I've been scammed: what should I do in the first 30 minutes?

If you have been scammed, call your bank now, on the number printed on your card or shown in the bank’s official app, and ask them to block your cards and stop any payment that has not gone through yet. That call matters more than anything else in the first 30 minutes. Then secure your email, keep the evidence and report it.

Anyone can be fooled: scams are built to sound like your bank, a shop or someone you trust.

Do this now

1. Call your bank or card provider. Use the number on the back of your card, your statement or the bank’s official app, never one from the message or call you received. The US Federal Trade Commission (FTC) says to report it “immediately” and ask for the payment to be reversed.
2. Block every card the scammer knows. Ask for it on the same call, card by card. For Postepay and other prepaid cards, the blocking numbers are below.
3. If the scammer had access to your phone or computer, disconnect it from the internet. ANZ, an Australian bank, gives this as the first step.
4. Change your passwords from a device the scammer never touched, starting with your email. ANZ, the Australian bank quoted in step 3, advises changing passwords “on a separate device”. The UK National Cyber Security Centre (NCSC) explains why email comes first: criminals use it to reset your other passwords.
5. Keep the evidence. Save the messages, emails, call times, web addresses, receipts and statements, and do not delete the chat. The FBI’s Internet Crime Complaint Center (IC3) asks victims to keep original records in a safe place, because investigators may ask for them.
6. Report it. To the police and to the national reporting service of your country: the boxes below give the official links and numbers.
7. Warn the people who might be next. If your account was used, tell your contacts to ignore recent messages from it, as the NCSC advises. Tell your family too: the UK Financial Conduct Authority (FCA) notes that people who have been scammed are at greater risk of being targeted again.
8. Ignore anyone who offers to get your money back for a fee. The FTC warns that “government agencies and legitimate organizations will never ask for money to help you get a refund”.

I gave my card details, or my card was used: what now?

Call the bank or card provider, block the card and list the payments you did not make. A payment you did not authorize is treated differently from one you made yourself after being tricked, so say exactly what happened: what you typed, which codes you gave and to whom.

The rules on what you can lose depend on the country:

• Italy. Under the Italian law on payment services, the bank must refund a payment you did not authorize by the end of the next business day at the latest (article 11), unless, on a well-founded suspicion of fraud, it suspends the refund and reports it at once in writing to the Banca d’Italia. You must tell the bank without delay and in any case within 13 months of the debit (article 9). Once you have told the bank, later misuse costs you nothing; before that, you may bear up to 50 euros, or everything if you acted fraudulently or were seriously careless, which the law calls gross negligence (article 12).
• Elsewhere in the EU. The European Commission’s Your Europe page says you can be asked to pay at most 50 euros towards fraudulent payments, and nothing if you could not have known about the theft or misuse.
• US. The FTC explains that on a credit card the most you might pay is $50, and nothing if only your card number was used. On a debit card it depends on speed: $50 if you report within two business days, up to $500 after that, and possibly everything taken if you report more than 60 days after your statement is sent.
• UK. Tell the bank at once and ask for the payments you did not make to be refunded. The complaint route is in the UK box below.

I sent a bank transfer or an instant transfer: can it be stopped?

Call the bank immediately, tell them the payment went to a scammer and ask them to stop or reverse it, as the FTC advises for transfers and Zelle. Do not wait to be sure: the bank can only try to stop what it knows about.

What the bank owes you differs by country. In Italy the refund rule in article 11 is written for payments you did not authorize: if you made the transfer yourself because someone deceived you, the bank looks at your case, and in a dispute the ABF decides. Details are in the country boxes below.

I paid with PayPal or another payment app: what can the app do?

Report it inside the app or on the service’s own website, from its help or dispute section, and ask the company to reverse the payment and refund you, as the FTC advises. For PayPal, the FTC points to the Resolution Center; for Cash App and Venmo, to the chat inside the app. If the app is linked to your card or bank account, call the bank as well. The company decides whether to refund.

I paid with a prepaid card such as Postepay: how do I block it?

Block the card first. Poste Italiane’s help page says to use the “blocco carta” function on its site; if the card does not appear there, call 800 00 33 22 from Italy or +39 06 45 26 33 22 from Italy and abroad. Then ask Poste Italiane to refund the payments you did not authorize: the Italian rules in the card section above are written for payment instruments in general, and the same complaint route through the Banca d’Italia and the ABF is open.

