What To Do in the First 24 Hours After a Scam

The first 24 hours after a scam are about containment. The immediate emergency — stopping contact and alerting your bank — buys you time; the rest of the day is for making sure the scammer can't do any more damage with what they already have. Work through it methodically, and remember that you don't have to do everything perfectly or all at once. Take breaks. Being scammed is disorienting, and a calm, ordered response beats a frantic one.

Start with your email account, even if the scam had nothing to do with email. Your inbox is the master key to almost everything else: whoever controls it can reset passwords for banking, shopping, and social media accounts. Change the password to something long and unique, turn on app-based two-factor authentication, and then check three things scammers commonly tamper with: forwarding rules (is mail being silently copied elsewhere?), recovery details (has a phone number or backup email been added that isn't yours?), and signed-in devices or sessions (sign out anything you don't recognise).

Next, deal with every account that was directly involved in the scam, and every account that shares the same password. Password reuse is how a single leaked login turns into five compromised accounts, so this is the moment to start using a password manager if you don't already. As you reset each password, enable two-factor authentication — an authenticator app is stronger than text messages where you have the choice.

With accounts secured, follow up with your bank. If you asked them to attempt a recall or stop a payment, call back and ask for the status and a case reference. Ask directly whether your situation may qualify for reimbursement — the answer depends on your country, your bank, and how the payment was made, and it costs nothing to ask. Go through your recent statements while you're at it and flag anything you don't recognise, however small: scammers sometimes test an account with tiny transactions before attempting larger ones.

Then report the crime. Report to your national fraud or cybercrime service, to the platform where the scam happened (dating app, marketplace, social network, job board), and to any other provider involved. Keep every reference number you're given in one place — reports create the official record that reimbursement claims, insurance, and later disputes may rely on. If you're unsure where to report in your country, our reporting directory can point you to the right channels.

Spend a few minutes thinking about who else could be affected. If the scammer had access to your contacts, email, or social media, they may already be messaging your friends and family pretending to be you. A short warning message — 'my account was compromised, ignore anything asking for money or codes' — protects the people around you. If work systems, a shared family account, or a joint bank account could be touched, tell the relevant people today rather than hoping it won't matter.

Finally, set your expectations for the days ahead. Assume any personal details you shared — name, address, date of birth, ID documents, card numbers — may be misused, and consider fraud alerts or a credit freeze if identity documents were involved. Expect follow-up contact: scammers often return under a new identity, sometimes posing as investigators, lawyers, or 'fund recovery' specialists who claim they can get your money back for a fee. That second approach is a scam every time it arrives unsolicited. Genuine help comes from your bank and official fraud services, and none of them charge victims upfront fees.

One more thing, because it matters: this was done to you by people who deceive others for a living. Feeling embarrassed, angry, or shaken is normal, and none of it means you were foolish. Tell someone you trust what happened. Victims who keep a scam secret are easier to target again; victims with support recover faster, both financially and emotionally.