What to do if you've been scammed: the first hour, in order

Hang up, or stop replying. Then call your bank, card company, or payment app on a number you look up yourself, and ask them to stop or reverse the payment. After that, lock down whatever you gave the scammer, starting with your email password. Then, report it to all relevant entities. And expect a second call: anyone who contacts you out of the blue offering to get your money back for a fee is running a second scam.

So, if you’re looking for a checklist, in order that’s:

1. End the contact. Hang up, stop replying, block them. If you’re in danger, call 911 first.
2. Call about the money, on a number you look up yourself, by how you paid.
3. Lock down what you gave them, email password first.
4. Write everything down.
5. Report it.
6. Tell someone you trust. If you’d rather not do steps 2 through 5 alone, hang up, then call them.

If this happened to your mom or dad, this guide is written for you.

Don’t be ashamed. Almost everyone gets targeted, and careful, smart people lose money to these professionals every day. The people who did this are experts, and you are one of many. What matters now is staying calm, taking the next steps in order, and not getting caught by the follow-up.

The first hour

1. End the contact

Hang up. Stop replying to the texts, emails or messages. Don’t call back to argue or to tell them you’re reporting them, and don’t try to trace them yourself. A reply tells them a real person is still there. Block the number or the profile.

If a pop-up has locked your screen, the FBI says to disconnect the device from the internet and shut it down. If you gave someone remote access to your computer or phone, disconnecting it from the internet is the sensible first move too. Step 3 covers what to do next.

2. Ask for your money back

Whether you can get money back from a scammer depends on how you paid, how fast you contact the payment provider, and whether you sent the money yourself or they took it. So call immediately on a number you look up yourself: the back of your card, the bank’s app, the company’s own website. Never call a number from the scammer’s messages. The FTC’s advice is nearly the same for every payment method: contact the company you paid through right away, tell them it was a scam, and ask them to reverse or refund it.

One distinction matters a lot on that call. If a scammer moved the money themselves, using a code, password or card number they tricked out of you, that’s an unauthorized transfer, and federal rules give you stronger protections than if you sent it yourself. Say so plainly: “I did not make this transfer.”

Who to call, by how you paid:

• Bank transfer, Zelle, wire or check: your bank’s fraud line. If you paid through Zelle, Zelle’s network has a policy to reimburse certain impostor scams even when you sent the money yourself; AARP reports it covers scammers posing as a government agency, a bank or a service provider. Report it to your bank first and ask whether yours qualifies.
• Credit or debit card: the number on the back. Ask to dispute the charge, and ask whether they need it in writing too; some card protections do.
• Payment app (PayPal, Venmo, Cash App): report it in the app and contact the company. If the app pulled from a card or bank account, call them too.
• Western Union or MoneyGram: their fraud lines. Ask for a refund.
• Gift card: the company that issued the card. Keep the card and the receipt.
• Crypto: the exchange or crypto ATM operator. Crypto payments are generally not reversible, but report it anyway.
• Cash by mail: the U.S. Postal Inspection Service at 1-877-876-2455, which can sometimes intercept a package before it’s delivered, for a fee. By FedEx or UPS, call the carrier. If someone came to your door for the cash, call the police.

What to expect. My honest advice: expect to get nothing back, so anything that comes back is upside. Banks, payment apps and tech platforms want scammers out of their systems, and in my experience they tend to be very helpful. Recovery, when it happens, starts with them, and moving fast and giving them every detail you have improves your odds.

Two figures to hold at once: (1) AARP’s fraud experts say recovery is very rare, but (2) in a 2026 survey by the Global Anti-Scam Alliance (GASA), about half of the Americans who reported a loss to any organization, their bank included, said some or all of the money was reimbursed or recovered.

Nobody gets money back without asking. So ask, and if the first answer is no, ask again.

One caveat: a payment you made yourself, even because you were tricked, isn’t protected the way a stolen card is. Cards generally have the strongest protections, and cash, gift cards and crypto are the hardest to get back. Call anyway, and ask for a reference number every time.

3. Lock down what you gave them

Read the line that matches what you shared.

• A password, or access to your email. Change your email password first, from a device the scammer never had access to. Whoever controls your email can reset many of your other accounts. Then change your bank, payment app and social media passwords, and anywhere you reused the old one. Turn on two-step verification, or a passkey where it’s offered. (Side note: now might be a nice time to consider a password manager.)
• Your bank or card details. Tell your bank when you call about the money, and ask about a new card or account number.
• Your Social Security number. Go to IdentityTheft.gov if it’s already being used. Either way, freeze your credit at Equifax, Experian and TransUnion. A credit freeze is free, stops lenders from pulling your report to open new credit in your name, and can be lifted for a while when you need a loan or a new card in the future.
• Access to your computer or phone. The FTC says to update your security software, run a scan and delete anything it flags, then change your passwords. If you’d rather have help with that, ask the manufacturer or someone you trust. If it started with a fake renewal email and a “refund,” the Geek Squad scam email guide walks through that version step by step.
• An account they took over (email, Facebook, WhatsApp). Recover it through the platform’s own help pages, then sign out of all devices and check the recovery email, phone number and forwarding rules, which scammers change so they can get back in. Tell your contacts that messages “from you” may be fake; scammers use a taken-over account to work through your friends.
• Your Medicare number. Call 1-800-MEDICARE (1-800-633-4227), and check your Medicare statements for services you didn’t get. Our Medicare scam calls guide has more.

