Being scammed can make every next step feel urgent and confusing. This recovery checklist helps you contain the damage, protect your accounts, preserve useful evidence, challenge payments where possible, report the incident, and monitor for identity-theft warning signs over the weeks that follow.
Overview
After a scam, speed matters, but panic can lead to further mistakes. Do not send more money to someone who promises to recover your funds, and do not continue a conversation simply because the scammer claims that a deadline is approaching. Treat every follow-up message, phone call, refund offer, or “verification” request as potentially connected to the original fraud.
Your recovery plan has five goals:
- Stop further contact and transactions. End the conversation, close the suspicious page, and avoid clicking additional links.
- Secure exposed accounts and devices. Change credentials, revoke access, and check for unauthorized activity.
- Contact the payment provider quickly. Ask about cancellation, dispute, recall, or other available options without assuming recovery is guaranteed.
- Preserve evidence and report the scam. Save messages, receipts, account details, URLs, and timelines before deleting or blocking anything.
- Monitor for delayed damage. Watch financial accounts, email, social profiles, credit activity where available, and important identity documents.
If you shared highly sensitive information, lost control of an account, or allowed remote access to a device, prioritize account and device security before investigating the scam in detail. A useful companion guide is What to Do After a Phishing Scam.
What to track
1. The incident timeline
Write down what happened while the details are fresh. Record the date and approximate time of the first contact, the platform used, the sender’s username or phone number, the claims made, links opened, information shared, payments sent, and any action taken afterward. Include the names of businesses or accounts the scammer impersonated.
A simple timeline is more useful than a long emotional account. Keep the original wording of important messages, but label your own notes clearly. Do not edit screenshots in a way that removes dates, usernames, addresses, or transaction references.
2. Payment and transaction status
Make a list of every payment connected to the incident. Include the amount, date, payment method, recipient details, transaction ID, and whether the payment is pending, completed, reversed, or disputed. Contact the provider using an official app, statement, or website—not a phone number supplied by the scammer.
The correct request depends on the method used. You might ask a bank about an unauthorized transfer, a card provider about a transaction dispute, a money-transfer service about a cancellation, or a cryptocurrency platform about account security and transaction tracing. Explain exactly what happened and ask what documentation is required. Avoid describing a payment as unauthorized if you personally approved it after being deceived; provide an accurate account instead.
3. Account access and password exposure
Track every account that may be at risk, including email, banking, payment services, shopping accounts, social media, cloud storage, work systems, and cryptocurrency services. Change passwords from a trusted device, starting with your primary email because it may be used to reset other accounts. Use a different, unique password for each important account.
Review recent sign-ins, recovery email addresses, phone numbers, forwarding rules, connected apps, active sessions, and multi-factor authentication settings. Sign out unfamiliar sessions and remove access you do not recognize. If the same password was reused elsewhere, change those accounts too. For account takeover warning signs, see Account Takeover Warning Signs.
4. Personal information exposed
Note exactly what you shared: name, address, date of birth, identity-document details, tax information, passwords, security codes, card numbers, bank details, or a photograph of an identity document. The response should match the exposure. A leaked password calls for password changes and session review; exposed payment details may require a provider notification; exposed identity information calls for longer-term monitoring and advice from relevant official services.
5. Device and download changes
If you installed an app, opened a suspicious attachment, scanned a questionable QR code, or granted remote access, disconnect the device from sensitive activity until you can check it. Remove software you do not recognize, update the operating system and security tools, and review browser extensions and notification permissions. Change passwords from a separate trusted device if you suspect the original device was monitored. Do not reinstall an app merely because a pop-up claims your device is infected. The Fake App Warning Guide covers safer download checks.
6. Evidence and reports
Keep screenshots, emails with full headers when available, message exports, call records, payment receipts, wallet addresses, website URLs, profile links, and names used by the scammer. Save them in a clearly labeled folder and keep a backup that the scammer cannot access. Report the account, listing, message, website, or app through the platform’s official reporting process. You can also use How to Report a Scam to organize the reporting steps.
