Security Scams: how they work and what to do if you fall for one
I sent money to a scammer: the first hour matters most
What can still be recovered and how, in order: the calls to make, the words that trigger a recall, the reports that matter, and what to expect from each payment method.
The short answer
- Call your bank's fraud line first and ask them to attempt a recall and contact the receiving bank, because money still sitting in that account can sometimes be frozen.
- Describe it accurately: a payment you made under deception is an authorized push payment fraud claim, which is a different process from an unauthorized transaction.
- How you paid decides the odds: card payments have a dispute process, while wires, gift cards and crypto mostly leave you with a report.
- Never make a second payment to release the first, whatever it is called; that stage is where many people lose more than they did originally.
- Reimbursement rules differ by country, and in the UK most authorized push payment victims are now covered by a mandatory scheme.
- Anyone who contacts you offering to recover your money for a fee is running the follow up scam.
Call your bank's fraud line now, before you finish reading this. Use the number printed on your card or shown in your banking app, not a number anyone gave you. Tell them you have been defrauded, that you made the payment because you were deceived, and ask them to attempt an immediate recall and to contact the receiving bank. Money that is still sitting in the receiving account can sometimes be frozen; money that has been moved on usually cannot. That is why the first hour is worth more than the next month, and it is the only part of this that is genuinely time critical.
The first hour, in order
Do these in sequence. If you have someone with you, hand them this list and let them make the second call while you make the first. If the scam involved a caller claiming to be your bank, dial from a different phone, because the number shown on a call is supplied by the caller and a held line can be used to fake the callback.
- Your bank or card issuer. Ask for the fraud team. If you paid by card, ask them to block the card, reissue it, and raise a dispute. If you sent a bank transfer, ask them to attempt a recall and to contact the beneficiary bank directly.
- The receiving side, if it is not a bank. A payment app, a marketplace, a money transfer service or a crypto exchange each have their own fraud reporting route, and a transfer that has not yet been collected can sometimes be stopped.
- Secure the accounts. If you shared a password, a code, or let anyone onto your device, change passwords from a different device and end all active sessions. The full sequence is in what to do after clicking a phishing link.
- Write it all down. Times, phone numbers, names used, account numbers, the amount, reference numbers, and the exact wording they used. Screenshot the messages before you block anyone. You will be asked for this three or four times by different people.
- Get a case reference from the bank for the fraud claim, in writing if you can. Verbal assurances vanish.
- Report it to your country's fraud body, covered below.
- Stop the conversation. Do not warn them, do not argue, do not negotiate. Block them once you have the screenshots.
The words that start the right process
Banks run two different processes, and which one you get depends on how you describe what happened. Getting this right saves days.
An unauthorized transaction is one you did not make: someone used your card number or got into your account. These have the strongest protection almost everywhere, and the bank generally has to refund and then investigate.
An authorized push payment is one you made yourself because you were tricked. You logged in, you typed the amount, you approved it. This is what happens in the safe account scam, the fake invoice and the romance scam, and it is handled under a different and slower process. Say the phrase clearly: you authorized the payment, but you did so as a result of fraud, and you want it treated as an authorized push payment fraud claim. If the scam involved someone pretending to be the bank itself, say so, because the details matter to the claim; the mechanics of that version are in the safe account scam.
For a card payment, the word you want is chargeback, or dispute. That is a scheme level process run between your bank and the merchant's bank, and it has its own deadlines, typically counted in months from the transaction or from the date you expected delivery. What it covers and how to argue it is set out in disputing a payment.
What each payment method can get back
Recovery depends far more on how you paid than on how convincing the scam was.
| How you paid | Realistic chance | What to ask for | Window that matters |
|---|---|---|---|
| Credit card | Good | Chargeback or dispute; in the UK also joint liability of the card issuer on qualifying purchases | Weeks, but scheme deadlines apply |
| Debit card | Moderate | Chargeback; protections are weaker than credit | Weeks |
| Domestic bank transfer | Sometimes | Immediate recall and contact with the receiving bank | Minutes to hours |
| International wire | Poor | Recall request plus a fast law enforcement report | Hours |
| Payment app | Poor to moderate | Report in the app and to your bank; ask if their scam reimbursement policy applies | Immediately |
| Cash pickup transfer | Moderate if uncollected | Ask the operator to stop the transfer, quoting the reference | Before collection |
| Gift cards | Poor | Call the card brand with the numbers and receipts to freeze any unspent balance | Hours |
| Crypto | Very poor | Report to the exchange if it went to a hosted wallet, with the transaction ID | Hours |
The pattern is simple. Payment types built to be reversible give you a process. Payment types built to be final give you a report. Any stranger who insists on the second group is telling you something about their intentions, which is a useful test the next time and is part of buying safely from a seller you do not know.