4. Write it all down

The names the scammer used, phone numbers, email addresses, websites, dates, amounts, how you paid, screenshots, and every reference number the bank gives you. The FBI asks for as much of this as you can gather, and every report after the first gets easier. Do it today, while the details are fresh.

5. Report it

Reports are how these operations get traced and shut down, even when your own money is gone. Leave the tracing to the agencies; trying it yourself can reopen the contact.

Here are the proper reporting channels:

• The platform they used. Forward scam texts to 7726 (SPAM), report the email to your email provider, and/or report the profile on the site or app.
• The FTC: ReportFraud.ftc.gov.
• The FBI: ic3.gov, for scams that happened online or by phone. File even if you’re not sure it counts.
• The National Elder Fraud Hotline, for fraud against anyone 60+: 833-372-8311, weekdays 10 a.m. to 6 p.m. ET. Run by the Justice Department, it gives you a case manager who helps with the rest of the reporting.
• Local police, if you were threatened or someone came to your home, or if a police report would help a claim.
• Your state attorney general’s consumer protection office.

6. Tell someone you trust

For a lot of people, this is the hardest step. Pride, shame and fear get in the way. You worry about how they’ll react and what happens next, and it can feel easier to pretend it didn’t happen.

But telling someone doesn’t require apologizing or feeling ashamed. It just requires trusting they’ll be there to help you and work in your best interest.

A second person also helps with what comes next. They can make some of the calls with you, and they can be the one who says “let’s check that first” when a new call comes in.

Expect a second scam

The people who took your money may come back, and the FTC says scammers buy, sell and trade lists of people who have already paid. In the GASA survey, 58% of Americans who lost money to a scam in the past year said it happened more than once. Not all of those were recovery scams, but the first loss is often not the end of it.

A good friend of mine was scammed, and then nearly fell for several follow-up scams. Callers claimed to be his bank, reaching out to help him recover what he’d lost. He was desperate to get it resolved and worn out from dealing with it, and he came close to losing more. What gave it away: the callers knew details about the scam that he hadn’t told his bank yet.

So double-check every call and email that comes to you, even one that seems to know everything. Before you give any more information, reach back out through a number or email address you’ve verified yourself. Remember that the people who took your money know exactly how it happened. That makes it easy for them to sound like your bank, calling about the specifics.

The FTC’s rule for refund and recovery scams is simple: no real agency or recovery service that contacts you charges an upfront fee or asks for gift cards or crypto to get your money back. Scammers pose as government agencies, law firms and consumer groups, and the Justice Department warns that some impersonate the Elder Fraud Hotline itself. The check is the same every time: hang up, look up the number yourself, call back.

How you might feel

Many people feel angry and embarrassed, and shaky for a while afterward. In Australia, Sylvie Leber checked her bank account about an hour after a call from someone claiming to be from the national broadband network, and about $20k of her savings was gone. She has described being horrified, then ashamed, and losing confidence, and she later saw a psychologist. Her daughter’s friend, who works in cybersecurity, secured her passwords and devices.

That reaction is normal, and it will pass. If it’s weighing on you, talk to someone. AARP’s Fraud Watch Network runs a free helpline, 877-908-3360, weekdays 8 a.m. to 8 p.m. Eastern, for members and non-members alike, and a free online Fraud Victim Support Group for people who’ve been through a scam and their families. A counselor or your doctor can help too.

In the next few weeks

• Check your bank and card statements every week for a couple of months, and report anything odd the day you see it.
• Pull your free credit reports at AnnualCreditReport.com.
• Set up a password manager, and turn on a passkey or two-step verification for your email and bank, where they offer it.
• Make your social media profiles visible to friends only.
• Keep your notes and reference numbers in one place, in case a bank or investigator calls back. (Before you answer their questions, hang up and call them back on a number you look up.)

Next time

The rules that protect you from the next one are short:

• Nobody gets money or a code from you because of a call, text or email where you didn’t start the contact. If it might be real, hang up and call back on a number you look up yourself.
• Secrecy and “right now” are the tells. Treat either one as a reason to end the call and check.
• Anything that nags at you gets checked the same way.

Knowing the rules isn’t the same as having them ready when a friendly, official-sounding voice is on the line. That’s what ScamPrep is for: realistic practice calls, texts and emails, with warm coaching if ever there’s a slip, so the pause is familiar when it counts. You invite, they opt in. If you’d like that practice for yourself, or for someone you love, here’s how it works. If you want to set these rules up with a parent first, start here.