If you clicked, paid or gave information

Jump to what happened:

• I clicked a link but didn't type anything
• I typed a password
• I gave a card number or bank details
• I sent money
• I gave my Social Security or Medicare number
• I let someone into my computer or phone
• Report it

I clicked a link but didn't type anything

• Close the page. Don't download or install anything it offers.
• If something did download, or a program asked to install, the FTC suggests updating your security software, running a scan and removing anything it flags.
• For fake delivery texts, the Postal Inspection Service advises telling your bank if you interacted with the link at all, even without pressing submit. It's a reasonable step for any link that was about money.
• Keep an eye on your statements for the next few weeks.
• A scan often won't flag a remote-control program that someone talked you into opening, because it's a real program. If that happened, see I let someone into my computer or phone.

I typed a password

If it was your bank's password, or you also gave a code, call your bank first, at the number on the back of your card. The FBI warns that criminals who get a password and a one-time code can lock you out and move money quickly, and its advice is to contact your bank as soon as you recognize the fraud.

Then, from the FTC's "What To Do if You Were Scammed":

• If you can still sign in, change that password now, and change it on any other account where you used the same one.
• Turn on two-step sign-in (also called two-factor or multi-factor authentication), so a password alone isn't enough to get in.
• If you can't sign in any more, use the company's official account-recovery page, which you reach by typing its address yourself.

If it was your email password, change it first among the others, from a device you trust: your email can be used to reset your other passwords. Our first-hour checklist for a hacked email goes through the rest, including the recovery details and forwarding rules attackers add.

I gave a card number or bank details

• A credit or debit card: call the number on the back of your card, or use your card company's app, or its website typed in yourself, today. Tell them what happened and ask them to cancel the card and dispute any charges you didn't make. Federal law limits what you owe for charges you didn't make, but with a debit card, how much you're protected depends on how quickly you report it, so don't wait. If you paid the scammer with your card yourself, call anyway: the FTC's advice is to report it immediately and ask for a refund.
• Then follow up in writing. The FTC says to "Follow up immediately in writing." For a credit card, the Consumer Financial Protection Bureau says you "must also send a written billing error notice to the card company within 60 calendar days after the charge appeared on your statement" to protect your rights. Under the federal rule, the card company has to receive the notice within that time, so send it well before the deadline. Ask the card company for its address for billing disputes. For a debit card, the CFPB says that if your card, or its security code or PIN, was lost or stolen, you should notify your bank "within two business days of discovering the loss or theft", which limits what you can owe to $50; after two business days, it says, "you could be responsible for up to $500 in unauthorized transactions." And whatever happened to the card, a statement starts a 60-day limit: if the card was lost or stolen and your bank sends a statement showing a withdrawal you didn't authorize, the CFPB says "you should notify them within 60 days"; if nothing was lost or stolen, it says "At the latest, you must notify your bank within 60 days" after it sends the statement showing the transaction you didn't authorize. If your bank asks you to confirm in writing, the CFPB says that if you don't do so within ten business days, the bank doesn't have to put the money back in your account for now while it looks into it. Either way, sooner is better: the less time passes, the less you can lose. If you're not sure which of these limits applies to you, don't wait for either: call your bank today.
• Bank account details: call your bank at the number on the back of your card or on your statement. Ask whether to close the account and open a new one, and ask them to watch for withdrawals, transfers or checks you didn't make. If a scammer used a password or code you gave them to take money out of your account, the CFPB says federal rules treat that as a transfer you didn't authorize, even though you shared the information. Report anything you didn't authorize as soon as you see it: for electronic transfers, the limits above apply, and for checks the CFPB's advice is to contact your bank as quickly as you can. If the check wasn't processed as an electronic transfer, it says, "you may have protections under state law." Those rules have time limits of their own, so don't wait.

