Reviews
After a scam, stop the payment before saving messages or reporting
After a scam, this gives the order that limits the loss: stop the payment, keep messages, secure accounts, freeze credit, report, and recognize a second scam.
Being scammed is disorienting, and the disorientation is part of how it works. The hours right after you realize what happened are the ones where your actions matter most, and they are also the hours when you are least able to think in order. This page is the order, so you do not have to invent one.
Read the first section now and the rest later. Nothing here requires you to talk to the person who scammed you, and nothing here costs money.
What to take away
- Do these in this sequence, and stop reading between steps only when a step is done.
- The instinct to delete everything is strong and it works against you.
- Different payment rails have genuinely different reversibility.
- Work outward from whatever the scam actually touched.
The first hour: stop the loss
Do these in this sequence, and stop reading between steps only when a step is done.
First hour: stop the loss
- Break contact, do not delete anything
- Cut the money routecall bank now
- Remove remote access from device
- Change primary email password first
- Write down the timeline while fresh
- Break contact, but do not delete anything.Stop replying. Do not tell them you know. Do not threaten them or demand your money back: it gives them a reason to move funds and to burn the accounts you would otherwise be reporting. Leave the messages, emails, and profile where they are.
- Cut the money route before you do anything else.If a payment is in flight, or a card or account is exposed, call the bank or payment provider now. That call comes before screenshots, before reporting, before telling family. See the payment table below for who to call and what to ask for.
- Get remote access off your device.If you were talked into installing a "support", "security", or "screen sharing" app, disconnect the device from the internet, then remove the app. Assume anything you typed while it was running was seen.
- Take back the accounts you still control.Change the password on your primary email first, it is the key to everything else, then on the accounts you reused that password on. Sign out all other sessions. Check for a forwarding rule, a new recovery address or phone number, or a new app password you did not create.
- Write down the timeline while it is fresh.Dates, amounts, names used, phone numbers, handles, and what you were told. You will be asked for this several times by several organizations, and your memory of it degrades quickly.
Preserve the evidence before you clean up
The instinct to delete everything is strong and it works against you. Every organization you are about to contact will ask for some of this.
Evidence to preserve before cleanup
- Screenshots with full sender address and link
- Transaction recordsreference, amount, date, recipient
- Original messages kept in place, not forwarded
- Files or apps you were sent or installed
- Your own timeline note tying it together
Keep a copy somewhere that is not on the device you think was compromised.
Money: who to call, and what to ask for
Different payment rails have genuinely different reversibility. This is the single biggest factor in what happens next, and it is worth knowing which one you used before you make the call.
Who to call by payment rail
How you paid
- Credit card
- Card issuer fraud line
- Debit card
- Bank fraud line immediately
- Bank transfer or wire
- Your bank, then receiving bank
- Payment app
- Your bank and app provider
- Gift card codes
- Card issuer or retailer
- Cryptocurrency
- Exchange you sent from
- Money transfer service
- Service fraud line
Call
- Credit card
- Dispute or chargeback
- Debit card
- Dispute, card blocked
- Bank transfer or wire
- Recall or fraud freeze
- Payment app
- Fraud claim
- Gift card codes
- Freeze remaining balance
- Cryptocurrency
- Flag receiving address
- Money transfer service
- Hold the transfer
Ask for
- Credit card
- New card number
- Debit card
- Time-limited protections
- Bank transfer or wire
- On receiving account
- Payment app
- Say you were deceived
- Gift card codes
- Sometimes unspent
- Cryptocurrency
- Transfers cannot be reversed
- Money transfer service
- If not yet collected
Money: who to call
| How you paid | Call | Ask for |
|---|---|---|
| Credit card | The card issuer's fraud line | A dispute or chargeback, and a new card number |
| Debit card | Your bank's fraud line, immediately | A dispute, and the card blocked; debit protections are governed by different rules than credit and several are time-limited |
| Bank transfer or wire | Your bank, then the receiving bank if your bank will contact it | A recall or fraud freeze on the receiving account |
| Instant bank-to-bank payment app | Your bank and the app provider | A fraud claim; say clearly that you were deceived into sending it |
| Gift card codes | The card's issuer or the retailer that sold it | A freeze on the remaining balance: sometimes it is unspent |
| Cryptocurrency | The exchange you sent from, if any | The receiving address flagged; transfers themselves cannot be reversed |
| Money transfer service | The service's fraud line | A hold on the transfer if it has not been collected |
Say two things on the call, in plain words: "I was defrauded" and "this payment was not authorized by me in the way you would normally understand it."
