This article is for general information only and is not financial advice. For decisions that affect your money, speak with a qualified financial professional.
Call your bank or payment provider immediately and say the words "I am reporting a fraudulent payment" — speed matters more than anything else you do today. Then stop all contact with the scammer, change your passwords from a different device if they had any access, and report it to your national fraud reporting body. Card payments and bank transfers are sometimes recoverable in the first hours; gift cards and crypto almost never are, but reporting them still matters.
If you are reading this because it just happened: stop reading in a moment and call your bank. The single most useful thing you can do today is make that call as early as possible. Everything else on this page will still be here in ten minutes.
And before anything else — this was not your fault. Modern scams are run by organised, well-funded operations that rehearse their scripts, clone real voices with AI, copy real bank websites down to the fonts, and deliberately create the kind of time pressure that switches off careful thinking. They fool lawyers, accountants and IT professionals every week. Shame is the tool that keeps victims quiet and slow, and slow is exactly what the scammer needs from you now.
The first 30 minutes
Call your bank or payment provider — right now
Use the number printed on the back of your card or in your banking app, never a number the scammer gave you. Most banks have a 24-hour fraud line.
Say this clearly at the start: "I am reporting a fraudulent payment. I need it stopped and my account secured." That phrasing routes you to the fraud team instead of general customer service, and it starts a formal case rather than a query.
Have ready: the amount, the date and time, the account or card used, and where the money went if you know. Ask for a case or reference number before you hang up, and write it down. You will need it every time you call back.
Ask three specific questions before ending the call
Fraud calls go better when you ask rather than wait:
- "Can this payment be recalled or stopped?" — for a transfer, ask them to contact the receiving bank immediately. For a card payment, ask whether it is still pending, because a pending payment is far easier to kill than a settled one.
- "Should my card or account be frozen?" — if the scammer has your card details or logged into your account, yes.
- "What do I need to send you, and by when?" — many banks require a written fraud claim within a set number of days. Missing that deadline can end the claim on a technicality.
Cut contact — but do not delete anything
Stop replying. Do not answer their calls, do not explain, do not tell them you have called the bank. If they know you are onto them, they move the money faster.
But keep every message, email, transaction receipt and phone number. Screenshot the chat, the payment confirmation, the profile, the website address. Do not delete the app or block the number until you have copies — that evidence is what your bank and the police will ask for, and it is the part victims most often destroy in the first wave of anger.
Write down what happened, while it is fresh
Open a note or a sheet of paper and write a plain timeline: when they first contacted you, what they claimed, what you sent, when, and how. Include the exact wording they used if you remember it.
You will repeat this story to the bank, the police and possibly an ombudsman, and the details fade fast. A written timeline also helps you see the whole shape of it — which is often the moment people realise there was more than one payment.
Do not send one more penny — to anyone
This is the rule that saves the most money after the first loss. If anyone asks you to pay a fee to release, unlock, verify, tax or recover your funds, that is the scam continuing. Real institutions deduct fees from money they hold; they never ask you to send fresh money from outside to free money you supposedly already have.
The same goes for anyone who contacts you afterwards offering to get your money back — there is a section on that second wave further down this page.
Tell one other person today
A partner, an adult child, a friend, a neighbour. Not because you need permission — because isolation is part of how the scam worked, and because a second head catches things you will miss while your hands are still shaking. Ask them to sit with you for the phone calls if you can.
What is actually recoverable, by payment method
This is the honest version. Some of these are worth fighting for; some are not coming back, and knowing which is which stops you wasting the hours that matter.
| How you paid | Realistic chance | What to do first |
|---|---|---|
| Credit card | Good | Dispute with the card issuer — chargeback rights are strongest here |
| Debit card | Fair to good | Report as fraud immediately; time limits are shorter than credit |
| Bank transfer | Depends on speed | Ask your bank to recall it and to contact the receiving bank |
| Instant payment app | Low, but act anyway | Report inside the app and to your bank; ask them to freeze the recipient |
| Gift cards | Very low | Call the card issuer with the numbers; report to your fraud body |
| Cryptocurrency | Effectively nil | Report anyway; note the wallet address and transaction ID |
| Cash by courier or post | Effectively nil | Call the police — this often means a local person collected it |
Card payments. A card gives you the most protection of any method. If you paid by credit card, the issuer can usually reverse the payment through the card scheme's chargeback process, and in most countries you are not liable for fraudulent card use beyond a small capped amount. In the EU, if someone used your card without your permission, you can be asked to bear a maximum of 50 euros — and nothing at all if you could not have known, such as after a data breach or a cloned card. Debit cards carry similar protection but the money has already left your account, so the wait is real. Ask the issuer explicitly whether they are treating it as a fraudulent transaction or a dispute with a merchant — the two go down different paths.
