If you paid a scammer, speed and organization matter more than embarrassment. This step-by-step recovery plan shows how to contact the right payment provider, secure exposed accounts, preserve evidence, report the incident, and monitor for follow-up fraud. It also gives you a reusable incident worksheet and checkpoints for the first hour, first day, and following weeks.
Overview
There is no guaranteed way to get money back from a scammer, particularly when a payment was authorized, converted to cryptocurrency, sent by wire, or transferred through a person-to-person service. However, reporting the payment quickly can improve the chance that a provider can review, freeze, reverse, or investigate it. The correct response depends on how you paid and what information you shared.
Start by stopping further contact and payments. Do not send a second payment to unlock a refund, pay a supposed tax, or verify your account. Scammers often change identities after the first loss, presenting themselves as lawyers, investigators, recovery specialists, platform employees, or customer-support agents. A request for an upfront recovery fee is a strong warning sign.
Use only contact details found in the payment provider’s official app, statement, or website that you type into your browser yourself. Do not use a phone number, QR code, button, or link supplied by the scammer. If the incident involved a suspicious website, review how to check if a website is legit before returning to it.
What to track
1. Payment and platform details
Record each transaction separately. Your incident worksheet should include:
- Date, approximate time, amount, currency, and payment method.
- Transaction, confirmation, order, wallet, or reference numbers.
- The recipient name, username, email address, phone number, wallet address, account number, or merchant descriptor shown by the provider.
- The platform where contact began, such as a marketplace, social network, dating app, messaging service, or investment site.
- The exact reason given for payment and what the scammer promised in return.
- Whether you shared passwords, identity documents, card details, bank information, one-time codes, or remote access.
Save screenshots, emails, text messages, invoices, profiles, advertisements, websites, shipping claims, and call records. Keep the original files where possible and do not edit screenshots. If a page may disappear, save its address and take a screenshot showing the account name, date, and relevant claim. These records help a bank, payment service, marketplace, or investigator understand the sequence of events.
2. The provider-specific response
Use this checklist for the payment route involved:
- Credit or debit card: Call the card issuer using the number on the card or statement. Explain that the payment was connected to fraud and ask what dispute, replacement-card, or account-security process applies.
- Bank transfer or wire: Contact the sending bank’s fraud department immediately. Ask whether a recall, cancellation, recipient-bank notification, or account review is possible. A recall is not guaranteed, so record the case number and any deadline the bank gives you.
- Payment app or digital wallet: Report the transaction inside the official service and contact its support channel. Include the transaction ID and explain whether the recipient account impersonated a person, business, or platform.
- Gift card: Contact the gift-card issuer through its official support route, keep the card and receipt, and provide the card number only through that verified channel. Do not share remaining codes with anyone who contacts you unexpectedly.
- Cryptocurrency: Notify the exchange or wallet provider used to send the funds. Provide the transaction hash, destination address, date, and related messages. Blockchain transfers may be difficult or impossible to reverse, but a provider may still record the report or identify activity within its service.
- Marketplace or social platform: Report the seller, profile, listing, message thread, advertisement, or impersonation account. Do not delete the conversation before saving evidence.
For marketplace-specific checks, see Facebook Marketplace scams: how to check a seller before you pay. If the scam began with an email or text, use the verification steps in this phishing message checklist.
3. Account and identity exposure
Change any compromised password from a clean, trusted device. Start with email, banking, payment, social, and password-manager accounts because control of your email can allow other accounts to be reset. Use unique passwords and turn on multifactor authentication where available. Sign out of unfamiliar sessions, remove unknown recovery methods, and check whether forwarding rules or new payment recipients were added.
If you sent identity documents, tax details, account credentials, or one-time codes, treat the event as an identity-risk incident rather than only a lost-payment problem. Watch for unfamiliar account activity, password-reset messages, new credit inquiries, bills, orders, or official-looking notices. The identity theft warning signs guide provides a separate review list.
Cadence and checkpoints
First hour
- Stop communication and do not make another payment.
- Contact the bank, card issuer, transfer service, or wallet provider through an official route.
- Ask whether the payment can be stopped, recalled, disputed, or escalated to fraud review.
- Secure the email and financial accounts connected to the payment.
- Preserve messages, receipts, account details, and website evidence.
First day
Complete reports to the relevant platform and payment provider. Ask for a case or reference number and write down the date, department, representative, and next promised step. If personal information was exposed, review account statements and consider appropriate credit or identity-protection measures available in your country. If a device was accessed remotely or a suspicious app was installed, disconnect it from sensitive accounts, remove the software only after preserving necessary evidence, and run a trusted security check. See how to check if an app is safe or fake for prevention guidance.
Following weeks
Check transaction history, bank alerts, email forwarding, login activity, mobile-account changes, and credit records on a regular schedule. Watch for small test charges and messages claiming that your original case is ready for a refund. Keep every case number and response together. If a provider denies a claim, read the explanation and ask what documentation or review route is available rather than arguing with an unknown caller.
How to interpret changes
A payment marked as pending may still be worth reporting immediately; do not wait for it to settle. A reversed or credited transaction does not necessarily mean the issue is finished, because a provider may later review the transaction or a scammer may attempt another charge. New login alerts, password-reset notices, unfamiliar recipients, or messages from a supposed recovery agent should be treated as new warning signals.
Separate confirmed facts from assumptions in your worksheet. For example, record that a transfer was sent to a specific account, but avoid stating that the recipient is arrested or that recovery is certain unless an official provider confirms it. This makes your report clearer and helps prevent persuasive follow-up claims from changing your decisions.
Be especially cautious when someone uses information from your original complaint to sound credible. A recovery scammer may know the amount lost, the payment method, or the name of the platform. Verify every contact independently through the provider’s official website or app. For tactics involving promised chargebacks or customer support, review refund scam tactics.
When to revisit
Revisit this plan after every new payment, account alert, or message connected to the incident. During the first month, review the worksheet at least weekly or according to the deadlines given by your bank or payment provider. After that, a monthly check is sensible while a dispute, identity concern, or account investigation remains open. Update the worksheet whenever a provider changes the case status, requests evidence, issues a credit, or closes the review.
Use this practical closing checklist before marking the incident complete:
- Every payment has been reported through an independently verified provider channel.
- Case numbers, screenshots, receipts, and contact notes are stored in one secure location.
- Email, banking, payment, social, and marketplace accounts have been reviewed and secured.
- Exposed identity information is being monitored for unfamiliar activity.
- No one is being paid to recover the funds without independent verification and clear written terms.
- A follow-up date is recorded for the next account and dispute review.
Reporting a scam payment may not undo the loss, but prompt action can limit additional damage and create a clearer record for providers. Return to this worksheet whenever the scammer contacts you again, a new transaction appears, or the payment platform changes the status of your case.
