What to Do If You Get Scammed Online: Act Fast

If you have been scammed online, stop contact with the scammer and call the bank, card issuer, payment app, or exchange immediately using a number from its official app, website, or the back of your card. Secure your email and financial accounts from a trusted device, disconnect any computer or phone the scammer accessed, save the evidence, and file reports. Do not pay a “recovery expert” who promises to get the money back. Fast action cannot guarantee a refund, but it gives payment providers and investigators the best chance to limit the loss.

If you are still unsure whether the situation was fraud, use the “did I get scammed?” warning-sign checklist. If money, credentials, personal information, or device access has already been exposed, continue with the recovery steps below.

What to do in the first hour after being scammed

1. Stop contact without deleting the conversation. Do not argue, threaten the scammer, send another payment, or follow a new “verification” link. Capture the messages and transaction details, then block the account or number.
2. Call the payment provider now. Use official contact details, not a phone number, QR code, or support link supplied by the scammer. Ask the fraud team to stop, recall, dispute, or flag the transaction and secure the account.
3. Protect your email first. Email is often the reset key for banking, shopping, social media, and cloud accounts. From a clean device, change the email password, sign out other sessions, check forwarding rules and recovery details, and enable multi-factor authentication.
4. Disconnect a device the scammer controlled. Turn off Wi-Fi or unplug the network cable. Do not log in to banking, email, a password manager, or a crypto wallet on that device until it has been checked.
5. Save evidence. Keep receipts, order numbers, transaction IDs, email headers, chat exports, usernames, phone numbers, website addresses, wallet addresses, and the exact time of each event.
6. Report the scam. Notify the platform where contact happened and the appropriate fraud or cybercrime agency. In the United States, the FTC and FBI’s Internet Crime Complaint Center are the main starting points.[1][2]
7. Warn connected people and organizations. Tell an employer if a work account or device was involved. Tell contacts if the scammer could impersonate you. If an identity document was exposed, follow the issuer’s replacement guidance.

Can you get your money back after an online scam?

Sometimes, but the outcome depends on the payment method, whether the payment was authorized, the provider’s rules, local law, and how quickly you report it. Never describe a knowingly sent payment as an unauthorized card transaction. Tell the fraud team exactly what happened: you were deceived, what you expected to receive, when you realized it was a scam, and what evidence you have.

The FTC’s payment-method guidance likewise recommends contacting the company that handled the payment and asking whether it can be reversed.[1] A bank, app, exchange, or police report number may also help establish a timeline, but none of these steps guarantees recovery.

If you shared a password, card number, or identity information

Work from a device the scammer did not control. Secure the main email account first, then banking, payment apps, password managers, shopping accounts, social media, and cloud storage.

• Change every exposed or reused password to a unique one.
• Sign out other sessions and remove unknown devices, app passwords, passkeys, and recovery addresses.
• Turn on multi-factor authentication, preferably with an authenticator app or security key where available.
• Check email forwarding rules, filters, mailbox delegates, and deleted messages for changes you did not make.
• Replace exposed cards and review recent transactions and account-profile changes.
• If a Social Security number or other identity document was exposed, create a recovery plan and consider a fraud alert or credit freeze through the official IdentityTheft.gov process.[3]
• If a phone number was taken over, contact the mobile carrier, recover the number, add an account PIN, and then reset important passwords.

Do not change sensitive passwords on a computer that still has an active remote-access session, an unknown browser extension, or a file you ran for the scammer. The new credentials could be captured again.

If you downloaded a file or gave the scammer remote access

Disconnect the affected Windows PC from the internet, but leave it powered on if you need to note the remote-access program, open windows, or file names. Use another trusted device to contact the bank and change critical passwords. When the financial accounts are contained, return to the offline PC and record any remote-support software, new extensions, unknown applications, or files the scammer asked you to run.

Uninstalling the visible remote-access app or deleting one download may not remove everything created during the session. A loader, scheduled task, service, startup entry, browser change, or bundled module can remain and recreate symptoms after reboot. Run a full Gridinsoft Anti-Malware scan, remove detections, reboot, and scan again if pop-ups, redirects, blocked connections, unknown logins, or security warnings return. The scan can check hidden files, startup entries, scheduled tasks, browser changes, and persistence; it cannot reverse a payment, restore a stolen password, or prove that no data was viewed.

If the scammer had administrator access, disabled security controls, accessed a password manager or crypto wallet, or activity continues after cleanup, treat the device as high risk. Back up personal documents carefully and consider a clean Windows reset or help from a trusted local technician. For a known remote-support tool, the unexpected ScreenConnect cleanup guide shows the kind of access and persistence checks to perform.

What evidence should you save?

Create one folder and a short timeline. Keep copies rather than forwarding original messages to strangers who offer help.

• the scammer’s display name, username, phone number, email address, and profile URL;
• website URLs, order pages, advertisements, and the page that requested payment;
• screenshots or exports of the full conversation, including dates and times;
• receipts, bank references, transaction IDs, crypto transaction hashes, and destination wallet addresses;
• the names of downloaded files, installed apps, browser extensions, and remote-access tools;
• support case numbers from the bank, app, marketplace, exchange, police, and reporting agencies.

Do not upload identity documents, bank statements, seed phrases, passwords, or unredacted payment details to public forums. Give sensitive evidence only to the verified organization handling the case.

Where should you report an online scam?

• Payment provider: first priority when money moved or payment credentials were exposed.
• Platform or marketplace: report the account, listing, advertisement, page, and transaction.
• United States: report consumer fraud to the FTC and internet-enabled crime to IC3.[1][2]
• Outside the United States: use the national cybercrime reporting center, consumer-protection agency, financial regulator, or local police service for your country.
• Police or emergency services: contact them promptly when there are threats, stalking, blackmail, identity-document theft, a large transfer, or immediate physical danger.
• Employer or school: report the incident when their device, account, data, or payment process may be affected.

Reporting does not automatically produce a refund, but it creates a record and gives platforms, financial institutions, and investigators information that can connect related cases. IC3 notes that rapid reporting can support efforts to recover lost funds.[2]

Do not get scammed twice by a recovery service

Victims are often contacted by people claiming to be hackers, investigators, law firms, government agents, or “fund recovery departments.” Treat an unsolicited promise to recover everything for an upfront fee, tax, wallet activation, remote-access session, or seed phrase as another scam.

Use only contact information you independently verify on the bank, platform, regulator, police, or government website. A real organization may ask for evidence through its official case system; it will not need your password, authentication code, full crypto seed phrase, or another payment to “unlock” recovered money. For crypto cases, the crypto scam guide explains common wallet, investment, and recovery traps.

FAQ

References

1. Federal Trade Commission. “What To Do if You Were Scammed.” Consumer Advice, July 2022, accessed July 22, 2026. consumer.ftc.gov/articles/what-do-if-you-were-scammed
2. Federal Bureau of Investigation, Internet Crime Complaint Center. “Internet Crime Complaint Center (IC3).” Accessed July 22, 2026. ic3.gov
3. Federal Trade Commission. “IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan.” Accessed July 22, 2026. identitytheft.gov