I sent money

Contact the company you used to pay, right away, tell them it was a scam, and ask them to stop or reverse the payment. Find its number in its own app, on your receipt, or on its website, typed in yourself, not in a search result or an ad: the FTC warns, "Don't assume the phone number that comes up in search is legit." The FTC's guide, by payment method:

• Bank transfer or Zelle: tell your bank or credit union immediately and ask them to reverse the payment. For a transfer or wire out of your bank account, the FBI's advice is to "request a recall of the funds" right away.
• Credit or debit card: call the number on the back of your card and ask for a refund, then follow up in writing. For a credit card, send the written notice within the 60-day limit (see the time limits above) even though you made the payment yourself: the CFPB says that being charged for a purchase when you didn't receive what you ordered can be considered a billing error. For a debit card payment you made yourself, ask anyway.
• A payment app (such as Venmo, Cash App or PayPal): report it to the app company immediately and ask them to reverse the payment.
• A wire transfer company (such as Western Union or MoneyGram): tell them a scammer tricked you and ask for a refund.
• Gift cards: contact the company that issued the card, using the contact details on the card, and explain that a scammer got the card number and PIN. Keep the card and the receipt. Our gift card page has more.
• Cryptocurrency: contact the exchange or the crypto ATM company immediately, say the transaction was fraud, and ask them to reverse it. The FTC's guide to crypto scams says crypto payments typically aren't reversible, and its guide above adds that they don't have the legal protections cards do, but that some states have passed laws that might help you. So ask anyway, and report it.
• Cash sent by U.S. mail: contact the U.S. Postal Inspection Service immediately (the FTC's guide above lists its phone number). If you have the tracking number, the Postal Service may be able to intercept the package for a fee, but only before it's out for delivery, and USPS says the service isn't guaranteed. For FedEx or UPS, contact the carrier as soon as you can.

Cash or gold handed to someone at your door: don't agree to another pickup, whatever the caller says. The FTC says "it was a crime, so file a report with local law enforcement", so call your local police, and the FBI asks people to report it at ic3.gov as quickly as possible.

Speed matters. The FBI's 2025 report puts it simply: "If you discover a fraudulent transfer, time is of the essence." For money moved out of a bank account, its Recovery Asset Team works with banks to try to freeze it. In 2025 it did this in 642 cases involving people aged 60 and over (out of 201,266 complaints from that age group) and helped freeze $32.9 million of the $65.4 million reported lost in those cases. The FBI also says: "Regardless of the amount lost, file a complaint at www.ic3.gov."

I gave my Social Security or Medicare number

• If it's been used (a new account you didn't open, a tax return you didn't file), report it at IdentityTheft.gov. You'll get a personal recovery plan, free, from the FTC.
• If it hasn't been used, or you're not sure, follow the steps at IdentityTheft.gov/databreach.
• Get an Identity Protection PIN from the IRS. In the IRS's words, an IP PIN "is a six-digit number that prevents someone else from filing a tax return using your Social Security number". Anyone with a Social Security number who can verify their identity can get one, at irs.gov/ippin. The IRS says an IP PIN is valid for one calendar year and a new one is generated each year, and it must be used on any federal tax return you file that year, so give it to whoever prepares yours. If you get it online, the IRS says you'll need to get it online each year, because no notice with it will be mailed to you; it's generally available to view in your online account from mid-January through mid-November. The IRS adds: "The IRS will never ask for your IP PIN. Phone calls, emails or texts asking for your IP PIN are scams."
• If you gave your Medicare number: Medicare.gov says that if you think someone else is using it, call Medicare, and that if you feel you gave your personal information to someone you shouldn't have, you should contact the Federal Trade Commission.

Freeze your credit

A credit freeze is one of the strongest free protections there is. From the FTC's guide to credit freezes and fraud alerts: while a freeze is in place, nobody can open a new credit account in your name, including you. It's free to place and free to lift, lasts until you lift it, and doesn't affect your credit score. When you need to apply for credit, you can lift it for a while and put it back afterward.

You place a freeze separately with each of the three credit bureaus. Their pages also offer credit "locks" and monitoring, some of them in paid plans (Experian's page, for one, compares its free freeze with a lock "Included in a paid membership"). You don't need any of those for this: federal law says a bureau must place a freeze "free of charge."

• Equifax credit freeze
• Experian credit freeze
• TransUnion credit freeze

USA.gov's credit-freeze page links to each bureau's own instructions, if you'd rather start there. According to USA.gov, a freeze requested online or by phone must be in place within one business day, and a request to lift it online or by phone must be done within one hour.

