I was scammed: what to do in the first hours

If you just realized you were scammed, take a breath: you are not alone and it is not your fault. These scams are built to fool anyone. This guide is for anyone who already sent money or personal information to a scammer, or is helping a relative who did: it explains what to do in the first hours, how to ask for your money back depending on how you paid, where to report it and how to stop identity theft.

To tell your bank your debit card was lost or stolen, and limit what you lose

2 business days³

To cancel an international remittance at no cost, if it has not been picked up

30 minutes⁷

To send a written dispute of a credit card charge

60 days⁴

What your bank generally has to investigate an unauthorized charge

10 business days³

First: stop the damage

The most urgent thing is to keep the scammer from taking anything else. The IRS puts it simply: stop interacting with the scammer immediately, do not send more money or share more information, and contact your bank or credit union.¹ Block their number, do not answer their messages and do not open their links.

If the scammer asks for “one last payment” to return your money, release a prize or “avoid” an arrest, that is part of the same scam. Real government agencies and banks do not ask you to send money to protect it.⁹

Then gather everything you have: receipts, screenshots, messages, emails, names, phone numbers and how you paid. You will need it for every call and report in this guide.

Call your bank or the payment company

The CFPB says that if you think you sent a money transfer or app payment to a scammer, you should contact your bank or the payment company right away and tell them there may have been an unauthorized transaction.² Call the number on your card or the official website, not one the scammer gave you.

If someone used your debit card or account without your permission, federal law protects you, according to the CFPB. An unauthorized transaction is a charge or withdrawal you did not make or allow. Once you report it, the bank generally has ten business days to investigate (20 if the account is new), and if it cannot finish in time, it must generally give you a temporary credit while it keeps investigating.³

What you lose depends on how fast you report. If your card was lost or stolen and you report within two business days of discovering it, you cannot be held responsible for more than $50 or the amount taken, whichever is less. If you report later, you could be responsible for up to $500. And if a charge shows up on your statement, report it within 60 days; if you wait longer, you could have to pay for what happens after that period.³

The first hours and days

1. 1. Cut off contact with the scammer

   As soon as you realize

   Do not send more money or information, even if they promise to return what you paid.¹

2. 2. Call your bank, card company or payment company

   The first hour

   Say there may have been an unauthorized transaction; if it was a wire, ask for it to be reversed.²

3. 3. If it was a remittance, ask to cancel it

   Within 30 minutes, if possible

   If the money has not been picked up or deposited, you can cancel at no cost; check your receipt.⁷

4. 4. Report the scam

   The same day

   At ic3.gov or reportfraud.ftc.gov, to your state attorney general and to local police.⁹

5. 5. If you gave out your information, protect your identity

   That same week

   Report at IdentityTheft.gov and place a fraud alert or freeze your credit, for free.¹²

6. 6. Send your credit card dispute in writing

   Within 60 days of the statement

   A phone call is not enough to protect your rights: keep a copy of your letter.⁴

7. 7. Watch your accounts and statements

   The following weeks

   Report any new charge you do not recognize within 60 days.³

If you paid with a credit card

Credit cards have their own dispute process. The CFPB recommends calling the company right away and checking your card agreement for your rights on unauthorized charges. But to protect your rights you must also send a written billing error notice within 60 calendar days after the charge appeared on your statement. The company has 30 days to confirm it received it. Even if you already paid the charge, you can still dispute it. Keep copies of everything.⁴

Watch the address: the address for billing disputes may be different from where you send payments, and your statement says which one to use. While the company investigates, you do not have to pay the disputed charge or related finance charges, but you must keep paying the rest on time. The company gets another two billing cycles to finish its investigation.⁵

Wire transfers, remittances, gift cards and cryptocurrency

These are scammers’ favorite payment methods because they move money fast.² Getting money back is harder, but not impossible, and time matters.

Wire transfer. The CFPB says to call your bank or wire-transfer company immediately and ask for a wire recall: reporting it as soon as possible can increase the likelihood of recovering your money.⁶ Even so, the CFPB and FTC warn that wiring money is like sending cash: once sent, you usually cannot get it back.⁸ There is more on this fraud in the glossary: wire transfer fraudwire fraud at closingThis is a scam aimed at people about to close on a home. Days before closing, the scammer sends an email that looks like it comes from your real estate agent or settlement agent with "new" instructions to wire or electronically transfer your down payment or closing costs to a different account. If it works, getting the money back can be very hard. The CFPB recommends writing down two trusted contacts ahead of time, confirming any instructions with them using only those numbers, and not using phone numbers or links in the email. If it happens to you, call your bank right away to stop or reverse the transfer.See the full definitionClose.

