I've been scammed. What do I do right now?

Right now: the first hour

1. 1.

   STOP all communication with the scammer — do not respond, do not click anything else, do not send more money under any circumstances.

2. 2.

   Call your bank or payment provider immediately — tell them you've been a victim of fraud. Request a recall or chargeback. Time matters enormously here — banks can sometimes intercept wire transfers within 24-48 hours.

3. 3.

   Document everything — screenshot all conversations, emails, transaction records, and the scammer's profile/contact information before they delete it. Save URLs, phone numbers, and usernames.

4. 4.

   Change your passwords — if you shared any credentials, change them immediately from a different device. Start with email and banking.

5. 5.

   Do NOT pay any "recovery fees" — scammers often circle back posing as recovery agents, lawyers, or government officials. Legitimate recovery never requires upfront payment. Ever.

Within 24 hours: report everywhere

Reporting creates a paper trail essential for potential recovery and protects future victims. Our full reporting directory explains exactly who to contact and what each agency does — here are the essentials:

• ▸

  Your bank — file a formal fraud dispute in writing, not just a phone call. Request a reference number.

• ▸

  FBI IC3 (ic3.gov) — for US victims of any internet crime. This feeds into federal databases that track scam networks.

• ▸

  FTC (reportfraud.ftc.gov) — creates a record that helps law enforcement identify patterns across thousands of reports.

• ▸

  Report Fraud (UK) — reportfraud.police.uk for all UK fraud and cybercrime (replaced Action Fraud).

• ▸

  Scamwatch (Australia) — scamwatch.gov.au for all Australian scam reports.

• ▸

  Canadian Anti-Fraud Centre — for Canadian victims of all fraud types.

• ▸

  Local police — file a police report. You'll need the report number for insurance claims and credit disputes.

• ▸

  The platform where the scam occurred — dating app, social media, marketplace. Report the scammer's profile so they can be removed.

If the money left via Zelle and your bank's first answer is "you authorised it," that is not the end of the conversation — Regulation E still covers imposter-account scams in many cases. We walk through exactly how to push that dispute (and when to escalate to the CFPB) in When the bank says no on a Zelle scam refund.

Beware recovery scams

This is critical and most guides don't mention it: after being scammed, you are now a known target. Your information may be on "sucker lists" sold between criminal groups. Watch for:

• ▸

  "Recovery agents" — who contact you claiming they can get your money back — for a fee. Legitimate recovery never charges upfront.

• ▸

  Fake law firms — that "specialize" in fraud recovery. Verify any firm through your state bar association before paying anything.

• ▸

  Government imposters — claiming to process your refund — governments don't cold-call to return money.

• ▸

  Cryptocurrency "recovery services" — crypto recovery is extremely difficult and most services claiming to do it are scams themselves.

The rule: if someone contacts YOU offering to help recover scam losses, it's almost certainly another scam.

One sentence that ends the conversation

Everything above tells you what a recovery scam looks like. This is how you settle it in a single message, without needing to judge how professional anyone sounds. And you will need it, because the people who contact you after a loss are, by then, well practised at sounding like the help you were hoping for.

A genuine operation working on contingency can accept that, because it is how contingency already works. A recovery fraud cannot, and the reason is arithmetic rather than preference: there is nothing to recover, so a fee taken afterwards is a fee that never arrives. The upfront payment is not their pricing model. It is the entire product. That is why the objections come quickly and sound reasonable, and why they always resolve to the same request: a retainer, a filing fee, a court cost, a tax, a currency conversion, a wallet-unlocking charge, a small good-faith payment to open the case.

The second test costs even less. Ask for the firm name, the registration or bar number, and the regulator they answer to. Then look that number up yourself, on the regulator’s own website, rather than on a link they send you. A real firm expects this and it takes a minute. A fraud will supply a number that does not resolve, or a very convincing website that is theirs, or an explanation of why the check is unnecessary. Any of the three is your answer.

It also settles the callers who claim to be official. No police force, no financial regulator and no government agency charges you a fee to return your own money, and none of them cold-call to announce a refund. If you are unsure, hang up and contact that agency on a number you looked up. The genuine ones will not mind at all.

This is the second approach, and expecting it is the defence. Being targeted again is not bad luck and it is not a sign you are gullible: your details were sold precisely because you already paid once, which is a business model rather than a judgement on you. We set out how those lists are built and traded in the sucker list. Nobody legitimate needs your money before they have got you any.