Technology
The First Two Hours After You Realise: A Checklist
If you have just realised something was wrong, start here. Read the rest afterwards.
Do not wait until you are certain. Every action below is harmless if you turn out to have been mistaken, and several of them stop working within hours.
For a practical overview of time-tracker manipulation, Monitask provides the complete article with further context.
Do these now, in this order
1. Call your bank's fraud department. Use the number on your card. Say the words "I think I have been defrauded." That phrase routes you correctly.
2. If money left an account, say so immediately and ask whether it can be recalled. Wire transfers and faster payments sometimes can be, and the window is measured in hours.
3. If you installed anything, disconnect that device from the internet. Turn off the wi-fi or unplug it. Then use a different device for everything else on this list.
4. If you gave a password, change it — from a different device — and change it anywhere else you used the same one.
5. If you gave a one-time code, tell the bank exactly which code. It tells them what the caller was trying to authorise.
6. Ask the bank to check for new payees, new devices, changed contact details and new cards. These are added quietly and are how a single loss becomes an ongoing one.
7. Freeze your credit with the three bureaus if identity details were given. It is free and it can be lifted later.
8. Write down everything you remember, now, while it is fresh: times, numbers, names used, what was said, what you sent and how. You will need it and you will forget details by tomorrow.
Then, today
Report it. The FTC at reportfraud.ftc.gov and the FBI at ic3.gov. The National Elder Fraud Hotline is the AARP Fraud Watch Network, and it exists specifically for this.
Reporting is not paperwork. It is what allows patterns to be linked, and in some cases it is what makes recovery possible.
If a courier collected cash from your home, call local police. These operations depend on local people to move money, and unlike the callers, couriers can be identified.
Tell someone in your family. The hardest step, and the one that matters most for what happens next.
Why the shame is the dangerous part
This is worth saying plainly, because it determines outcomes more than any technical measure.
These schemes are run by organised operations with scripts refined over thousands of calls. They are designed by people whose full-time work is defeating exactly the kind of caution you exercise every day. Being taken in by one says nothing about your intelligence, your competence or your ability to manage your own affairs.
Most losses are never reported, and the reason is almost always embarrassment. That silence is what keeps the operations profitable and what keeps the next person unwarned.
There is also a practical consequence. People who tell nobody are the people who get targeted again — because they have no one checking, and because their details now circulate as a known responsive contact.
The second wave
Expect it, and recognise it.
The most alarming new entry in the FBI's 2025 report: $540 million stolen from prior fraud victims by criminals posing as recovery services, attorneys, or government agencies offering to recover previously lost funds.
Once you have been defrauded, your details may be sold on as a person who responds. What arrives next is a call or email offering to recover what you lost — from a law firm, a recovery service, a government-sounding agency, sometimes a "blockchain investigator".
All of them are fraudulent. Every one.
Two rules that cover the whole category:
Legitimate agencies do not charge you to investigate. The FBI, the FTC and your state attorney general do not take a fee.
Legitimate agencies do not contact you first by phone.
Anyone asking for an upfront payment, a "release fee", a tax on recovered funds, or your banking details in order to return your money is running the second half of the same operation.
In the following weeks
Watch statements closely for small unfamiliar amounts. Testing with a small charge before a large one is standard practice.
Check your credit report. You are entitled to free copies, and new accounts opened in your name appear there first.
Change security questions, not just passwords, if you gave answers like a mother's maiden name.
Consider a new card number and new account number if details were exposed. Inconvenient, and cheaper than the alternative.
Set up two-factor authentication on your bank and email accounts if it is not already on. Email matters more than people expect: whoever controls your email can reset everything else.
The conversation with family
If you are the one telling family, three things make it go better:
Lead with what you have already done. "I called the bank, I have reported it, I have frozen my credit" changes the conversation from a crisis into a situation being handled.
Be clear about what you need. Practical help, or just someone to know. Say which.
If independence is a worry, name it. Adult children sometimes respond to a fraud by suggesting broader supervision. Being defrauded by a professional operation is not evidence that someone cannot manage their affairs, and it is reasonable to say so directly.
If you are the family member being told: the first thing you say determines whether you hear about the next one. Start with "thank you for telling me."
Keep this somewhere
- Bank fraud department: the number on your card
- FTC: reportfraud.ftc.gov
- FBI: ic3.gov
- National Elder Fraud Hotline: the AARP Fraud Watch Network
- Credit freezes: all three bureaus, free
Worth writing on paper and keeping near the phone. In the moment, nobody wants to be searching for a number.
For additional public information on consumer fraud and scam prevention, see Federal Trade Commission.