If you’ve just realized you were scammed, speed and clarity are your best friends. Within minutes, you can lock down accounts, preserve evidence, and start reporting fraud to the FBI and other authorities that can actually help. This guide walks you through exactly what to do, step by step, so you don’t lose more money, miss critical deadlines, or fall for “recovery” scams that prey on victims twice.
First 10 Minutes: Secure Accounts And Preserve Evidence
Disconnect, Lock Down, And Change Passwords
If you clicked a link, downloaded a file, or gave remote access, disconnect from Wi‑Fi immediately. Turn off the device or switch to airplane mode to stop any active session. Then, on a clean device you trust, start changing passwords for your email, bank, social media, cloud storage, and any account tied to payments. Prioritize the email account that resets all your other accounts.
Use unique, long passphrases (think 16+ characters) and a password manager. If the scam involved your work account, notify your IT/security team right away so they can contain it.
Enable MFA And Revoke Suspicious Sessions
Turn on multi‑factor authentication (MFA) everywhere, preferably using an authenticator app or a hardware key. Avoid SMS codes when possible (they’re better than nothing, but still phishable). In your account security settings, sign out of all sessions and revoke app tokens you don’t recognize, especially for email, cloud storage, and crypto exchanges. On Google: Security > Your devices > Sign out of unfamiliar devices. On Microsoft/Apple: similar device/session management pages exist.
Preserve Evidence: Screenshots, Headers, Wallet Addresses
Document everything before it disappears. Take screenshots of messages, profiles, URLs, caller IDs, payment confirmations, and the scammer’s instructions. Save email headers (Gmail: “Show original”: Outlook: “View message source”) and export chats. For crypto, capture wallet addresses and transaction hashes. Keep bank statements, transaction IDs, and any refund attempts. Store files with clear names and timestamps so you can share them with investigators or your bank.
Do Not Pay Or Engage Further
Don’t send more money, gift cards, or crypto. Don’t install new software “to get a refund.” Stop replying, scammers escalate pressure and pass your info to others. If you’re being threatened, call your local police (non‑emergency line or 911 if there’s immediate danger).
Report To The Right Agencies (U.S.)
FBI Internet Crime Complaint Center (IC3)
File a complaint at ic3.gov as soon as you stabilize your accounts. Include amounts, dates, account numbers, wallet addresses, phone numbers, domains, and screenshots. For wire transfers and Business Email Compromise (BEC), speed matters, within 24–72 hours banks may still be able to recall or freeze funds. IC3 may coordinate with the FBI’s Recovery Asset Team when fast action is possible.
Federal Trade Commission: ReportFraud.gov And IdentityTheft.gov
Report scams and deceptive practices at ReportFraud.gov: the FTC aggregates data to spot patterns and support enforcement. If your identity was misused (new accounts, loans, benefits filed in your name), go to IdentityTheft.gov to generate a recovery plan and an Identity Theft Report you can use with creditors and police.
Local Police And State Attorney General
File a police report if requested by your bank/insurer or if there’s a threat, in‑person contact, or significant loss. Bring your evidence packet. Also report to your state Attorney General’s office: many AGs have consumer protection divisions that can mediate complaints and track serial offenders.
U.S. Postal Inspection Service (Mail Fraud)
If the scam used the mail or you sent cash, gift cards, or money orders through USPS, report at USPIS.gov/report. Ask your local post office about intercept options if a parcel hasn’t been delivered yet.
SEC And CFTC For Investment And Trading Scams
For securities, broker, and platform fraud (stocks, options, “guaranteed returns,” social trading), tip the SEC at sec.gov/tcr. For commodities, forex, or crypto derivatives schemes, report to the CFTC at cftc.gov/complaint or whistleblower.gov. If a registered broker/dealer or adviser is involved, add a complaint via FINRA (finra.org/investors/have-problem).
