Scammed? What to do and where to report it

I sent money or card details

Do this first

Contact the organization that handled the payment now. Explain whether you authorized a payment after being deceived, or noticed an unauthorized transaction. Give the amount, time, and reference if available.

• Card or bank details: ask your issuer or bank about blocking or replacing the card and disputing charges.
• Bank transfer or payment app: ask the bank or provider whether the payment can be stopped or reversed.
• Gift card: contact the card issuer; keep the card and receipt.
• Cryptocurrency: contact the exchange or service used. Recovery may be difficult and is not guaranteed.

FTC: recovery options by payment method (US) ↗ (opens in a new tab or window) explains who to contact. Procedures and protections differ by location and payment type.

I entered a password or shared a login code

Do this first

1. Use a device you trust. Open the service directly and change the affected password. Replace it on any other account where you reused it.
2. Use the service’s security settings to sign out other sessions. Review recovery email addresses, phone numbers, and sign-in activity.
3. Turn on an extra sign-in check (multi-factor authentication). If you shared a one-time code or approved a sign-in, treat it as possible account access even if the password still works.
4. Check email forwarding rules and recent sent messages. Remove changes you do not recognize and warn contacts if messages were sent in your name.

If you cannot sign in, use the provider’s official recovery process. The FTC account-recovery guide ↗ (opens in a new tab or window) links to major providers and explains the checks above. Be cautious of strangers offering to recover an account for a fee.

I clicked, but did not share information

Did a file download or an app install? Go to the download steps.

Do this first

1. Close the page. Do not reply, call its support number, approve prompts, or return to investigate.
2. Check whether a file downloaded or you gave permission to install anything. If so, use the download steps.
3. Keep your browser and device updated. If you suspect harmful software was downloaded, update your security software and run a scan.
4. Check the real account through its official app if the message claimed there was a problem. Watch for unfamiliar sign-in alerts.

A click does not by itself establish that an account was taken over. These checks help you choose a response; they cannot prove that a device is clean.

Source: UK NCSC: responding to phishing ↗ (opens in a new tab or window).

Source: FTC: responding to a phishing email ↗ (opens in a new tab or window).

I downloaded or ran a file

Do this first

Downloaded but did not open it: do not open it to check. On a personal device, use trusted security software to scan and quarantine or remove it. On a work device, let the security team direct you.

Opened, installed, or ran it: stop using that device for sensitive tasks. If you suspect active compromise, disconnect it from Wi-Fi or Ethernet and use another trusted device to seek help from your manufacturer or security team. Arrange trusted help for scanning and updates; a disconnected device may need a controlled reconnection to obtain them.

A clean scan is not a guarantee. If symptoms persist, a trusted technician may need to assess the device. Avoid a factory reset before considering backups and evidence. Review exposed accounts from a separate trusted device.

Source: FTC: help after a scammer gains device access ↗ (opens in a new tab or window).

Source: UK NCSC: malicious app recovery guidance ↗ (opens in a new tab or window).

I gave someone access to my device

Do this first

1. End the remote session. Disconnect the device from the internet if you cannot reliably stop their access.
2. From another trusted device, contact your bank if financial details were visible or you made payments during the session.
3. Ask trusted support to remove the remote-access tool and check for changes or malware. Do not use the caller’s support link or phone number.
4. Secure accounts the person could access, following the password steps.

Record the tool’s name and what you remember doing. You do not need to reconnect with the caller to gather more information.

Source: FTC: tech support impersonation and recovery ↗ (opens in a new tab or window).

I received a suspicious message

Do this first

1. Do not reply, click its links, or open attachments.
2. If it claims to be from someone you know, contact them using an app or number you already trust.
3. Report the message, then delete it. If you already replied, paid, or shared information, use the matching steps above.

Where to report a scam

These services are US-specific. Reports are submitted on their official websites, not on this site. Contact your bank or account provider first if a payment or account is at risk.

Outside the US

Use your country’s official consumer-protection or police reporting service. Contact the bank or account provider involved through its official app or a trusted number.

What to keep for your report

Keep the original message, payment receipts, transaction references, and a short timeline. Do not revisit suspicious sites or forward potentially harmful attachments casually.

Reporting does not guarantee reimbursement. Be wary of anyone demanding an upfront fee to recover your money. See the FTC warning about refund and recovery scams ↗ (opens in a new tab or window).

When the immediate steps are done

Return to the account protection checklist and practice recognizing phishing messages. Keep notes of your support case numbers and review account activity again after the immediate response.