Skip to content
Scams

Scammed online: your first moves after financial fraud

Investment platforms that vanish, "support" that drains accounts, a relationship that turned into transfers. Recovery depends on speed and evidence — not confrontation.

Scammed online: your first moves after financial fraud — Response Red advisory illustration

The essentials

  • Stop all further payments immediately — including "release fees", "taxes", or "verification deposits" to withdraw your money. Those are the same scam continuing.
  • Call your bank or card issuer about recalls and chargebacks the same day; for crypto, record transaction hashes and report — tracing is possible, reversal is rare.
  • Do not confront the scammer or reveal that you know. Silence preserves accounts and evidence.
  • Anyone who contacts you offering to recover your lost money is almost always a second scam.
  • Capture everything now — profiles, chats, and platforms are deleted overnight.

Modern scams are not crude. Investment platforms show you real-looking dashboards with fake profits. "Account managers" chat with you for months. The pressure to keep paying — fees, taxes, unlock charges — is part of the same script, engineered by teams who do this professionally.

If you have just realized what happened: the money already sent is at risk, but what you do in the next hours decides whether any of it can be traced or frozen, and whether the scam keeps running on you.

Do this now

  1. Cut every payment channel. Stop transfers, block the card used, and tell your bank it was fraud — ask about recalls and chargebacks. If crypto was involved, write down wallet addresses and transaction hashes for every transfer.
  2. Capture the evidence before it vanishes. Screenshot the platform, profiles, and conversations. Export chats where possible. Save URLs, usernames, phone numbers, and account details. Scam infrastructure disappears fast once victims stop paying.
  3. Report it the same day. File with your bank, the platform where contact began, and law enforcement (IC3 in the US, Action Fraud in the UK, or your national service). If an exchange handled your crypto, report the destination addresses to it as well.
  4. Check what else they were given. If you shared identity documents, follow the identity-theft steps too. If you installed anything at their request — especially remote-access software — treat that device as compromised until it is cleaned.
  5. Tell someone you trust. Scams run on isolation. Telling one person — family, a friend, your accountant — breaks the script, protects you from re-approach, and makes the next steps easier to face.
  6. Get professional help for large or business-linked losses. Where losses are substantial or touched company systems and accounts, professional investigation can trace funds, establish the intrusion's scope, and produce the evidence banks and courts need.

What not to do

  • Do not pay anything further to "unlock", "verify", or "release" your funds.
  • Do not hire recovery services that advertise to scam victims or contact you directly.
  • Do not confront the scammer or post publicly before evidence is captured.
  • Do not delete the conversation history, however much you want to.
  • Do not keep it secret from the people who will eventually need to know — secrecy is the scam's oxygen.

Preserve the evidence

Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:

  • Full chat exports and screenshots including usernames, handles, and dates.
  • Payment records: transfers, card statements, receipts, wallet addresses, transaction hashes.
  • URLs of the platform and any apps you were told to install.
  • Emails, phone numbers, and social profiles used to contact you.
  • Your own timeline: first contact, each payment, and when suspicion began.

Keep a clear head

The shame you likely feel was designed. These operations build genuine-feeling relationships precisely so that discovery feels like personal failure — that is what keeps victims silent and keeps the scheme alive. You were run through a professional script; intelligence and caution are not defenses against a process built to defeat both.

Losses of this kind can produce grief-like waves — disbelief, anger, bargaining. That is a normal response to an abnormal event. If the weight persists, talk to a professional; financial fraud is recognized as a genuinely traumatic experience.

Questions victims ask

Can I get my cryptocurrency back?

Direct reversal is rare — crypto transfers are final. But transactions are traceable, and funds often land at exchanges where law enforcement can freeze accounts. Fast reporting with exact transaction hashes gives tracing its best chance.

Why shouldn't I confront them? I want them to know I know.

Confrontation triggers deletion: profiles, chats, and platforms vanish within hours, taking your evidence with them. It can also mark you for "recovery" re-targeting. Go quiet, capture everything, and let investigators make contact on their terms.

Is my computer or phone compromised too?

If you installed anything at the scammer's request — especially remote-access tools like AnyDesk or TeamViewer — assume yes. Disconnect it, change important passwords from a different device, and have it professionally checked before trusting it again.

When the first hour is over, we take it from there.

Scoping, containment, forensics, and recovery — expert-led and evidence-safe, with AI removing the waiting. Engage a responder or talk to us about readiness.