What to Do If You Fall for an Online Scam

First, a reassurance

If you have just realized you were tricked, you are probably feeling a mix of panic, embarrassment and anger. That is normal. Scams are built by people who do this repeatedly, and they catch careful, intelligent people every day. What matters now is acting quickly and calmly. Many outcomes depend on how soon the right people hear about it.

The steps below are general. The right actions depend on what you lost (money, passwords, personal details, device access) and on where you live, so treat this as a framework, and rely on your bank and local authorities for specifics. Nothing here can promise that money will be recovered.

Step 1: Stop contact and stop paying

Do not reply to the scammer, and do not send anything more, even if they threaten you or promise to fix the problem for a fee. Do not click further links. If you are on a call, hang up. If someone has remote access to your device, disconnect the device from the internet (turn off Wi-Fi or unplug the cable).

Do not delete the messages yet. They are evidence.

Step 2: If money was sent, contact your bank or provider

Call the number on your card or your bank’s official website, not one supplied by the scammer. Explain what happened as clearly as you can.

• Ask whether the payment can be stopped, recalled or disputed. This is most likely when you act within hours, and outcomes are uncertain. Card payments sometimes offer a dispute route, covered in how card chargebacks work, whereas transfers, gift cards and cryptocurrency are much harder to reverse.
• Ask them to block or replace affected cards and secure your accounts.
• If you paid by gift card, contact the card issuer promptly. Keep the card and receipt.
• If you used a payment app, digital wallets or other payment service, report it to that provider as well.
• Ask whether your online banking access should be reset and whether they will add extra monitoring.

Step 3: Secure your accounts

If you shared a password, code or login:

1. Change the password on that account, ideally from a device you trust.
2. Change it anywhere else you used the same password. Password reuse is the reason one slip can spread.
3. Turn on two-factor authentication where it is available.
4. Review account recovery details, such as backup email addresses and phone numbers, in case they were changed. Setting up account recovery options safely helps avoid lock-outs later.
5. Check for unfamiliar login alerts, forwarding rules in your email, or new devices connected to accounts.
6. Consider a password manager, so that each new password is unique.

If your email account was affected, prioritize it, because it can reset many other accounts.

Step 4: Check your device

If you clicked a suspicious link, opened an attachment or installed something at a caller’s request, run a security scan and remove unfamiliar programs. Our article on how to spot and remove malware describes what to look for. If remote access was given, a trusted technician may be needed. Keep operating system and apps up to date, since software updates close known weaknesses.

Step 5: Protect your identity

If you shared personal details such as an ID number, date of birth or documents, assume they might be reused. Watch for the warning signs described in the article on identity theft: unfamiliar accounts, letters or credit checks. Ask a recognized consumer or credit agency in your country whether you can place an alert or freeze on your records. Be extra alert for scam calls and messages in the following weeks, since criminals may reuse your details or sell them on.

Step 6: Keep a record

Write down what happened while it is fresh: dates, times, amounts, account numbers, websites, phone numbers and names used. Save screenshots, emails, texts, receipts and transaction records. This helps your bank, the authorities and anyone investigating.

Step 7: Report it

• Your bank or payment provider, as above.
• The platform where it happened, such as the messaging service, marketplace, social network or email provider, so they can remove the account.
• Police or a national fraud-reporting service, if your country has one. Reports are often used to spot patterns even when individual cases cannot be pursued.
• Your employer or IT contact, if work accounts or devices were involved. A prepared incident response plan gives the team a clear way to act.
• The impersonated organization, if the scammer pretended to be a real company, so it can warn others.

Step 8: Beware of recovery scams

After a loss, victims are often contacted by people claiming they can recover the money for an upfront fee, or posing as an official or law firm. These are frequently a second scam, sometimes run by the same group. Be wary of unsolicited offers, and verify any service through official channels. Real authorities generally do not ask for payment to return stolen funds.

Step 9: Look after yourself

Scams can cause stress, shame and sleeplessness, in addition to financial loss. Talk to someone you trust. If the loss is serious, consider seeking advice from a free financial counseling service or a professional. If you feel overwhelmed, speaking with a counselor is reasonable and common.

Step 10: Learn without blaming yourself

Once things have settled, a calm review can improve your defenses. Ask what pressure was used, which warning sign you wish you had caught and what check would have stopped it. The overview of online scams and the explanation of social engineering describe the patterns that tend to repeat. If you are in a workplace, share the lesson without blame, because speedy reporting is worth more than silent embarrassment. Sharing your experience with family or friends can protect them as well.