Got scammed? Here's what to do now

Do not reply or use the message’s link or number. If it might concern a real account or delivery, open the official app or website independently. Report the message as spam and delete it when you no longer need it as evidence.

For US phishing texts, forward to 7726 where your carrier supports it. See the FTC’s phishing reporting instructions.

Close the page. Do not return to it to investigate. Opening a link alone does not establish that an account was taken over.

If you suspect a download, update your security software, scan, and remove anything it identifies, following the FTC’s phishing guidance. If you installed software or selected “Allow access,” use the access section. If information was entered or autofilled, also use the relevant section below.

Open the real service independently. If you can still sign in, change the exposed password and any reused passwords. Sign out other sessions, check recovery details, and enable multi-factor authentication. A shared code may have approved access or a transaction: contact the affected service, and your bank if money is involved.

Review the FTC’s account-security checklist. If you cannot sign in, use the lost-account section.

If someone is remotely controlling the device, disconnect it from the internet. Use another trusted device to secure affected accounts. Update security software, scan and remove detected threats; get help from the device maker or a trusted technician if needed. See the FTC’s device recovery guidance.

If you approved a connected app: remove its permission in the affected account’s security settings. The FBI’s consent-phishing warning explains why changing a password alone does not revoke this access. Review account activity and report suspected misuse.

The next step depends on what you shared. Contact your bank for exposed payment or account details. For a Social Security number or other identity information, use IdentityTheft.gov’s exposed-information steps. If someone is using your identity, report the identity theft for a recovery plan.

A free credit freeze at Equifax, Experian, and TransUnion helps prevent new credit fraud. It does not secure existing accounts or prevent all tax, medical, or other identity misuse. See our identity-recovery guide.

Use the provider’s official account-recovery process from a trusted device. The FTC’s hacked-account guide links to common providers. For a bank or payment account, call its independently verified fraud contact immediately.

After recovery, change the password, sign out other sessions, check recovery contact details and email forwarding rules, and enable multi-factor authentication. Warn contacts if messages were sent in your name. Do not pay someone who contacts you promising to restore the account.

Stop interacting and write down what you remember: did you type or autofill information, approve a code, pay, download a file, install an app, or approve access? Keep existing screenshots and receipts without reopening suspicious links.

Check the real account’s activity and security settings from a trusted device. If money or card details may be involved, contact the provider now. Use each section that could apply. The FTC’s recovery guide separates payment, information, and device exposure; this checker cannot inspect your device or accounts.

Save dates, amounts, receipts and messages. Report fraud at ReportFraud.ftc.gov and internet crime at IC3.gov. Reports help investigations but are not a promise of individual recovery.

Be wary of unsolicited recovery offers, demands for another payment, or requests for passwords. Independently verify any claimed agency or company before responding.