What to do if you've been scammed online
Paid a fake shop or typed your password into a fake page? What to do in the first hour, how to secure evidence, how to approach your bank, where to report it and how to avoid the follow-up scams.
Realising you've been scammed is a horrible feeling. Most people feel embarrassed first and act second. Please do it the other way round: the first hour matters more than anything else, and the steps below are the same whether you lost 30 or 3,000. Scammers are professionals. Falling for one says nothing about your intelligence.
Work through this guide from top to bottom. Skip the parts that don't apply to you.
The first hour: stop the damage
1. Contact your bank or card provider immediately
Call the number on the back of your card or in your banking app, not a number from an e-mail or text message. Tell them:
- that you have been the victim of a scam, and when it happened
- the amount, the date and the recipient (shop name, account details or wallet address)
- whether you paid by card, bank transfer, PayPal or another method
- whether you shared card details, an online banking login or a one-time code
Ask them to block the card if the details were exposed, to stop any pending payments and to tell you which dispute or recall options exist. Speed matters most with bank transfers: the sooner your bank contacts the receiving bank, the better the chance the money is still there.
2. Change passwords you may have exposed
If you typed a password into a fake login page, change it now on the real website, which you should open by typing the address yourself. Then change it everywhere else you used the same password. Start with your e-mail account, because whoever controls your e-mail can reset everything else.
Turn on two-step verification (an app or a security key is better than SMS) for e-mail, banking, PayPal, Amazon and social media.
3. Disconnect remote access
If someone talked you into installing a program such as a remote desktop tool, disconnect the computer from the internet, uninstall the program and run a full scan with your security software. If you're not comfortable doing that, ask a trusted local repair shop. Then change your passwords from a different device. Our guide to tech support scams explains this situation in more detail.
4. Stop talking to the scammer
Don't reply, don't threaten, don't negotiate. Scammers often follow up with excuses ("your parcel is stuck in customs, just pay the fee"), and some come back months later pretending to be a lawyer or agency that can recover your money for a fee. That is a second scam, called a recovery scam.
The first day: secure the evidence
Before anything gets deleted, collect what you have. Banks, the police and payment providers will ask for it.
- Screenshots of the website, product pages, checkout and any confirmation page
- The full web address of the site (copy it from the address bar)
- E-mails, texts and chat messages, including the sender's address or number
- Payment records: bank statement line, card transaction, PayPal transaction ID, crypto transaction hash
- Order numbers and tracking numbers, even if the tracking is fake
- A short timeline in your own words: what happened, when, in which order
Save everything in one folder. Don't edit the screenshots. If the website disappears, which scam shops often do within weeks, your screenshots may be the only proof it existed.
Getting your money back
What's possible depends almost entirely on how you paid:
| How you paid | What to ask for |
|---|---|
| Credit card | A chargeback through your card issuer |
| Debit card | A chargeback; protection varies by bank and card scheme |
| PayPal (goods and services) | A Buyer Protection claim in the PayPal Resolution Center |
| Bank transfer | An urgent recall request; in the UK, a reimbursement claim for an authorised push payment scam |
| Direct debit (SEPA) | A refund through your bank |
| Crypto or gift cards | Contact the exchange or card issuer immediately; recovery is rare |
Time limits apply to all of these, and they differ by bank, card network and country. We explain each option, with realistic expectations, in How to get your money back after an online scam.
Be honest with your bank about what happened, including if you authorised the payment yourself. Saying it was "not you" when it was can cost you the claim.
Report it to the police
A police report helps in several ways: your bank may ask for it, it creates an official record if your identity is misused later, and it lets investigators connect your case with others. Most countries let you report online fraud online:
- United States: the FBI's Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov
- United Kingdom: Action Fraud at actionfraud.police.uk for England, Wales and Northern Ireland; in Scotland, Police Scotland on 101
- Germany: the online police station (Onlinewache) of your federal state, or any local police station
- Canada: your local police and the Canadian Anti-Fraud Centre
- Australia: Scamwatch and ReportCyber
Our guide How to report a scam website lists the right places country by country, including where to report the website itself so it can be taken down.
Warn others
Scam sites rely on new victims who don't know about the ones before them. A report takes a few minutes and can save someone else:
- Report the website on websurely.com. Once a moderator confirms the report, it raises the site's Scam Score, and every visitor checking that site sees the warning. You need a free account; no e-mail address required.
- Report it to the platform where you found it: the social network that showed you the ad, the marketplace or the search engine.
- Report phishing pages to your browser's safe-browsing service so they get blocked for everyone.
You can see what others have reported recently on our list of latest scam websites. If your loss involved tickets for a concert or a match, our guide to fake ticket websites has advice specific to that.
Watch out for the follow-up
In the weeks after a scam, be extra careful:
- Recovery scams: messages promising to get your money back for an upfront fee. Real police and banks don't charge you to recover stolen money.
- Identity misuse: if you shared ID documents or personal data, watch your bank statements and consider asking your bank or a credit reference agency about fraud alerts.
- More phishing: your e-mail address or phone number may now be on a list. Expect more fake messages, and don't click links in them.
Look after yourself
Losing money to a scam can be distressing, and it is common to feel ashamed. Talk to someone you trust. Victim support organisations exist in many countries, and the police can point you to them. You did nothing wrong by trusting; the people who lied to you did.
Next time: check before you pay
Most scam websites can be spotted before you pay, if you know what to look for. Our step-by-step checklist for checking a website takes about five minutes. The free websurely.com browser extension shows the rating of every site you visit, so you get a warning before you reach the checkout.
Check a website now
Want to know whether another site is safe? Paste the link on websurely.com for a free Scam Score in seconds.
This article is general information, not legal or financial advice. If you have been scammed, contact your bank or payment provider immediately and report it to the police.