- Quick reference: FBI IC3 (ic3.gov), FTC (ReportFraud.gov / IdentityTheft.gov), USPIS (USPIS.gov/report), SEC (sec.gov/tcr), CFTC (cftc.gov/complaint), State AG (search “YourState AG consumer complaint”).
Strengthen Financial And Credit Protections
Place Fraud Alerts Or Credit Freezes With Equifax, Experian, TransUnion
If your identity was exposed or you’re unsure, place a free fraud alert with any one bureau (Equifax, Experian, or TransUnion), they must notify the others. An initial alert lasts one year: extended alerts (for confirmed ID theft) last seven years. For stronger protection, place a free credit freeze at all three bureaus: you can lift it temporarily when applying for credit. You can also freeze ChexSystems to block new bank accounts in your name.
Dispute Charges, Stop Payments, And Attempt Recalls
Contact your bank or card issuer immediately. For debit/ACH/Zelle transfers that were unauthorized, you may have protections under Regulation E, report quickly and in writing. For wires, ask your bank to initiate a SWIFT/Fedwire recall and law enforcement hold: success is highest within 24–72 hours. For credit cards, dispute the charge: cards typically offer strong chargeback rights for fraud. If you mailed cash or money orders, ask USPS about intercepts. Keep detailed notes of dates, reps, and case numbers.
Report And Lock Payment Apps, Bank, Card, And Crypto Accounts
Use your bank and card apps to lock cards (temporary freeze) and disable new payees until you’re in the clear. In Zelle/Venmo/Cash App, report the transaction to support and your bank: outcomes vary by platform, but early reports help. For crypto, immediately contact the exchange with the transaction hash and file a support ticket: they can sometimes freeze funds hitting their platform.
Monitor Credit, Replace IDs, And Freeze ChexSystems
Check your reports at AnnualCreditReport.com, free weekly reports from Equifax, Experian, and TransUnion are now permanent. Look for new accounts, inquiries, or addresses you don’t recognize. Replace compromised IDs (driver’s license at your DMV: Social Security card only if necessary). If your SSN is involved, consider an IRS Identity Protection PIN to block fraudulent tax filings.
What To Expect After You Report
Get And Save Case Numbers And Documentation
Each report, IC3, FTC, police, bank dispute, should generate a reference or case number. Save these in a single document along with timelines, contacts, and copies of your evidence. You’ll need them for follow‑ups and any insurance or reimbursement process.
Timelines, Investigations, And Recovery Odds
Authorities triage based on dollar amounts, patterns, and cross‑case links. You might not get a personal reply from the FBI or FTC, but your data still matters. Banks and card issuers typically provide provisional credits while they investigate: crypto platforms may only act if funds hit custodial wallets they control. Realistically, recovery odds drop fast after the first 72 hours, but early, precise reporting can make the difference, especially with wires and BEC.
Cooperate Safely And Avoid “Recovery” Scams
If investigators or your bank contact you, verify identities before sharing information. Call back using official numbers you look up yourself. Never pay “processing” or “tax” fees to recover funds, legitimate agencies don’t charge you. Be skeptical of anyone claiming they can instantly “unblock” or “trace” crypto for a fee. Sadly, recovery scams target victims frequently after the first incident.
Special Situations And Where To Report
Identity Theft: Social Security, Tax, And Unemployment Fraud
If someone used your SSN, file at IdentityTheft.gov to create an official recovery plan and pre‑filled affidavits. For tax fraud, submit IRS Form 14039 and consider getting an IRS IP PIN (irs.gov/ippin) to lock future filings. For unemployment fraud, report to your state workforce agency and notify your employer’s HR. Monitor your SSA “my Social Security” account and secure it with strong MFA.
Business Email Compromise And Wire Transfer Fraud
For invoices or payroll changes sent from spoofed or compromised email, notify your bank immediately and your company’s security team. Ask for a wire recall and law enforcement hold, then file at ic3.gov and inform all parties in the payment chain. Time is brutal here, the first 24 hours offer the best chance for clawback. Check email rules/forwarders and reset credentials company‑wide with MFA enforced.
