week.
Common questions
How likely am I to get the money back?
It depends almost entirely on the payment method and on how fast you called, and often it is not recoverable at all. That is worth saying plainly, because the belief that it always comes back is what the follow-up offers are sold on.
Do I have to report it if I do not want anyone to know?
Nobody can make you. The reference number is genuinely useful later, and reports are handled routinely by people who see this every day.
How long should the whole process take?
The urgent part is an evening. The reports are an hour. The rest is a set of checks spread over a few weeks, and treating it as a project rather than a crisis is the version that gets finished.
What if I only realized months later?
Do the same list in the same order. The calls are less likely to help and the account and identity work is exactly as useful as it would have been.
Should I close my accounts and start again?
Rarely. Securing an account is faster than rebuilding a life around a new address, and closing it destroys the history that supports a claim.
