Scammed Online? What to Do in the First Hour, Step by Step

Why does the first hour after a scam matter so much?

When money leaves your account through a scam, it rarely stays where it landed. Criminal groups move it quickly through chains of mule accounts, split it into smaller amounts, withdraw it as cash or convert it to cryptocurrency. Every hop makes it harder to trace and freeze.

That's why fraud teams and police talk about speed above everything else. India built its national helpline system around this idea: the Ministry of Home Affairs reported in late 2024 that its Citizen Financial Cyber Fraud Reporting and Management System had saved more than Rs 3,431 crore across 9.94 lakh complaints since 2021. Nobody can promise you a recovery, but a fast report is the one part of the outcome you control.

The first hour is also when people make the two most common mistakes: calling the scammer back to plead, and hiding what happened out of embarrassment. Both waste the time that matters most.

What should you do first if you've been scammed?

Work through these steps in order. Write down the time next to each one, because you'll be asked for times later.

• Minutes 0 to 10, stop the bleeding: end all contact. Don't make 'one last payment' to release anything. If the scammer had you install a screen-sharing or 'support' app, disconnect from the internet and uninstall it.
• Minutes 5 to 20, call your bank or payment provider: use the number on the back of your card or inside the official app. Ask them to block cards, UPI and online banking, flag the transactions as fraud and try to recall or freeze the payments. Note the name of the person and the reference number.
• Minutes 10 to 40, report to the national channel: see the table below for your country.
• Minutes 20 to 60, secure your accounts: change your email password first, then banking and any account the scammer saw. Sign out of other sessions and turn on two-step verification.
• Within the day, collect evidence: screenshots of chats and texts, call logs with times, website addresses, UPI IDs or account numbers you paid, and the transaction references from your statement. Don't delete anything.
• Today, tell someone you trust: a partner, a friend, an adult child. You'll think more clearly, and you'll be far less exposed to the recovery scams that often follow.

How do you know if you've actually been scammed?

Sometimes it's obvious: money has gone and the 'buyer', 'officer' or 'investment manager' has vanished. Often it's less clear, especially while the scam is still running. People ask us in workshops whether it 'counts' if they only shared a code, or only installed an app, or only paid a small fee. It counts. Treat any of the situations below as an emergency and start the first-hour steps now, even if no money has left your account yet.

If you're unsure, pause and run the situation past someone you trust before you do anything else the other person asks. A genuine organisation will still be there in an hour; a scammer will push you not to check.

• You shared a one-time password, PIN, card number or online banking password with someone who contacted you
• You entered your PIN or scanned a QR code to 'receive' money, refund or a prize
• You installed a screen-sharing or remote-access app because a caller asked
• You moved money to a 'safe', 'verification' or 'RBI' account, or bought gift cards or crypto on someone's instructions
• You paid a fee to get a job, release earnings or withdraw money from a trading platform
• Your phone suddenly lost signal and you stopped getting calls or texts (a possible SIM swap)
• You got alerts about logins, password resets or new payees you didn't set up

Where do you report a scam in your country?

Always call your bank first, then report through the official channel. These details were checked in October 2026, but services do get renamed. The UK's Action Fraud, for example, was replaced by Report Fraud in early 2026. Confirm on the official website before you rely on any number.

Can you get your money back after a scam?

Sometimes, partly, and it depends heavily on how the money was taken, where you live and how fast you reported it. This is general information, not legal advice, so ask your bank and check the regulator's website for your situation.

In India, Reserve Bank of India rules from 2017 give customers zero liability for unauthorised electronic transactions caused by a third-party breach, as long as the bank is told within three working days, with limited liability for reports made between four and seven working days. The catch is important: if you shared credentials such as an OTP or PIN, you may bear the loss until you report it to the bank. That's another reason to call immediately.

In the UK, the Payment Systems Regulator's reimbursement rules mean most victims of authorised push payment scams made through Faster Payments or CHAPS can claim up to £85,000 from their bank. You should report as soon as possible and within 13 months, and banks may apply an excess of up to £100, though not to vulnerable customers.

In the US and many other countries there is no single reimbursement rule for scams where you sent the money yourself, but card disputes, bank fraud teams and fast reports to the FTC and FBI can still help. Keep every reference number in one place.

What is a recovery scam, and how do you avoid one?

After a loss, many victims are contacted by 'recovery agents', 'cyber lawyers', 'blockchain investigators' or people claiming to be police, offering to get the money back for an upfront fee. They are almost always scammers, sometimes the same group that took the money in the first place.

The FBI's Internet Crime Complaint Center warns on its own homepage that scammers impersonate it, that it does not partner with law firms or crypto services to recover funds, and that it will never contact you directly asking for information or money. Australia's Scamwatch notes that about one in three scam victims are scammed more than once.

• Never pay anyone to recover money lost to a scam
• Deal only with your bank and the official reporting channel you contacted yourself
• Treat unsolicited contact about your case with the same Pause, Check, Verify habit you'd use for any suspicious call

What if the scam was a 'digital arrest' or fake police call?

In India, 'digital arrest' scams have cost people life savings. Criminals pose as police, customs, the CBI, the NCB or the RBI, keep the victim on a video call, insist on secrecy and demand transfers to 'verification' or 'safe' accounts. The Government of India has issued public alerts about this impersonation, and reported in late 2024 that it had blocked more than 1,700 Skype IDs and around 59,000 WhatsApp accounts linked to these scams.

There is no such thing as a digital arrest. Real agencies don't arrest people on video calls and never ask for money to prove innocence. If it's happening to you right now, end the call and tell someone. If money has gone, call your bank and 1930 straight away. The same pattern appears worldwide as fake tax office, Social Security, customs or police calls. The US Federal Trade Commission reported that people lost $3.5 billion to imposter scams in 2025, including around $920 million to government impersonators.

How do you secure your accounts after being scammed?

Start with your main email account. It's the master key, because every other account sends its password reset links there. Then work outwards to your mobile number, banking and payment apps, and anything the scammer saw or could have reset.

How do you stop it happening again?

Most scams pull the same four levers: urgency, authority, fear and hope, usually with a demand for secrecy. One habit defeats them: Pause, Check, Verify. Pause before you pay, click, share or install. Check what is actually being asked. Verify through a channel you find yourself, such as the number on your card or a family member's usual number.

Add a few protections: unique passwords in a password manager, two-step verification on email and banking, sensible payment limits, and a family code word for emergency calls that might use a cloned voice. If you want to see where you stand, AssessAll's Everyday Scam and Fraud Resistance Assessment gives you a quick baseline. Managers can fold security awareness into team development plans with Jobulary for Teams.

Bodhih Training's Scam-Proof kit puts all of this into practical tools, including a First Hour After Fraud action sheet you can fill in today while you're calm, so that if the worst happens you won't be searching for numbers in a panic.