What to Do Immediately After Being Scammed

Steps to take after being scammed

A practical, step-by-step guide to limiting the damage, protecting your accounts and reporting the fraud.

Discovering that you may have been scammed can trigger panic, embarrassment and an urgent desire to fix everything at once. Stop for a moment and focus on the order of your actions.

Your first priorities are to prevent further loss, contact the organisation that moved the money, secure any compromised accounts and preserve the evidence. Reporting the crime comes next.

There is no guaranteed way to recover money sent to a scammer. However, acting quickly may give your bank, card issuer, payment provider or cryptocurrency platform a better opportunity to stop or trace a transaction.

What to do immediately after being scammed

What to do after being scammed

1. Stop all contact with the scammer.
2. Do not send any more money, verification codes or personal information.
3. Contact your bank or payment provider immediately.
4. Secure any accounts or devices the scammer may have accessed.
5. Keep the messages, receipts and transaction details as evidence.

Do not wait until you have completed a police report before contacting your bank. Financial institutions may need to act while a payment is still pending or before the money is moved again.

1. Stop the scam from continuing

End the call, stop replying and do not click any more links.

A scammer may claim that one final payment will release your investment, parcel, prize, refund, loan or withdrawal. They may describe it as a tax, verification payment, security deposit or administrative fee.

Do not pay it.

Do not confront the scammer or warn them that you intend to report them. Preserve the available evidence and block them after you have recorded the account, profile, telephone number or address they used.

If you are in immediate physical danger, being threatened or facing extortion, contact your local emergency services or police immediately.

2. Contact the bank or payment provider

Use the number on the back of your card, your bank’s official application or contact details obtained directly from its official website. Do not use a telephone number or link supplied by the suspected scammer.

Tell the fraud team:

• when the payment was made;
• how much was paid;
• where it was sent;
• whether the payment is still pending;
• what the scammer claimed;
• whether you disclosed card details, login credentials, a PIN or a one-time password;
• whether the scammer had remote access to your device; and
• whether further payments or debit orders may be attempted.

Ask whether the transaction can be stopped, recalled, reversed or disputed. Also ask whether your card, account or online banking access should be temporarily blocked.

Be accurate about what happened. If you personally authorised a transfer because you were deceived, explain that clearly. Do not describe it as an unauthorised transaction if you approved it yourself. Banks may follow different processes for an unauthorised transaction and an authorised payment induced by fraud.

Official consumer guidance consistently recommends contacting the organisation used to send the money immediately, even when recovery appears unlikely. The FTC provides payment-specific recovery steps, while Scamwatch advises victims to contact their bank or card provider straight away.

What to do for each payment method

Credit or debit card

Contact the card issuer immediately. Ask it to block or replace the card if its details were exposed and to investigate or dispute the payment.

Continue checking the account for small unfamiliar transactions. Criminals sometimes test stolen card details with a small charge before attempting a larger one.

Bank transfer

Call the bank’s fraud department and request an urgent recall or trace. Give the recipient’s account details, payment reference, amount, date and time.

Ask the bank to contact the receiving institution and attempt to freeze any remaining funds. A recall is not guaranteed, but delaying the request reduces the available response time.

Payment application or digital wallet

Report the transaction through the payment service’s official fraud process. If the application was connected to a card or bank account, report it to that financial institution as well.

Wire transfer

Contact the wire-transfer company immediately. Tell it that the transfer resulted from fraud and ask whether the payment can be stopped or refunded.

Gift card

Contact the gift-card issuer using the number printed on the card or its official website. Keep the card and purchase receipt. Give the issuer the card number, purchase details and any remaining balance information.

Cryptocurrency

Contact the exchange, wallet provider or cryptocurrency ATM operator used to send the funds. Provide the wallet address, transaction hash, amount, date and supporting communications.

Blockchain transactions are usually difficult or impossible to reverse, but an exchange may be able to flag an account or respond to a lawful request if the funds pass through its systems. Cryptocurrency generally does not provide the same consumer protections as card payments, according to the FTC’s recovery guidance.

Do not pay an online “crypto investigator” who promises to hack the wallet or recover the funds.

Cash or a posted parcel

Contact the delivery company immediately and ask whether the parcel can be intercepted before delivery. Then report the matter to the police.