The difference between a payment you never made and one you were tricked into making affects how the claim is handled. Better you name it than let it surface later.
Do not let embarrassment shrink the story. Fraud teams hear this every day, and a partial account produces a partial investigation.
Accounts, devices, and the things behind them
Work outward from whatever the scam actually touched.
Secure accounts and devices
- Emailnew password, sign out everywhere
- Check forwarding rules and auto-delete filters
- Carrierport-out or transfer PIN
- Move off text-based codes to authenticator or passkey
- Treat device as untrusted if remote access installed
- Email first.New password, sign out everywhere, check forwarding rules, filters that auto-delete or auto-archive, connected apps, and the recovery phone and address. A rule that quietly deletes the bank's emails is a common way for the loss to keep running after you think it stopped.
- Phone number.If your number could have been ported away, or texts stopped arriving, call your mobile carrier and ask for a port-out or transfer PIN on the account. A hijacked number defeats text-based codes on everything else.
- Move off text-based codeswhere the account offers something stronger, such as an authenticator app, a passkey, or a hardware security key.
- The rest.Financial accounts, the app stores, the cloud account behind your photos and backups, and anything sharing the old password. There is a fuller sweep in account security.
- Devices.If remote access software was installed, or you ran a file they sent, treat the device as untrusted until it has been checked or reset. Change passwords from a different device, not from the one in question.
If your identity data was exposed
Card numbers are replaceable. A national ID number, a date of birth, and a scan of your passport or driving license are not: they support new accounts opened in your name months later.
If identity data was exposed
- Security freeze at Equifax, Experian, TransUnion separately
- Fraud alert is lighter, freeze is stronger
- Read credit reports for accounts you did not open
- Use tax or benefits agency identity-theft process
- Watch for unexpected mail in your name
- Place a security freeze with each of the nationwide credit bureaus. In the US that is Equifax, Experian, and TransUnion, and each has to be done separately. A freeze blocks most new credit checks in your name; you lift it temporarily when you actually need credit. Check the current terms and process on each bureau's own site.
- A fraud alert is the lighter optionit does not block anything, it flags to lenders that they should verify identity. A freeze is stronger.
- Get your credit reportsand read them for accounts you did not open. Do this again after a few months, because damage often appears late.
- If a tax or benefits number was exposed, the relevant revenue or benefits agency has its own identity-theft process. Use it: the credit bureaus do not cover that.
- Watch for mail you did not expecta card you did not apply for, a bill from a service you never used, a letter about an account in your name. That is often the first visible sign.
Where to report, and why each one is worth doing
None of these will call you back with your money. They are still worth the time, because they are what shuts down the account or number that will otherwise be used on the next person, and because some of them produce a document you will need.
Where to report and why
- Platformreport profile, listing, message or ad
- Bank or payment providerfraud claim on your money
- US FTCidentity theft report and recovery plan
- US FBI IC3internet-enabled crime, wires, crypto
- Local policeID documents, threats, credit fraud
- The platform.Report the profile, listing, message, or ad through the platform's own reporting tool, not by messaging support through a link someone sent you. This is the report most likely to have a fast, concrete effect, and where the account doing the damage is a copy of yours rather than your own, the route is in impersonation scams.
- Your bank or payment provider, as above. Their fraud claim is the one attached to your money.
- In the US, the Federal Trade Commission.The FTC takes consumer fraud reports and runs a separate identity-theft service that produces a personal recovery plan and an identity theft report: the document some creditors ask for before they will remove fraudulent accounts. Reach it by searching for the FTC's own site directly rather than through a link in any message.
- In the US, the FBI's Internet Crime Complaint Center (IC3).This is the route for internet-enabled crime, and the one worth using for larger losses and for wire and cryptocurrency transfers.
- Local police, particularly where identity documents were taken, where you were threatened, or where a creditor asks for a police report number.
- The sector regulator, where one exists for what was involved: a financial conduct authority, a telecoms regulator, a state attorney general. Outside the US, look for the national consumer protection body and the national cybercrime reporting service.