Cadence and checkpoints
Recovery is not one task completed on one day. Use a staged schedule, adjusting it to the seriousness of the exposure.
Immediately: contain the incident
- Stop replying and do not pay a second fee to unlock, verify, or recover anything.
- Contact the bank, card issuer, payment service, marketplace, or cryptocurrency platform through an official channel.
- Secure your email and other high-value accounts.
- Save evidence before blocking or deleting the scammer’s account.
- If you are in immediate physical danger or believe a device or account is actively being controlled, seek appropriate emergency or official support.
Within the next few days: verify changes
- Review recent transactions and pending payments.
- Check account recovery settings, active sessions, email forwarding, and connected applications.
- Scan for unfamiliar apps, browser extensions, remote-access tools, and downloads.
- Complete platform and consumer-protection reports, noting confirmation numbers.
- Tell a trusted person what happened if you need help reviewing messages or monitoring accounts.
Weekly for the first month: monitor and document
Review financial activity, login alerts, password-reset notices, social-media changes, and messages from supposed investigators or recovery agents. Add each new event to your timeline. If a provider asks for more information, respond through its verified channel and keep a copy of what you submit.
Monthly or quarterly: reassess exposure
For identity information, account credentials, or sensitive business data, maintain a recurring review for as long as the information could be misused. Check whether contact details, recovery methods, or authorized devices have changed. Review privacy settings and remove old connected apps. If you publish online, examine impersonation reports and unusual messages sent from your creator or business accounts.
How to interpret changes
Not every unexpected message proves that an account has been compromised, but patterns deserve attention. A single failed login may be harmless; repeated password-reset emails, unfamiliar successful logins, changed recovery details, new payment recipients, or messages sent without your knowledge are stronger warning signs.
Separate the incident into three categories: confirmed activity, such as a transaction you did not make; possible exposure, such as sharing a password or identity document; and unverified claims, such as a caller saying your account is at risk. Take action on confirmed activity, reduce risk from possible exposure, and independently verify unverified claims.
Be especially cautious when someone contacts you after the original scam. Recovery scams often use details from the first incident to sound credible. A legitimate provider should not require you to send a gift card, cryptocurrency, remote-access session, login password, or one-time security code to recover funds. When in doubt, end the conversation and start a new one through the provider’s official contact route. Also avoid clicking “refund” links in unsolicited messages; read Refund Scam Tactics before responding.
If you gave someone remote access, treat the device as potentially exposed rather than relying only on a quick antivirus scan. Change credentials from a clean device, review financial accounts, and consider professional technical help from a source you selected independently. If identity documents or account credentials were exposed, document the steps you take and continue monitoring for new warning signs.
When to revisit
Revisit this checklist whenever a new message, login alert, transaction, account change, or contact from a supposed recovery specialist appears. Return to it weekly during the first month after a serious incident, then monthly or quarterly while exposed information remains relevant. Update your notes when a payment changes status, a provider requests evidence, an account is restored, or a report receives a response.
Use this printable-style checklist as a final review:
- ☐ I stopped communicating with the suspected scammer.
- ☐ I contacted every relevant payment provider through an official channel.
- ☐ I recorded payment details, reference numbers, and the incident timeline.
- ☐ I changed exposed or reused passwords and enabled stronger sign-in protection where available.
- ☐ I reviewed active sessions, recovery details, forwarding rules, and connected apps.
- ☐ I checked the device for suspicious downloads, extensions, and remote-access software.
- ☐ I preserved messages, screenshots, URLs, profiles, receipts, and other evidence.
- ☐ I reported the scam to the relevant platform and appropriate official channels.
- ☐ I scheduled recurring checks for transactions, logins, identity activity, and impersonation.
- ☐ I will ignore unsolicited recovery offers and verify every follow-up independently.
Recovery may not reverse every loss, but organized action can limit further damage and make follow-up more effective. Keep the checklist with your account records, revisit it on a monthly or quarterly schedule, and update it whenever the facts of the incident change.