A fraud alert is a lighter option you can use as well. It asks lenders to check that it's really you before opening credit. An initial alert is free and lasts one year; you place it with one bureau, which tells the other two. If your identity has been stolen, you can get an extended alert that lasts seven years, after you file an identity theft report at IdentityTheft.gov (or a police report). You can check your credit reports for free at AnnualCreditReport.com, which the FTC calls the only website authorized to fill orders for the free reports you're entitled to by law.

I let someone into my computer or phone

1. Disconnect. Turn off Wi-Fi or unplug the internet cable. On a phone or tablet, turn on Airplane mode, and check that Wi-Fi went off too: Apple says that if you've turned Wi-Fi on while in Airplane mode before, it may still be on.
2. If they could have seen your money, call about it now. If you opened any bank, card or investment account while they were connected, or they saw your account details, call that company now, at the number on the back of your card or on your statement, from a different phone if you can. Don't move any money a caller told you to move. The FBI's advice is to contact your financial institution as soon as fraud is recognized.
3. Next, take their program off. Microsoft's advice: "Uninstall any applications that scammers have asked you to install." That includes programs such as AnyDesk, TeamViewer, ScreenConnect or Quick Assist, if they had you open one. Security software often won't flag these, because they're real programs that companies use: the U.S. Cybersecurity and Infrastructure Security Agency notes that "The use of RMM software generally does not trigger antivirus or antimalware defenses." (RMM means remote monitoring and management, the kind of program these are.) Some run without being installed at all, as "portable executables," CISA says, so if they had you download a file and open it, delete that file too. If you're not sure how, ask someone you trust or the maker of your computer.

Then the FTC's steps, from "What To Do if You Were Scammed":

1. Update your security software. If you don't have any, the FTC suggests getting recommendations from independent review sites, friends and family.
2. Run a scan, and delete anything it flags.
3. Change your passwords and turn on two-step sign-in.
4. If you need help finding or removing something, ask the company that made your device, a company you know and trust, or a friend or family member who knows computers.

For Windows computers, Microsoft adds: "If you have given scammers access to your device, consider resetting it." A reset can erase your photos and documents, so back up your important files first: Microsoft's guide to recovery options in Windows warns that "Some recovery options can result in data loss." If you're not sure how, ask someone you trust to help.

We'd start the passwords with your email and your bank, because those are the ones that can unlock the rest, and we'd change them from a different device if you can, one the person never had access to.

Report it

Reporting helps even when the money can't be recovered: the FTC says it uses reports to build cases against scammers, and the FBI says its complaints help it "track trends and threats, and, in some cases, even freeze stolen funds." Report to both if you can.

• ReportFraud.ftc.gov, the Federal Trade Commission's reporting site, for any scam.
• ic3.gov, the FBI's Internet Crime Complaint Center, for scams that happened online, by text, by email or by phone. The FBI asks for as much detail as you have: names used, phone numbers, websites, email addresses, and the details of any payments. Type the address yourself; the FBI warns that fake versions of its site exist.
• Your state attorney general, which the FTC also suggests on its page about fake emergencies.
• A scam email or text: forward a phishing email to reportphishing@apwg.org, and a phishing text to 7726 (SPAM), as the FTC suggests. 7726 is a code for forwarding texts, not a number to call.
• The National Elder Fraud Hotline, if you're 60 or older or reporting for someone who is. It's a free Justice Department service; a case manager helps you report to the right places. Its number is on the Justice Department's page. The same page warns that scammers have pretended to be hotline staff, so be careful of anyone who calls you claiming to be from it.
• The site or app where it started. Dating sites, social networks and payment apps all have a way to report an account.

Watch for a second approach

People who've lost money are sometimes contacted again, by someone offering to get it back, for a fee or for your personal or financial details: a "law firm," a "recovery service," even someone claiming to be from the FBI or the FTC. The FBI says its complaint center doesn't keep a social media presence, never contacts people directly, and never charges to recover money. It adds that if more information is needed about a complaint, people will be contacted by FBI employees from local field offices or other law enforcement officers. If someone says they're from the FBI, you can check by calling your local FBI field office yourself, at a number you look up on fbi.gov, before you tell them anything.

Telling someone

It can feel hard to tell family. It's still worth it: talking it through helps you notice the next approach, and it helps them recognize the pattern too. Scammers rely on people keeping quiet. If you'd like something to share, our fridge sheet and wallet card put the main rules on one page.