Keep every reference number in the same note as your timeline. The routing question, meaning which body handles which kind of loss, is answered plainly at USAGov's page on where to report a scam, and the identity side has its own guided process at IdentityTheft.gov.
The follow-up nobody tells you about
The first hour is loud and the next month is quiet, which is when things get missed.
- Check whether the bank's fraud claim actually opened, and what its reference is. Ask what happens next and when you should chase it.
- Re-read your credit report on a schedule rather than once, and check what is visible about you while you are at it, which is the work in privacy settings.
- Watch the email account for password reset messages you did not request, that means someone still has your address on a list and is trying.
- Expect more approaches, on other channels, most of them arriving as messages rather than as people, which is the ground covered in phishing scams. Being scammed once makes you a target for the next round, and not because of anything you did wrong.
The second scam: "recovery services"
This is the part most people are not warned about, so treat it as the main warning on this page.
After a loss, people often contact you offering to get the money back. They claim to be an investigator, lawyer, blockchain-tracing firm, regulator, or the platform's fraud department.
They may already know your name, the amount, and what happened. Victim details get resold, and you may have posted about it.
Tells of a recovery scam
- They contacted you, not the other way round
- They ask for a fee, deposit or tax upfront
- They want remote access or banking login
- They promise a percentage, timeframe or guarantee
- They press for speed and secrecy
Fraud-report agencies never charge to take reports and do not cold-call demanding payment to release your funds.
If someone claims to be from a bank or agency, hang up and call your card's number or the agency's site. Professional help exists: a lawyer you found and hired, or your bank's fraud team. You find them; they do not find you.
Helping someone else who has been scammed
If the person in front of you is a relative or a friend, the fastest route to the first hour above is not an explanation of what they did wrong.
- Lead with "we can still do things right now", not with how it happened.
- Take the practical steps for them if they will let youthe bank call, the screenshots, the password changes.
- Do not repeat the amount back to them or ask how they fell for it. Shame is the single biggest reason losses are reported late or never.
- Expect the possibility that they are not yet convinced it was a scam. In that case, the useful move is a verification they can do themselves, calling the real organization on a number they look up, rather than an argument.
What recovery honestly looks like
Some losses come back in full. Card disputes work more often than wires do. Some losses do not come back at all, and no amount of correct procedure changes that. Anyone who tells you otherwise before looking at the payment rail and the timing is guessing or selling.
What is genuinely in your control is the size of the loss from this point forward: the accounts you secure, the identity data you freeze, the reports that get filed, and the second approach you recognize and refuse. That is the work, and it is worth doing even on a day when it feels pointless.
Common questions
Should I confront the scammer or try to get my money back directly?
No. It rarely works, and it tells them to move the funds and abandon the accounts you have just reported. It can also escalate into threats. Let the bank and the platform act on the accounts while they are still live.
Is it too late if this happened weeks ago?
It is worth doing anyway. Some claims are time-sensitive and some are not, and the account-security, credit-freeze, and reporting steps have no expiry at all. Start with the payment provider and ask directly what the position is.
Do I have to report it if I only lost a small amount, or nothing?
You do not have to. It is still useful. Reports of attempts and near misses are how patterns get spotted, and the profile or number you report is often the one about to be used on someone with more to lose.
Someone says they can trace my cryptocurrency. Is that real?
Tracing as a discipline is real; the person who cold-messaged you offering it is not. Any legitimate engagement starts with you approaching a firm you found and verified, and no honest one asks for an upfront payment to release funds that are supposedly already located.
What if the scam started on a platform I want to keep using?
Report it and stay if you want to. Then tighten who can find and contact you there: the discovery and message settings in a social media privacy audit are what determine whether the next approach reaches you at all.
In this guide
- Scam Recovery Checklist: What Still Has a WindowUse this scam recovery checklist to distinguish short payment windows from evidence, reporting, and account checks that may still matter after a delay.
- Scam recovery risks and how to avoid themScam recovery risks: the second approach, the evidence tidying destroys, the decisions to delay, and the checks that follow identity exposure.
- Scam reporting and recovery tools: ranked by what they actually doScam reporting and recovery tools ranked by what each can do, from the bank call that stops money to the paid services that take a second payment.