3. Secure your email account first

Your email account can be used to reset passwords for banking, shopping, social media and cloud-storage services. If the scammer may know your email password, secure it before moving through your other accounts.

Preferably use a different, trusted device.

• Change the email password to a new, unique password.
• Sign out all other devices and active sessions.
• Check recovery email addresses and telephone numbers.
• Remove devices you do not recognise.
• Examine forwarding rules, filters and automatic replies.
• Enable two-factor authentication.
• Save new recovery codes securely.

Criminals sometimes add forwarding rules so that they silently receive password-reset or security messages. The UK National Cyber Security Centre specifically recommends checking these rules, changing reused passwords, signing out other sessions and enabling two-step verification. See the NCSC hacked-account guidance.

After securing your email, repeat the process for banking, payment, social media, shopping, cloud-storage and mobile-provider accounts.

4. If the scammer accessed your computer or phone

If remote-control software is still active, disconnect the device from the internet. Do not use that device to change important passwords until you are satisfied that the unauthorised access has been removed.

From another trusted device:

1. Contact your bank.
2. Change the password for your primary email account.
3. Change financial and other sensitive passwords.
4. Revoke unfamiliar sessions and devices.
5. Enable two-factor authentication.
6. Contact your employer’s IT or security team if a work device or account was involved.

Update the device’s operating system and security software, run a complete security scan and remove any remote-access application you were instructed to install. If you are uncertain, obtain help from the device manufacturer or a reputable local technician whose contact details you found independently. The FTC recommends updating security software, scanning the device and changing affected passwords.

For a serious business compromise, large financial loss or possible evidence of organised crime, consult your IT team or police before erasing or resetting the device.

5. Preserve the evidence

Save the information before accounts, adverts or profiles disappear.

Keep copies of:

• emails, text messages and chat histories;
• social media profiles and usernames;
• website addresses and online adverts;
• telephone numbers and email addresses;
• invoices, receipts and order confirmations;
• bank records and payment references;
• beneficiary account details;
• cryptocurrency wallet addresses and transaction hashes;
• gift cards and purchase receipts;
• voice messages and call logs;
• documents or contracts supplied by the scammer;
• dates, times and a brief timeline of events; and
• reference numbers from banks, platforms and police.

Take full-page screenshots where possible. Retain original files and messages instead of keeping only cropped images.

Do not continue engaging with the scammer merely to obtain more evidence. Your safety and the prevention of further loss come first.

6. Protect your identity

If you disclosed an identity number, passport, driver’s licence, tax number, proof of address, banking details or a selfie used for identity verification, treat the incident as possible identity theft.

Contact the organisations that issued the exposed documents. Ask what replacement, monitoring or protective measures are available in your country.

Also consider:

• notifying relevant credit bureaus;
• placing a fraud alert or credit freeze where available;
• reviewing your credit report for unfamiliar enquiries or accounts;
• checking whether new mobile contracts or financial accounts were opened;
• monitoring tax, benefits and insurance accounts; and
• keeping a record of every identity-related report.

Credit freezes and fraud alerts differ between countries. Follow the official identity-theft process for your jurisdiction rather than assuming another country’s protections apply.

7. Contact your mobile provider when necessary

Call your mobile network immediately if your phone unexpectedly loses service, your SIM stops working or you receive notices about an unfamiliar SIM or number transfer.

Ask the provider to:

• check for a SIM swap or unauthorised number transfer;
• restore control of the number;
• add an account PIN or additional security;
• revoke unauthorised SIMs; and
• preserve relevant account records.

A compromised telephone number may allow criminals to receive security codes and reset other accounts.

8. Report the scam

Report the incident after taking the urgent financial and security steps. Reporting creates an official record, helps authorities connect related cases and may provide a reference number required by a bank, insurer or other organisation.

Report it to:

• your local or national police;
• the financial institution or payment provider;
• the website, marketplace or social platform involved;
• the organisation being impersonated;
• your national fraud-reporting service; and
• the appropriate identity-theft or cybercrime service.

Europol advises victims to contact their local or national police; Europol itself does not take reports directly from members of the public. Its country reporting directory links to national police services across Europe.

A report does not guarantee that the money will be recovered or that an individual case will be investigated. It may nevertheless assist financial institutions, platforms and authorities in tracing accounts, removing fraudulent content and connecting multiple incidents.

