You've been scammed: the first 24 hours

First, the thing nobody says clearly enough

This was not stupidity. Fraud operations are organised, funded, rehearsed and run by people who do this professionally, full time, against thousands of targets. They defeat accountants, lawyers, engineers, police officers and people who work in banking. The techniques are designed specifically to bypass careful thinking by creating urgency, authority and isolation.

The shame is the reason most fraud goes unreported, and the delay that shame causes is often what makes the money unrecoverable. So set it aside for the next few hours and work through the list. You can process the rest afterwards.

Hour one: stop the bleeding

1. Send nothing more. Not a final payment, not a fee to release funds, not anything to anyone offering to recover your money. Every further payment is part of the same scam.
2. Call your bank now. This is the single most time-sensitive action and it outranks everything else on this page. Ask specifically for the fraud team. Recent bank transfers can sometimes be recalled if the funds have not yet been moved on, and card payments can usually be disputed. Hours genuinely matter here.
3. Freeze or cancel affected cards. Most banking apps do this instantly, which is faster than waiting on hold.
4. If you gave remote access to your computer, disconnect it from the internet immediately and do not use it for anything else until it has been checked or reinstalled.
5. If you gave a password, change it now on a different device — and change it everywhere else you used it.

Hour two: secure what is still yours

1. Your email first. New unique password, two-factor authentication turned on, and check for forwarding rules, filters and recovery addresses you did not create. Attackers add these so they keep receiving your reset codes after you lock them out. Our email security guide covers exactly what to look for.
2. Sign out of all sessions on your major accounts. Stolen session cookies allow access without a password.
3. Then banking, then anything with a saved card, then social media, which gets used to defraud your friends in your name.
4. Check for new payees, standing orders, or direct debits in your banking app that you did not set up.
5. If your phone lost signal at any point, call your mobile provider — that can indicate a SIM swap in progress.

Hour three: preserve the evidence

Do this before you block anyone or delete anything. It feels satisfying to block and delete, and it destroys what investigators need.

• Screenshot all messages, profiles, and the website you used.
• Record the phone numbers, email addresses, web addresses, social media handles and account names involved.
• Save payment confirmations: dates, times, amounts, reference numbers, receiving account details, and any cryptocurrency wallet addresses.
• Note any names, company names, licence numbers or case references they gave, even though they are almost certainly false. Reused fake identities link cases together.
• Write down the sequence of events while it is fresh, with times. You will be asked for this more than once.

Hour four: report it

Report to the fraud agency for your country — our reporting page lists the right one and what to include. Report to the platform where it happened as well, since that is what gets accounts and listings removed. If identity documents were involved, contact the credit agencies in your country about a fraud alert or credit freeze.

Report even if the amount was small and even if you expect nothing to come of it. Individual reports look insignificant; the aggregate is what identifies a network, gets a site taken down, or gets an account frozen. Your report may be the one that connects two investigations.

What is realistically recoverable

Card payments — often recoverable. Card schemes have dispute and chargeback processes with time limits, so report promptly and be persistent.

Bank transfers — sometimes, if you act within hours and the funds have not been moved onward. Many countries also have reimbursement rules for certain kinds of authorised push payment fraud; ask your bank specifically what applies to your case rather than accepting a general refusal.

Gift cards — occasionally. Call the card issuer immediately with the card numbers and receipts. If the balance has not been drained, it can sometimes be frozen.

Cryptocurrency — realistically, no. Report it anyway, because wallet addresses are traceable and clusters of reports do lead to exchange accounts being frozen.

Cash sent by courier or collected in person — no. Report to police, as this method often indicates a local operation that can be investigated.

The next few days

• Watch every account closely. Turn on transaction alerts so anything unexpected surfaces immediately.
• Expect a second approach. Victim lists are traded. Anyone contacting you offering to recover your money for a fee is the same network coming back for whatever is left. No legitimate recovery service asks for payment upfront, and no real investigator contacts you out of the blue.
• If your computer was accessed remotely, have it professionally checked or reinstall the operating system. A scan alone is not conclusive, because remote access tools are often removed after use.
• If identity documents were taken, monitor your credit report for several months and consider a freeze, which prevents new accounts being opened in your name.
• Tell someone. One person you trust, at minimum. Isolation is what fraud depends on, and it does not stop being harmful after the money has gone.

The part that lasts longer than the money

Most people find the financial loss is not the hardest part. It is the feeling of having been read accurately and used — of having trusted something that was constructed specifically to be trusted. That reaction is normal, it is common among fraud victims, and it is not a sign of weakness.

Talk about it rather than hiding it. Telling other people also does something practical: the person you tell is less likely to be caught by the same approach, because they will have heard it described by someone they believe. That is worth more than any warning poster.

Preventing the next one

When the immediate work is done, the two highest-value changes are two-factor authentication on your email and an agreed family check word for verifying urgent requests. Beyond that, the rule that covers nearly everything is to verify through a channel you chose yourself — hang up and dial the number on your card, open the app rather than the link, call the person back on the number already in your phone.