Remittance abroad. If you sent a remittanceremittance transferA remittance transfer is an electronic money transfer you send from the United States to a person or company in another country through a remittance transfer provider, such as a bank or another financial services company. Federal law protects transfers above a minimum amount made by a provider in the normal course of its business. The provider must tell you, before and after you pay, the fees, taxes, exchange rate and how much the other person will receive, in your language if it advertises in it or served you in it. You have up to thirty minutes to cancel at no charge, if the money has not been picked up, and one hundred eighty days to report an error.See the full definitionClose through a money transfer company, you can cancel at no cost if you paid less than 30 minutes ago and the money has not been picked up or deposited; for a scheduled transfer, up to three business days before. Your state’s law or the company’s rules may give you more time, and your receipt should generally state your cancellation period.⁷

Gift card. As soon as you tell someone the numbers on the back, they control the card. No legitimate business or government agency will insist that you pay with gift cards.⁸ Report it anyway.

Cryptocurrency. Cryptocurrency payments do not come with legal protections, and you usually cannot get the money back unless the person you paid sends it back.⁸

What you can do depending on how you paid

More protection

Debit or credit card

• Debit: report within two business days to limit what you lose.³
• Credit: dispute in writing within 60 days.⁴
• You do not pay the disputed charge while they investigate.⁵

Act within minutes

Wire, app or remittance

• Call the bank or company and report an unauthorized transaction.²
• Ask for a wire recall.⁶
• Remittance: free cancellation within 30 minutes, if not picked up.⁷

Very hard to recover

Gift card or cryptocurrency

• Whoever has the numbers controls the gift card.⁸
• Cryptocurrency has no legal protections.⁸
• Report it anyway: what you share can help protect your community.⁸

Whatever you paid with, call today: reporting quickly can increase the chance of getting your money back.⁶

Report the scam

What you report can help protect your community from fraud.⁸ The CFPB says to contact the FBI, the FTC, your state attorney general or your local police. You can report to the FTC at reportfraud.ftc.gov or to the FBI at ic3.gov, find your attorney general through the National Association of Attorneys General, and call the police or sheriff on their non-emergency number.⁹

Where	For what
ic3.gov (FBI)	Scams online, through apps or by wire
reportfraud.ftc.gov (FTC)	Any consumer scam or fraud
Your state attorney general	Scams in your state; many have a consumer protection office
Local police or sheriff	An official report, through the non-emergency number

IC3, the FBI’s hub for reporting internet crime, asks you to file a report even if you are not sure your case qualifies.¹¹ If you do not know which agency applies, USAGov’s where-to-report-a-scam tool guides you with a few questions.¹⁰

If the victim is an older adult or a person with a disability, the CFPB says to also contact your local adult protective services, which you can find through the Eldercare Locator or at (800) 677-1116.¹³ And if a bank, card company or money transfer company is not responding, you can submit a complaint to the CFPB; the company generally responds within 15 days. Keep in mind that the CFPB keeps complaint information, including your personal information, for 25 years and shares it with certain agencies as the law allows.¹³

If your information was stolen: stop identity theft

If you gave the scammer your Social Security number, ITIN, passwords or account details, the risk continues after the scam: someone can open accounts in your name. That is identity theftidentity theftIdentity theft happens when someone uses your personal information without your permission to commit fraud: for example, your name, your Social Security or Medicare number, or your credit card or bank account number. With that information, a thief can rent a home, get credit cards, receive government benefits or tax refunds, or open other accounts in your name. You often find out when your credit report or a statement shows accounts or charges you do not recognize, or when a debt collector calls. The federal site IdentityTheft.gov takes reports and gives you a recovery plan.See the full definitionClose. The CFPB lists these steps:¹²

1. Close affected accounts and call the fraud departments of your banks and card companies.
2. Report the theft to the FTC at IdentityTheft.gov. You get an Identity Theft Report and a recovery plan.
3. Place a fraud alertfraud alertA fraud alert is a note in your credit file that requires creditors who check your report to verify your identity before opening a new account, issuing an additional card or raising your credit limit. You only need to ask one of the nationwide credit reporting companies, which must notify the others. An initial alert is for anyone who suspects they are, or are about to become, a victim of fraud or identity theft, and it lasts one year unless you ask to remove it sooner. An extended alert requires an identity theft report and lasts seven years. When you place one, you are entitled to free copies of your report.See the full definitionClose. You only need to contact one of the three nationwide credit reporting companies (Equifax, Experian or TransUnion), which must notify the others. An initial alert lasts one year; an extended alert lasts seven years if you filed a report at IdentityTheft.gov.
4. Consider a credit freezesecurity freezeA security freeze, also called a credit freeze, keeps new creditors from seeing your credit file, which helps stop an identity thief from opening new accounts in your name. By law it is free to place and to lift, and you must ask each of the three nationwide credit reporting companies separately. While it is on, only a few can see your file, such as creditors on accounts you already have, and you can still review your reports. It does not affect your score. Because creditors rarely lend without checking your file, it stops you too; you can lift it for free for a period of time when you need to.See the full definitionClose. Under federal law, freezing and unfreezing is free, but you must request it at each of the three companies.
5. Ask them to block what is fake. With your identity theft report, the companies must block fraudulent information from your report within four business days.