Bank transfers. A transfer you authorised yourself is legally different from a payment someone made without you, and this is where most people are surprised. The 50-euro cap above applies to unauthorised transactions. When you were tricked into pressing "send" yourself — the category the industry calls authorised push payment fraud — the outcome depends on your country. The UK now requires banks to reimburse most victims of these scams up to £85,000, for payments made from 7 October 2024 onward, with claims accepted for 13 months and reimbursement normally within five working days. Elsewhere it is assessed case by case, and your bank's decision can usually be escalated to a financial ombudsman if you disagree. Either way: ask in writing, keep the answer in writing.
Speed is the variable you control. Money sent by transfer sits in a "mule" account before being moved onward, often within an hour or two. If your bank reaches the receiving bank while it is still there, it can be frozen. That window is measured in hours, which is why step one is a phone call and not an email.
Gift cards. Call the company that issued the card — not the shop that sold it — and read them the card number and the receipt. If the balance has not been spent yet, some issuers can freeze it. Keep the physical card and the receipt either way; both the issuer and investigators will ask.
Cryptocurrency. Transfers are final and pseudonymous, and there is no bank to call. Do not spend money on "blockchain recovery" services; they are overwhelmingly fraudulent. Do record the wallet address, the transaction hash and the exchange you used, and report it — exchanges occasionally freeze funds when a law-enforcement request arrives fast enough, and your transaction data is genuinely useful to investigators tracing a network.
If they got into your device or your accounts
Money is only half of it. If the scammer talked you through installing something, asked you to read out a code, or "helped" you from their end, treat every account on that device as compromised.
Disconnect the device from the internet
Turn off Wi-Fi or unplug the cable. This ends any live remote session immediately. Do not shut the computer down if you can avoid it — a technician may want to see what is running.
Change your email password first, from a different device
Use your phone if the compromise was on the computer, or someone else's computer if it was your phone. Email first, always — whoever controls your email can reset the password on everything else, so it is the master key.
Then, in order: online banking, then any account holding money or payment details, then everything sharing that old password.
Check what they changed, not just what they saw
Attackers leave doors open behind them. In your email settings, look for:
- Forwarding rules silently copying your mail to an unknown address
- A changed recovery email or phone number
- Unfamiliar devices in the "where you are signed in" or "security activity" list — sign them all out
- New app passwords or connected apps you do not recognise
Do the same in your banking app: check saved payees, changed contact details, and any new payment limits.
Remove remote-access software
If they asked you to install anything to "fix" your computer or "verify" your account — names like AnyDesk, TeamViewer, UltraViewer and QuickSupport come up constantly — uninstall it. If you are not confident doing that, take the machine to a repair shop and tell them plainly what happened. Do not use that computer for banking until it has been checked.
Turn on two-factor authentication where it was not on
Once passwords are changed, add a second step to email and banking. An authenticator app is stronger than SMS, but SMS is far better than nothing. If you already had it on and they got in anyway, they talked you into reading out the code — that is the most common route, and knowing it is what stops it happening twice.
What will not come back — and why to report it anyway
Being honest about this is more useful than false hope. Cash handed to a courier, gift card codes read out over the phone, and cryptocurrency sent to a wallet are, in the overwhelming majority of cases, permanently gone. Money wired abroad and moved on within hours usually is too.
Report it regardless, for reasons that are not about your refund:
- Your report is a data point in someone else's case. Fraud networks reuse accounts, phone numbers, wallets and scripts. A single report looks like bad luck; four hundred reports naming the same account is what gets it frozen and its owner traced.
- It creates an official record. You may need a police reference number for an insurance claim, a tax question, a dispute with your bank, or an ombudsman complaint months from now. Getting it later is much harder.
