If you have sent money, shared a password, disclosed personal information, or clicked a suspicious link, act quickly but do not panic. This step-by-step recovery checklist explains what to do after a scam, how to contain further damage, preserve evidence, report the incident, and track follow-up actions over the weeks and months that follow.
Overview
A scam does not end when the conversation stops. A stolen password may be reused against other accounts, a compromised device may expose new information, and a payment dispute may require records that are easiest to collect immediately. Your first priority is containment: stop further contact, secure accounts and devices, and alert the organizations that can limit additional loss.
Start by writing down what happened while the details are fresh. Record the date and time, the contact method, the sender’s name or claimed organization, phone numbers, email addresses, website addresses, usernames, payment method, amount, and any information you disclosed. Do not continue talking with the scammer to obtain more evidence. Save what you already have, then block the account or number if appropriate.
If you are in immediate physical danger, believe a criminal has access to your home or workplace, or face an urgent threat involving a child or vulnerable person, contact local emergency services. For financial or account-related incidents, use contact details you find independently, such as the official website, the number on a bank card, or the support function inside a trusted application. Do not use a number or link supplied by the suspicious message.
For additional prevention guidance, see our online scam checker workflow and identity theft protection checklist.
What to track
1. Payments and financial accounts
Contact the bank, card issuer, payment app, money-transfer service, gift-card issuer, or cryptocurrency platform involved. Explain that the transaction was connected to fraud and ask what cancellation, recall, dispute, or account-security options are available. The outcome depends on the payment method and timing, so report it as soon as possible and keep the case number.
Check recent and pending transactions for activity you do not recognize. Ask whether the account needs a new card, changed credentials, additional monitoring, or temporary restrictions. Do not pay anyone who promises guaranteed recovery of your money. Recovery scammers often target people who have already reported a loss and demand an upfront fee, tax, verification payment, or cryptocurrency transfer.
2. Passwords and account access
Change the password for any account whose credentials were disclosed, typed into a suspicious website, or reused elsewhere. Begin with your primary email account because it may be used to reset other passwords. Then secure banking, payment, cloud storage, social media, work, shopping, and messaging accounts.
Use unique passwords or passphrases and enable multifactor authentication where available. Review recovery email addresses, phone numbers, active sessions, connected applications, forwarding rules, and newly created login methods. If you cannot sign in, use the provider’s official account-recovery process rather than links in an email or text. If a work account was involved, notify your organization’s security or IT team immediately.
3. Devices, links, and software
If you clicked a malicious link, installed software, granted remote access, or opened an unexpected attachment, disconnect the affected device from the internet when practical and seek trusted technical help. Run security scans, remove unfamiliar applications, install pending updates, and review browser extensions. A password change made from a compromised device may not be enough; use a known-clean device when possible.
For a suspicious text, email, call, or website, preserve the original message and relevant headers or URL before deleting it. Our guide to checking suspicious messages before replying can help you distinguish evidence from content that should not be opened again.
4. Identity information
If you shared an identification number, address, date of birth, tax information, account details, or photographs of identity documents, increase monitoring. Consider contacting the relevant identity-document issuer, credit-reporting service, insurer, employer, or government office for guidance based on the information exposed. Where available in your region, ask about a fraud alert, credit freeze, replacement document, or other protective measure.
Watch for unfamiliar account-opening notices, password-reset messages, bills, benefit changes, medical statements, employment records, or tax correspondence. Keep a log of each alert, the date you received it, and the action taken.
5. Reports and evidence
Report the incident to the payment provider, platform where the scam began, email or messaging service, mobile carrier when relevant, and the appropriate consumer-protection or law-enforcement channel in your jurisdiction. If the scam involved your workplace, school, client, or customer, follow the organization’s incident-reporting process. Include facts, not guesses: what happened, when it happened, what was sent, and which accounts or devices may be affected.
Keep screenshots, transaction records, emails, message exports, URLs, receipts, usernames, call logs, case numbers, and support responses in one secure folder. Preserve originals where possible and make a separate backup. Do not publish sensitive evidence publicly, since it may contain account numbers, addresses, or identity documents.
Cadence and checkpoints
A simple schedule prevents the incident from disappearing from view.
- Immediately: Stop contact, preserve evidence, contact the payment provider, secure the email account, and report any compromised work account.
- Within 24 to 48 hours: Change reused passwords, enable multifactor authentication, review active sessions and transactions, secure affected devices, and submit platform or consumer reports.
- During the first few weeks: Check financial accounts and email regularly, respond to legitimate follow-up requests, and watch for recovery scams or attempted password resets.
- Monthly for several months: Review statements, credit or identity alerts where available, account-recovery notifications, and the status of open disputes or reports.
- Quarterly: Recheck privacy settings, remove unused connected applications, update devices, and confirm that old passwords are not being reused.
Use a tracker with these columns: date, organization, contact method, case number, information provided, promised action, next follow-up date, and status. Store it separately from the compromised account if that account may be inaccessible.
How to interpret changes
Not every unfamiliar message proves that identity theft has occurred, but patterns matter. One unsolicited password-reset email may be an attempted login; several reset requests across different services suggest that someone may be testing credentials. A small unfamiliar transaction can be a warning sign, especially when followed by larger attempts or changes to account settings.
Prioritize signals that involve control of an account, movement of money, creation of a new account, or use of identity information. If you see any of these, contact the affected organization through an independently verified channel rather than replying to the alert.
Separate confirmed events from possibilities in your notes. For example, “card payment disputed on Tuesday” is a confirmed action, while “identity may have been exposed” is an assessment. This distinction makes follow-up clearer and helps support staff understand what needs attention.
Be cautious with anyone who contacts you because of the original incident. A genuine bank, platform, or agency should not require you to move money to “protect” it, share a one-time code, install remote-access software, or pay a guaranteed recovery fee. When uncertain, end the conversation and start again using an official channel.
When to revisit
Revisit this checklist whenever a new transaction, login alert, password-reset message, account notice, or contact from a supposed recovery service appears. Also review it after a data breach notification, device loss, change of phone number, or discovery that the same password was used on multiple services.
Set a monthly calendar reminder while disputes, identity monitoring, or account investigations remain open. At each checkpoint, confirm that alerts are still enabled, contact information is current, follow-up dates have not passed, and no new account or transaction has appeared. Once activity has stabilized, retain your evidence and final case records according to your personal or organizational retention needs, then continue basic quarterly privacy and security checks.
If you are helping someone else, avoid blame and focus on the next safe action. Scams are designed to create urgency and confusion. A calm record, prompt notification, and consistent follow-up give you the best practical basis for limiting damage and pursuing available recovery options. For longer-term prevention, review these privacy protection steps and keep this article available as a recurring scam recovery checklist.