If your Social Security number or ITIN was stolen, the IRS says to also report it to the IRS and get an IP PINIRS Identity Protection PIN (IP PIN)The IP PIN (Identity Protection PIN) is a six-digit number from the IRS that keeps anyone else from filing a tax return with your Social Security number or ITIN. Only you and the IRS know it. Anyone with an SSN or ITIN who can verify their identity can get one: online, by application or in person at an IRS office. It changes every year, and you must use it on every federal return you file that year. The IRS will never ask for your IP PIN by phone, email or text message: that is a scam.See the full definitionClose, a PIN that keeps anyone else from filing a tax return in your name.¹ The guide to reading your credit report helps you spot accounts that are not yours, and the guide to disputing errors helps you correct them.

Watch out for the second scam: people who “recover” your money

After a scam, calls often come from someone promising to recover your money for a fee: a supposed lawyer, a supposed agency or a “crypto expert.” The IRS warns that some victims get scammed again this way.¹ The FBI’s IC3 says it does not work with non-law enforcement entities, such as law firms or crypto services, to recover lost funds, and that it never contacts you directly for information or money.¹¹

If the scammer pretended to be from an agency, the guide to impostor calls explains how to check who is calling. If it was a fake notario or immigration consultant, EOIR takes complaints at EOIR.Fraud.Program@usdoj.gov, and its employees never call to ask for information or money.¹⁴ The guide a notario is not a lawyer explains where to turn instead.

If this is you

If this is you

The victim is an older adult

Besides reporting, contact adult protective services through the Eldercare Locator, (800) 677-1116.¹³

You gave out your ITIN or Social Security number

Report it at IdentityTheft.gov and to the IRS, and get an IP PIN.¹

You paid for a home that did not exist

Call your bank or payment company and report the scam at ic3.gov.² The housing scams guide has more warning signs.

A fake notario or “consultant” scammed you

Report it to EOIR at EOIR.Fraud.Program@usdoj.gov and keep all papers and messages.¹⁴

Example with real numbers

An example: you paid a scammer through an app

One possible order of steps, with what official sources say at each one.

You realize it was a scam

You call your bank and report a possible unauthorized transaction.²

The same day

You report at ic3.gov and to the police on the non-emergency number.⁹

You had given out your Social Security number

You report at IdentityTheft.gov and freeze your credit at all three companies.¹²

Someone calls to “recover” your money for a fee

You do not pay: IC3 does not work with law firms or crypto services for that.¹¹

What you keep

Receipts, messages and the number of each report.

This is an example; your case may differ. If the scam left you short on money this month, the family budget tool helps you rework your spending.

Run it with your numbersFamily budget

Mistakes that make a scam worse

• Mistake: Waiting until you are “sure” before calling the bank.

  Instead: Call right away: time matters to limit what you lose.³

• Mistake: Sending “one last payment” to get back what you paid.

  Instead: Stop interacting with the scammer and do not send more money.¹

• Mistake: Disputing a credit card charge only by phone.

  Instead: Also send the notice in writing within 60 days and keep a copy.⁴

• Mistake: Paying someone who promises to recover your money.

  Instead: IC3 does not work with law firms or crypto services to recover funds.¹¹

• Mistake: Not reporting out of embarrassment or because you think it is useless.

  Instead: IC3 asks you to report even if you are not sure your case qualifies.¹¹

• Mistake: Freezing your credit at only one company.

  Instead: A freeze is requested at each of the three companies, and it is free.¹²

What to do this week

1. If you have not yet, call your bank, card company or payment company, and write down the case number.²
2. If you paid by credit card, send your written dispute to the billing disputes address.⁵
3. Report the scam at ic3.gov or reportfraud.ftc.gov, to your state attorney general and to local police.⁹
4. If you gave out your information, report at IdentityTheft.gov and freeze your credit at all three companies.¹²
5. If you have a Social Security number or ITIN, consider getting an IP PIN from the IRS.¹
6. Check your statements every week and report any new charge you do not recognize.³
7. If you are short on money, the emergency fund guide and the family budget tool help you regroup. If reporting worries you because of your situation, a free legal aid office can guide you.