What to Do After You've Been Scammed: First-Hour Checklist

Realizing you have been scammed — or that you just clicked a link in a phishing email — is a horrible feeling. Your heart races, and you may feel ashamed or frozen. Take one slow breath, then act, because the first hour matters. Payments that have just been sent can sometimes still be stopped, and quick action keeps a scammer from doing more damage.

Work through the steps below in order. You can print this page or keep it open while you make your calls.

Minutes 0–10: Cut off the scammer

Stop all contact. Hang up, do not answer if they call back, and do not reply to texts or emails. Block their number or address. If they are connected to your computer, turn off your Wi-Fi or unplug the internet cable.

Scammers often come back with a new story — a “supervisor,” a “fraud department,” a “refund” that requires one more payment. Whatever they say, the answer is no.

Minutes 10–30: Call the company you paid with

This is the most important step. The Federal Trade Commission’s guidance depends on how you paid, but the idea is always the same: contact the payment company right away, say it was fraud, and ask them to stop or reverse it.

If you paid with…	Do this now
Credit card	Call the number on the back of the card. Federal law limits your responsibility for unauthorized credit card charges.
Debit card	Call your bank or credit union using the number on the back of the card or its official app or website, and ask for a refund.
Bank transfer or Zelle	Call your bank or credit union immediately and ask them to reverse the payment.
Wire transfer	Contact the wire company (for example Western Union, MoneyGram or Ria) or your bank, say you were tricked, and ask for a refund.
Gift card	Call the company that issued the card, using the number on the card. Tell them a scammer has the card number and PIN. Keep the card and receipt.
Payment app	Report the payment in the app (Venmo, Cash App, PayPal and others) and ask for it to be reversed.
Cryptocurrency or crypto ATM	Contact the exchange or ATM operator right away, say it was fraud, and ask them to reverse it. Then report it to federal law enforcement.
Cash sent by mail	Call the U.S. Postal Inspection Service at 1-877-876-2455; they may be able to intercept a package that has not been delivered.

Write down who you spoke to, when, and any reference numbers.

If you clicked a phishing link or replied to a phishing message

Phishing emails and texts try to get your passwords, account numbers or Social Security number. If you responded to one, the FTC’s advice depends on what you shared:

• You only clicked a link or opened an attachment. Update your security software, run a scan, and delete anything it flags. Do not enter anything on the page that opened.
• You typed in a password. Change it right away, and change it anywhere else you used the same password. Turn on two-step verification.
• You entered card or bank details. Call the card company or bank using the number on the back of your card.
• You entered your Social Security number. Go to IdentityTheft.gov for steps based on exactly what was exposed.

Not sure whether a message was phishing? Our guide to phishing emails shows the warning signs.

Minutes 30–45: Lock down your accounts

Start with your email, because whoever controls your email can reset your other passwords. The FTC recommends that you:

1. Change the password to one that is hard to guess.
2. Sign out of all devices, so anyone logged in elsewhere is kicked out.
3. Turn on two-step (two-factor) verification.
4. Check that the recovery email addresses and phone numbers on the account are yours.
5. Look for email forwarding rules you did not create, and delete them.

If you let someone into your computer, update your security software, run a scan and delete anything it flags. If you cannot get back into an account, use the provider’s official account recovery steps.

Minutes 45–60: Report it and tell someone

File a report at ReportFraud.ftc.gov. If the scam happened online or involved a computer, also report it to the FBI at IC3.gov. The Social Security Administration also recommends calling your local police department. Our report-a-scam page lists the right agency for each type of scam, plus your state attorney general.

Then tell someone you trust. If you are 60 or older, the free National Elder Fraud Hotline (1-833-372-8311) can help you through the next steps.

In the weeks ahead: watch for the second scam

People who have lost money are often targeted again by “recovery” scammers who promise to get the money back. They may pretend to be a government agency, a law firm or even the FBI. In 2025, people 60 and older reported more than $540 million in losses to recovery scams to the FBI’s IC3 (a figure that may include money lost in the earlier scam that led to the contact).

Remember these rules from the FTC and FBI:

• Legitimate organizations never charge a fee to help you get a refund and cannot guarantee you will get your money back.
• IC3 does not have a social media presence, will never contact you directly by phone, email or social media, and will never ask for payment to recover lost funds.
• Do not call back a number someone gave you or the number on your caller ID. Look up the agency’s number yourself.

Keep an eye on your bank and card statements, and on your credit reports, for anything you do not recognize.