For other prepaid cards, use the number on the back of the card or in the issuer’s official app.

I paid in crypto or with gift cards: is there anything to do?

Act fast, even though the odds are lower:

• Gift cards. Contact the company that issued the card, using the number on the back of the card. Tell them a scammer made you share the card number and PIN, and ask for a refund. Keep the card and the receipt. These are the FTC’s steps.
• Crypto. Contact the exchange or the crypto ATM operator you used, say the transaction was fraudulent and ask them to reverse it. The FTC warns that crypto payments “don’t have the same legal protections as credit and debit cards do”. Save the transaction details the exchange shows you.

I gave away a password or a code: which account comes first?

Start with your email, because it can reset almost everything else. The NCSC’s order is: check the email account for forwarding rules and filters the criminal may have added, change the password of every hacked account and of any account that used the same password, log out all other devices, and turn on two-step verification, the extra code that makes a stolen password useless on its own.

If you gave someone a code that your bank sent you, call the bank first and tell them which code and when. If you can no longer log in to an account, use that service’s own recovery page, as the FTC advises, and never a recovery “service” that contacts you.

I let someone control my phone or computer: what now?

Disconnect the device from the internet, then call your bank if the scammer could see your banking app or your card details. Microsoft’s advice after a fake support call is to uninstall any app the scammers asked you to install, run a full security scan, change your passwords and consider resetting the device. The NCSC says that for phones and tablets “the safest solution is to do a factory reset”. A reset wipes the device, so first save the messages and files you need as evidence (step 5); Victoria Police in Australia also advises saving important files to external storage before a reset.

I sent a photo of my ID: what can I do?

Include it in your police report with the rest of the scam, and tell your bank. In the US, if you also gave your Social Security number, the FTC sends you to IdentityTheft.gov for a report and a recovery plan if it has been used, and to its protection steps if it has not or you are not sure. In Italy you can ask the Banca d’Italia for your own record in the Centrale dei Rischi, its database of what people owe to banks and finance companies: the request is free and the answer usually comes within 30 days.

Where do I report it, and who decides about a refund?

Report to the police even if the amount is small.

If you are in Italy

• Bank and complaint. The Banca d’Italia’s page for scam victims lists the steps: tell the bank at once, report the crime to the Polizia Postale, then send the bank a written complaint (reclamo). For payment services the bank must reply within 15 business days. If the answer does not satisfy you, you can send a complaint (esposto) to the Banca d’Italia through its online services.
• ABF. The Arbitro Bancario Finanziario, an out-of-court dispute body supported by the Banca d’Italia, decides disputes with banks. You must first complain to the bank, then apply online within 12 months of that complaint. It costs 20 euros, refunded by the bank if you win even in part, covers claims up to 200,000 euros and needs no lawyer. Its decisions are not binding: either side can still go to court.
• Police. A formal complaint (denuncia) is made at a police office; the Polizia Postale’s Segnala online form is for reports and does not replace it. An online pre-complaint on denunceonline.poliziadistato.it, with SPID or CIE, is still a trial at a few offices in Lazio and must be confirmed in person, by appointment, within 48 hours. If the scam is still happening, call 112 or 113.

If you are in the UK

• Report. In England, Wales and Northern Ireland, report to Report Fraud (formerly Action Fraud), the national service that replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, the FCA says to call Police Scotland on 101 or Advice Direct Scotland on 0808 164 6000.
• Bank transfers. The Payment Systems Regulator’s reimbursement protections cover people tricked into sending money by Faster Payments or CHAPS between UK accounts since 7 October 2024. Claims go to your bank within 13 months of the payment, up to £85,000. The bank may deduct an excess of up to £100 (not for vulnerable customers) and should pay within five business days, or reach an answer within 35 business days if it needs more information. It can refuse if you took part in the fraud or were seriously careless (the second reason does not apply to vulnerable customers).
• If the bank says no. For fraud and scam complaints the bank has 15 days to reply. Then you can go to the Financial Ombudsman Service, free, within six months of the bank’s final response.

If you are in the US

• Report. To the FTC at ReportFraud.ftc.gov, and for crimes that happened online to the FBI’s IC3 at ic3.gov, which says it never works with law firms or crypto services to recover money.
• If the bank or payment company refuses. You can send a complaint through the Consumer Financial Protection Bureau (CFPB), which forwards it to the company; most companies respond within 15 days.