Investment And Crypto Scams
If you were lured by “guaranteed returns,” fake trading dashboards, or impostor “brokers,” gather wallet addresses, TXIDs, platform URLs, and chats. Report to IC3, the FTC, and the SEC or CFTC depending on the product. If funds touched a known exchange, open a ticket immediately with their fraud team. Don’t send “unlock” or “withdrawal” fees, those are hallmark tactics of advance‑fee fraud.
Elder Abuse And Caregiver-Related Fraud
If a senior is targeted, contact Adult Protective Services via eldercare.acl.gov and their bank’s fraud department. Ask the bank to add extra authentication or view‑only status where appropriate. Report to local police, state AG, and IC3. Document caregiver access and consider legal advice to protect finances (power of attorney updates, account monitoring).
Prevent Future Scams
Verify Before You Pay Or Share
Trust the channel you can verify, not the one that reached out to you. Independently look up phone numbers and URLs, don’t use links in messages. For large payments, use a known contact method and confirm banking details with a “call‑back” to a number on file.
Use Multi-Factor Authentication And Password Hygiene
Keep MFA on for email, banks, cloud, and social media. Rotate passwords after incidents and avoid reusing them across sites. A password manager reduces friction and mistakes.
Device And Network Security Basics
Update your OS, browser, and apps. Turn on automatic updates, run reputable endpoint protection, and consider a separate device profile for financial tasks. Be skeptical of pop‑ups claiming “viruses”, close the browser, don’t call the number.
Build A Personal Incident Response Plan
Write down the steps you’ll take if something feels off: how to disconnect, where to find account security pages, and who to call at your bank. Keep a short list of reporting portals handy so you can move fast.
- Keep this mini‑checklist accessible: freeze cards, change email password first, enable MFA, capture evidence, contact bank, file IC3/FTC, and set credit freeze if needed.
Frequently Asked Questions
What should I do in the first 10 minutes after being scammed?
Disconnect from Wi‑Fi or switch to airplane mode, then use a trusted device to change passwords for email, bank, and key accounts. Enable MFA, sign out of all sessions, and revoke suspicious app tokens. Capture evidence: screenshots, email headers, wallet addresses, and transaction IDs before anything is deleted.
How do I report fraud to the FBI through IC3, and what details should I include?
Go to ic3.gov and submit a complaint promptly. Include dates, amounts, account numbers, wallet addresses, domains, phone numbers, and screenshots. For wires or Business Email Compromise, file within 24–72 hours so the FBI’s Recovery Asset Team may coordinate fund recalls if money is still in transit.
Can banks reverse wire, ACH, Zelle, or card payments after a scam?
Act immediately. Ask your bank for a SWIFT/Fedwire recall and a law‑enforcement hold for wires—success is highest within 24–72 hours. For unauthorized debit/ACH/Zelle, report quickly under Regulation E. For credit cards, file a dispute; cards generally offer strong chargeback rights. Document dates, reps, and case numbers.
What’s the difference between ReportFraud.gov and IdentityTheft.gov at the FTC?
Use ReportFraud.gov to report scams and deceptive practices so the FTC can track patterns and support enforcement. Use IdentityTheft.gov if your identity was misused; it generates a personalized recovery plan and an official Identity Theft Report you can share with creditors, police, and agencies to help restore your accounts.
Should I file a police report, and will it help me get money back?
File a local police report if your bank or insurer requests it, there’s in‑person contact, threats, or significant loss. Bring your evidence packet. A report creates a record and aids disputes, but recovery often depends on speed (first 24–72 hours), bank processes, and whether funds can still be intercepted.
Can I report fraud to the FBI if the scammer is overseas, and does it cost anything?
Yes. You can report fraud to the FBI via IC3 even if the scammer is abroad; IC3 shares data with domestic and international partners. Filing is free and does not affect your credit score. Consider credit freezes separately—they’re free and protect you but don’t harm your credit rating.
No responses yet