- It protects the next person. Warnings issued by fraud bodies come from reported cases. The scam that caught you is being run on someone else this afternoon.
- Recovery does happen — occasionally. Frozen mule accounts, exchange holds and seized funds do sometimes return money to victims, sometimes a year or more later. That can only reach people who are in the file.
The second wave: people who target victims
Expect to be approached again. Lists of scam victims are traded between criminal groups, and a person who has already lost money to one scheme is a proven target for the next. The follow-up usually arrives within weeks and takes one of these shapes:
- A "fund recovery agency" or "asset recovery lawyer" who already knows what happened to you and asks for an upfront fee, a "court filing cost" or a "tax payment" to release your money
- A "law enforcement officer" from a body you have never heard of, telling you your money has been located and needs a fee to be repatriated
- A "bank fraud department" calling to "reverse the transaction", who needs your codes to do it
The rule is simple and has no exceptions: nobody legitimate contacts you first and asks for money to give you money back. Real police, real regulators and real banks do not charge to investigate. If they found you, they bought your details.
Where to report it
Report to your bank and to your national reporting body — they do different jobs. The bank chases the money; the reporting body builds the case and the statistics.
United States
- Report fraud to the FTC — the national consumer fraud database
- FBI Internet Crime Complaint Center (IC3) — report here fast for wire transfers. Its Recovery Asset Team can attempt to freeze a wire before it is withdrawn, though that process is aimed at larger transfers reported within roughly 72 hours — report anyway if yours is smaller or older, because the case still counts
- IdentityTheft.gov — if they got your personal details, this generates a recovery plan
- Where to report scams, by type — USA.gov's directory for anything not covered above
United Kingdom
- Report to your bank first — under the APP fraud reimbursement protections, most victims of transfer scams must be reimbursed up to £85,000
- Report Fraud — the national reporting centre for England, Wales and Northern Ireland, reachable online any time or on 0300 123 2040 (this is the service that used to be called Action Fraud); in Scotland, report to Police Scotland on 101
Canada
- Canadian Anti-Fraud Centre — plus a report to your local police service
Australia
- Scamwatch — report a scam — run by the National Anti-Scam Centre
Ireland
- An Garda Síochána — fraud — report at your local Garda station
- FraudSMART — the banking industry's fraud awareness resource
Elsewhere in Europe
- Report cybercrime online — Europol's directory of national reporting points for every EU member state
- Your rights on payments and transfers — what EU law entitles you to when a payment was not authorised by you
The week after
The first day is about the money. The week after is about making sure it is finished.
Watch your statements closely for a month. Card details and account numbers get reused and resold. Check every line, including small amounts — testing a stolen card with a tiny charge before a large one is standard practice.
Follow up your claim in writing. A week after your call, email the bank asking for the status of case number X. Verbal fraud reports get lost; emailed ones create a paper trail, and a paper trail is what an ombudsman will ask for.
Consider a credit freeze or fraud alert if your identity documents or personal details were exposed, not just your money. In the US that is done free with the three credit bureaus; in most of Europe your bank or national credit register can flag the account.
Change the story you tell yourself. People who have been scammed often withdraw from technology entirely — no more online banking, no more email, no more answering the phone. That reaction is understandable and it makes life smaller without making it safer. The better response is a small set of rules that do not depend on your judgement in the moment: a family safe word that anyone claiming an emergency must give, a habit of hanging up and calling back on a number you look up yourself, and a standing agreement with one family member that no money moves without a second opinion. Those rules fit on a printable card meant to sit by the phone — free to print, copy and hand out.
What to try next
If the contact came by phone and the voice sounded like someone you know, read how to detect an AI voice on a phone call — the tells are subtle but learnable. If it started as a message or email, how to spot AI phishing emails covers what the written signals look like now that the grammar mistakes are gone. And if the scam involved an "investment platform" with a dashboard showing your growing balance, how the fake AI trading platform scam works explains each stage and where the exit doors are.
Sources
- What To Do if You Were Scammed — Federal Trade Commission
- Gift Card Scams — Federal Trade Commission
- APP fraud reimbursement protections — Payment Systems Regulator (UK)
- Payments, transfers and cheques — your rights — Your Europe, European Commission
- Payment services — European Commission
- Report cybercrime online — Europol