Elsewhere

Report to the police of your country and call your bank first, as everywhere. If you paid a shop in another EU country, the European Consumer Centre where you live can help. For the official channels in 36 countries, see where to report a scam.

Will I get my money back?

Nobody can promise it. Crypto, gift cards and cash are the hardest to recover.

Speed helps in every case: the sooner the bank knows, the more it can stop. A refusal is not always the last word: that is what the ABF, the Financial Ombudsman Service and the CFPB route are for. For large amounts, a consumer association or a lawyer can advise you. And anyone who offers to recover the money for a fee, even claiming to be from the police or a regulator, is very likely running a second scam.

How should I feel, and what do I tell my family?

Feeling shaken, angry or ashamed is normal, and it does not mean you were careless. Talking about it helps you think clearly and gets the reporting done. In England and Wales, Victim Support offers free help to fraud victims through its Supportline, 08 08 16 89 111, and a 24/7 live chat, and you do not need to have gone to the police to use it.

Tell your family what happened in plain terms: what the message or call looked like, what you were asked to do, and that the bank has been told. It protects them, because the same people may try them next, and it protects you, because scammers may come back with a new story. Agree that nobody in the family will move money or share a code because of an unexpected call or message without first calling the bank on the number they already know.

Where to go next

• How to tell if an online shop is real before you pay covers the checks to run before paying a shop you do not know, and what to do if the goods never arrive.
• Where to report a scam gives the official police, fraud and consumer channels in 36 countries, with what to prepare.
• Is this text a scam? shows how to spot the fake bank, parcel, toll and fine messages, and what to do if you clicked.
• How to protect yourself from online scams is the complete guide, updated every month.

Common questions

I got scammed, what do I do?

Call your bank or card provider first, using the number on your card or in the bank's official app, and block any card the scammer knows. Then change your email password, keep the messages and receipts, and report the scam: to the Polizia Postale or another police office in Italy, to Report Fraud (formerly Action Fraud) in England, Wales and Northern Ireland, to Police Scotland on 101 in Scotland, and to the FTC at ReportFraud.ftc.gov in the US.

I sent money to a scammer, can I get it back?

Sometimes, and it depends mostly on how you paid and how fast you tell your bank. Payments you did not authorize, such as card payments made by a scammer, have the strongest legal protections. In the UK, bank transfers to a scammer made since 7 October 2024 are covered by a reimbursement rule up to £85,000. Crypto, gift cards and cash are much harder to recover, and anyone who promises to get the money back for a fee is likely another scammer.

Will my bank refund me if I get scammed?

The bank decides, case by case. For payments you did not authorize, the law limits what you can lose: in Italy and the rest of the EU unless you acted fraudulently or with gross negligence, in the US depending on how fast you report it. If the bank says no, you can complain to it and then go to a free dispute service: the ABF in Italy, the Financial Ombudsman Service in the UK, or a complaint through the CFPB in the US.

What should I do if I gave my bank details to a scammer?

Call your bank straight away on the number on your card or in its official app, tell them exactly what you shared, and ask them to block the card or the online access. Then change your online banking and email passwords and watch your statements. If money has already left your account, ask the bank to try to stop or reverse the payment and report the scam to the police.

How do I report a scammer to the police?

In Italy, file a complaint (denuncia) at a Polizia Postale or other police office; the Polizia Postale online form is for reports, not complaints. In England, Wales and Northern Ireland report to Report Fraud at reportfraud.police.uk or 0300 123 2040; in Scotland call Police Scotland on 101. In the US report to the FTC at ReportFraud.ftc.gov and, for crimes online, to the FBI's IC3 at ic3.gov.

Can I get my money back from Zelle, Venmo or Cash App if I was scammed?

Report it at once: for Zelle to your bank or credit union, for Venmo, Cash App or PayPal inside the app or on its official website, and ask them to reverse the payment and refund you, as the FTC advises. Whether they refund is their decision. If the bank or company refuses, you can send a complaint through the CFPB, which forwards it to the company.

Share this article

• LinkedIn
• X
• Bluesky
• Facebook
• WhatsApp
• Email

Topics: scams, money back, reporting, everyday questions