Official reporting routes

South Africa

Contact your bank’s fraud department first. Report the crime to the South African Police Service and obtain a case number.

You can also report suspicious activity through Yima, an initiative of the Southern African Fraud Prevention Service. Its scam hotline is 083 123 7226 and can route callers to participating banks, retailers, telecommunications providers and SAPS.

If identity documents or personal information were compromised, contact SAFPS about Victim of Impersonation assistance or free Protective Registration.

United States

Report fraud at ReportFraud.ftc.gov. For identity theft, use IdentityTheft.gov to obtain a recovery plan. Internet-enabled crimes can also be reported to the FBI’s Internet Crime Complaint Center.

United Kingdom

People in England, Wales and Northern Ireland can report through Report Fraud. In Scotland, report the matter to Police Scotland by calling 101. Call emergency services if a crime is occurring or someone is in danger.

Canada

Report fraud or cybercrime through the Canadian Anti-Fraud Centre. Its guidance also recommends contacting the transferring financial institution, local police and both credit bureaus when identity fraud is involved.

Australia

Report the incident to Scamwatch. Scamwatch reports are not police reports, so victims who lost money to cybercrime should also use the official police reporting route. Identity and cyber support is available from IDCARE.

European Union

Report the matter to your country’s local or national police. Use Europol’s reporting directory to locate the appropriate national service.

9. Report the account, advert or profile

Report the fraudulent content to the platform on which it appeared. Include the profile address, advert identifier, payment details and police reference number if available.

Reporting may help the platform remove the content or preserve account information. Before blocking the scammer, record enough information to identify the account.

Also notify the genuine organisation if its brand, employee or website was impersonated. Use independently verified contact details.

10. Expect a second scam

Recent victims are frequently targeted again.

A new caller may claim to be:

• a police officer;
• a bank investigator;
• a government official;
• a lawyer;
• a cryptocurrency tracing specialist;
• a consumer-protection organisation; or
• an agent who has “found” your stolen money.

They may already know your name, the amount lost and details of the original scam. That information does not prove that they are legitimate.

Do not pay an upfront recovery, tax, legal, tracing or release fee. Do not disclose banking credentials, one-time passwords, cryptocurrency seed phrases or identity documents to an unsolicited recovery service.

The FTC warns that fraudsters buy and exchange information about previous victims and then offer fictitious recovery services. Legitimate authorities do not require an advance payment to release recovered money. Read the FTC warning about refund and recovery scams.

11. Monitor what happens next

For the following weeks and months:

• review bank and card transactions regularly;
• enable transaction and login alerts;
• inspect credit reports where available;
• challenge unfamiliar accounts or applications;
• retain correspondence with banks and investigators;
• record every case and complaint number;
• meet any dispute or insurance deadlines;
• update authorities when new information appears; and
• warn contacts if your email or social account was compromised.

If the scam involved a business account, payroll, supplier payment or customer information, notify the organisation’s management, bank, insurer, legal adviser and cybersecurity team promptly. Data-protection reporting obligations may apply.

Do not blame yourself

Modern scams are designed to create trust, fear, urgency or emotional dependence. They may combine stolen personal information, professional websites, spoofed telephone numbers, impersonated employees and long periods of careful grooming.

Being deceived does not make you foolish. It means someone deliberately manipulated the information and circumstances presented to you.

Tell a trusted person what happened. A second person can help you make calls, record reference numbers and recognise follow-up manipulation while you are under stress.

A final checklist

Before considering the immediate response complete, confirm that you have:

• stopped all communication and payments;
• contacted the bank or payment provider;
• blocked or replaced exposed cards;
• secured your email and important accounts;
• checked forwarding rules and active sessions;
• enabled two-factor authentication;
• dealt with any remote-access software;
• preserved transaction and communication evidence;
• reported the account to the relevant platform;
• filed the appropriate fraud or police report;
• taken identity-protection measures where necessary; and
• warned yourself and your family about recovery scams.

The outcome cannot be guaranteed, but prompt, organised action can limit further damage and give the responsible organisations the clearest possible opportunity to respond.

Once you have taken the urgent steps above, request an AdUncovered report to organise the offer, seller claims and relevant public information into a source-linked record for your assessment and any complaint you choose to make.