I've been scammed. What do I do right now?
Don't panic. Take these steps in order. The sooner you act, the better your chances of limiting the damage.
I lost money
Whether it was a wire transfer, crypto, gift cards, or a credit card charge — here's what to do in the next 24 hours.
-
Contact your bank or card issuer immediately
Call the number on the back of your card. Tell them it was fraud. Ask to freeze the account and reverse the transaction. For wire transfers, ask for a recall — speed matters, some wires can be clawed back within 24-48 hours.
-
File a report with the FBI's IC3
Go to ic3.gov and file an online complaint. This is the #1 resource US law enforcement uses to track scam operations. Include every detail: dates, amounts, account numbers, screenshots, and the scammer's contact info.
-
Report to the FTC
Go to reportfraud.ftc.gov. The FTC aggregates reports to build cases against scam rings. Your report helps even if you never hear back.
-
If you paid with crypto
Report the wallet address at chainabuse.com. Contact the exchange you used to send the funds — some exchanges can freeze receiving accounts if notified fast enough.
-
If you paid with gift cards
Call the gift card company (Apple, Google, Amazon, etc.) with the card numbers. Some have fraud recovery departments. Keep the physical cards as evidence.
-
Report it here
File a report on Stop A Scammer so the next person searching for this scam finds your warning.
I clicked a phishing link
If you clicked but didn't enter any information, you're probably fine. If you entered credentials — act now.
-
If you entered a password
Change it immediately on the real site (type the URL yourself — don't click any link). If you reuse that password anywhere else, change it everywhere. This is the most urgent step.
-
If you entered payment details
Call your bank and report the card compromised. Request a new card number. Check recent transactions for unauthorized charges.
-
Scan your device for malware
Some phishing pages drop malware. Run a full scan with your antivirus. On Mac, Malwarebytes (free) is solid. On Windows, Windows Defender is usually sufficient.
-
If you only clicked but didn't enter anything
Clear your browser history and cookies from the last hour. Most modern phishing pages can't do much without you actually submitting information, but clearing cookies removes any tracking they planted.
-
Enable 2FA everywhere you haven't already
Use an authenticator app (Google Authenticator, Authy) — not SMS. If the scammer got your password, 2FA is the wall that stops them from getting in.
Someone is impersonating me
Fake profiles using your photos, someone sending messages as you, or accounts opened in your name.
-
Report the fake profile to the platform
Every major platform (Facebook, Instagram, LinkedIn, X, TikTok) has an impersonation report form. Search "[platform] impersonation report" — they usually act within 24-48 hours.
-
Alert your contacts
Post on your real accounts that the other profile isn't you. Anyone who received messages from the fake may be mid-scam and needs to know.
-
If accounts were opened in your name
Freeze your credit (see above). File an identity theft report at identitytheft.gov. Contact each company where accounts were opened — the FTC affidavit helps close them.
-
If your phone number was ported (SIM swap)
Call your carrier immediately from a different phone. Ask them to add a PIN/passcode to your account to prevent future ports. Switch all 2FA from SMS to an authenticator app.
-
Document everything
Screenshot the fake profiles, messages, and any financial damage. You'll need this for the FTC report, police report, and potential insurance claims.
You're not alone.
Scams are crimes, not failures of intelligence. Millions of people are targeted every day. The fact that you're here looking for help means you're already taking the right steps.