What to Do If You Got Scammed: A Calm, Step-by-Step Recovery Plan
If you've just realized you were scammed, take a breath, acting quickly and in the right order matters far more than beating yourself up. This is the recovery hub. It walks you through the immediate first steps everyone should take, then branches to specific guidance depending on exactly what happened: a clicked link, a shared password, card details, a wired payment, a 2FA code, remote access, or a hijacked account. It also shows you exactly how and where to report the fraud, and how to avoid the 'recovery' scammers who prey on people twice.
How we check this: Reflects the recovery and reporting steps described by the FTC (reportfraud.ftc.gov, IdentityTheft.gov) and the FBI's IC3. · Last reviewed: 2026-08
First 30 minutes: stop the bleeding
Speed matters most in the first hour, so start with the actions that limit further damage. You can sort out the details afterward. First, cut off contact with the scammer: stop replying, don't call any 'help' number they gave you, and don't send anything else, even to 'verify' or 'undo' the problem. Every additional message is a chance for them to extract more.
Second, if any money moved, contact your bank or card issuer's fraud line immediately (use the number on the back of your card or your bank's official app, not a number from the scammer) and tell them you're a fraud victim. Ask them to stop, reverse, or recall the payment and to flag the account. The sooner you call, the better the odds of a claw-back.
Third, if you shared any password or code, change that password now and turn on two-factor authentication, and change it anywhere else you reused it. Then work down the branches below for anything specific to your situation. Don't skip the reporting step at the end; it's how funds sometimes get frozen and how you get the documentation you'll need.
If you clicked a link or entered a password
Clicking a phishing link alone is often less damaging than people fear, but assume the page may have tried to load something or harvest what you typed. Run a scan with your device's built-in security tools, keep the system updated, and change the password for any account associated with that link. If you entered your login on a fake site, treat those credentials as compromised: change that password immediately, change it anywhere you reused it, and enable two-factor authentication.
Watch your accounts closely for the next few weeks for unexpected sign-ins, password-reset emails you didn't request, or new devices you don't recognize. The specific pages below walk through each situation in detail.
If you gave card details, sent money, or paid with gift cards
For card details, call your card issuer's fraud line, dispute any unauthorized charges, and ask them to freeze and reissue the card. For a bank transfer or wire, contact your bank right away to request a recall, timing is everything, and some transfers can be stopped if you move fast. Report wire fraud to your bank in writing as well.
Gift cards feel hopeless but aren't always: contact the gift-card company immediately (the brand printed on the card), report the fraud, and ask them to freeze the funds, some issuers can if the card hasn't been drained. Keep the physical card and the receipt. In every money case, document amounts, dates, and any names or numbers the scammer used; you'll need this for your bank and your fraud report.
If you gave a code, remote access, or your account got hacked
If you read out a one-time verification or 2FA code, the scammer likely used it to log into an account or approve a transaction, change that password, revoke active sessions, and re-secure two-factor authentication immediately. If your 'bank' called and you gave a code, call the bank back on the official number; that code often authorizes a payment or a new payee.
If you granted remote access to your computer, disconnect from the internet, run a security scan, change passwords from a different trusted device, and watch any financial accounts you opened during the session. If a social or email account was taken over, use the provider's official account-recovery flow, then check for forwarding rules or recovery-info changes the attacker may have left behind.
For a hijacked bank, email, or social account, our dedicated account-recovery guide covers the full lockdown-and-recover sequence in order.
How and where to report the fraud
Reporting does three things: it can help freeze or trace funds, it creates the official record you'll need for banks and insurers, and it feeds the databases investigators use to catch scammers. In the United States, start with the FTC at reportfraud.ftc.gov. This is the general fraud report for scams of almost any kind. If money was lost online or the scam was internet-based, also file with the FBI's Internet Crime Complaint Center at ic3.gov, which routes reports to investigators and is especially important for wire fraud and larger losses.
If your personal information was exposed, Social Security number, driver's license, or enough to open accounts in your name, go to IdentityTheft.gov, the FTC's dedicated identity-theft hub, which generates a personalized recovery plan and an official identity-theft report. Consider placing a fraud alert or credit freeze with the three credit bureaus so no one can open new credit in your name.
Also report to the specific institution involved, your bank, the card network, the gift-card brand, or the platform where it happened (marketplace, social network, email provider). Keep copies of every report confirmation number; they're your proof and your reference for follow-ups.
Don't get scammed twice: beware 'recovery' scams
Once you've been victimized, your information often circulates among criminals, and a second wave targets people who lost money the first time. These are recovery scams: someone contacts you claiming to be an investigator, a lawyer, a government agent, or a specialized 'fund recovery' service who can get your money back, for an upfront fee, a tax, or a 'release fee.' Some even pose as the authorities who 'caught the scammer' and just need a payment to release your funds.
The rule is simple: no legitimate agency, bank, or recovery service asks you to pay upfront to get scammed money back. Real government agencies don't charge fees to return funds, and they don't cold-contact victims promising recoveries. Any message that says 'we caught the scammer, pay this fee for release' is itself the scam.
If you're pursuing recovery, work only through your bank, the official FTC/IC3 channels, and, if the loss is large, a lawyer you found independently. Treat every unsolicited 'we can get your money back' offer as a red flag.
FAQ
What is the very first thing to do after being scammed?
Stop all contact with the scammer, then immediately contact your bank or card issuer's fraud line if any money moved, and change the password for any account whose credentials or codes you shared. Speed in the first hour gives you the best chance of stopping or reversing a payment.
Where do I report a scam in the United States?
File a general fraud report at reportfraud.ftc.gov. For internet-based fraud or money lost online, also report to the FBI at ic3.gov. If your identity was exposed, use IdentityTheft.gov for a personalized recovery plan and an official identity-theft report.
Can I get my money back after a scam?
Sometimes, especially if you act fast. Card charges can often be disputed, some wire transfers can be recalled if reported quickly, and certain gift-card funds can be frozen before they're drained. Contact the relevant bank, card network, or gift-card brand immediately and keep all documentation.
Someone offered to recover my lost money for a fee, is that legit?
No. That's a recovery scam. No legitimate agency or service charges an upfront fee to get scammed money back, and anyone who cold-contacts you promising a recovery is trying to victimize you a second time.
Should I report the scam even if I didn't lose money?
Yes. Reporting attempts and near-misses to the FTC and IC3 helps investigators spot patterns and warn others, and it costs you only a few minutes. It also creates a record in case related fraud surfaces later.