Who reimburses, and when
This differs by country, and the rules change, so treat what follows as general information rather than advice about your own claim. Ask your bank directly what scheme applies and get the answer in writing.
In the United States, federal rules give strong protection for unauthorized electronic transfers from a consumer account when you report promptly, and card disputes are stronger on credit than on debit. Payments you made yourself, even under deception, generally fall outside those rules. Some payment networks have introduced reimbursement for particular imposter scams, so ask specifically rather than assuming.
In the United Kingdom, rules introduced in 2024 require banks to reimburse most victims of authorized push payment fraud on domestic transfers, with the cost shared between the sending and receiving bank. There is an upper limit, banks may apply a small excess, and a claim can be refused where the customer ignored clear warnings. If you are refused, complain in writing and then take it to the Financial Ombudsman Service, which is free.
In the European Union, unauthorized transactions must be refunded under payment services rules, while payments you authorized yourself generally are not covered, although the rules are being tightened and some banks refund at their discretion. Everywhere, the deciding factors tend to be how quickly you reported it and whether warnings were shown and dismissed.
The reports that are worth making
Reporting rarely produces a detective on your doorstep, and it is still worth twenty minutes. It creates the record your bank and insurer will ask for, it allows freeze requests to be sent to receiving institutions, and it links your case to others using the same account, which is how these accounts actually get shut.
In the United States, report to the Federal Trade Commission at reportfraud.ftc.gov and to the FBI's Internet Crime Complaint Center at ic3.gov, which matters especially for wires because of its role in requesting freezes. A local police report is useful paperwork. In the United Kingdom, report to Action Fraud, or to Police Scotland on 101. In Canada, the Canadian Anti-Fraud Centre. In Australia, Scamwatch and ReportCyber. Elsewhere, your national police cybercrime unit or consumer protection agency.
The second scam that follows the first
Expect to be approached by someone offering to get your money back. These recovery scams are aimed specifically at people who have already lost money, and the contact details often come from the first scammer or from a public complaint you posted.
The signs are consistent. They contacted you rather than the other way round. They claim to be investigators, a law enforcement asset recovery unit, a crypto tracing firm or a lawyer. They want an upfront fee, a retainer, a tax payment, or access to your wallet or your computer. No genuine police force, bank or regulator charges you a fee to return your own money, and none of them will ask for remote access to your machine, which is the same move used in the fake refund version of tech support scams.
What to do in the days after
If you gave out identity documents, a national insurance or social security number, or a full date of birth alongside your address, treat this as a possible identity theft case as well as a payment loss, and work through the early signs and the first moves in identity theft basics. Consider freezing your credit file if that is available where you live. Keep every reference number in one place and set a reminder to chase the bank if you have heard nothing within the timeframe they quoted.
Then the part nobody puts in a checklist. Being scammed is not a verdict on your intelligence. These operations are practiced, scripted, and designed to work on people who are busy, worried or simply being cooperative, and the people who fall for them include accountants, engineers and fraud investigators. The strongest predictor of a bigger second loss is silence, because isolation is what the follow up scam needs. Tell one person you trust, today, and let them make the next phone call with you.
Common questions
Can a bank transfer be reversed?
Not reversed by you, but it can sometimes be recalled. Your bank asks the receiving bank to return the funds, which only works while the money is still in that account. Scammers usually move it within minutes, so the chance drops sharply by the hour. Report it the moment you realize, even at night.
Will my bank refund me if I sent the money myself?
It depends where you are. In the UK a mandatory scheme covers most authorized push payment fraud on domestic transfers, subject to limits. In the US and most of the EU, payments you authorized generally sit outside the refund rules, though card payments have their own dispute route and some banks pay out voluntarily. Ask what scheme applies and get it in writing.
Is there any way to get money back from gift cards or crypto?
Rarely, but it is worth trying fast. For gift cards, call the brand with the card numbers and receipts; if the balance has not been spent it can sometimes be frozen. For crypto, report the transaction ID to the exchange if the funds went to a hosted wallet, since exchanges can freeze accounts. Assume the answer is no and be pleased if it is not.
Should I tell the police even for a small amount?
Yes. Small reports are what link one account to dozens of victims, and your bank or insurer may ask for the reference number. It takes about twenty minutes online in most countries. Nobody will judge the amount, and there is no threshold below which a report is pointless.
Someone says they can trace and recover my funds for a fee, is that real?
No. Tracing services that approach victims directly are almost always a second scam, working from lists of people known to have lost money. Real recovery happens through your bank, the receiving institution and law enforcement, and none of them charge an advance fee or ask for access to your device or wallet.