I've been scammed: where to start
In short
If money, a card or a code is at stake, call your bank first, on the number on the back of your card: it is the only step where every minute counts. For the rest, find below the situation that matches what you gave away, and follow the steps in order. Several situations can apply at the same time.
You sent money
- Call your bank straight away, on the number on the back of your card or from the official app.
- For a transfer, ask for the transaction to be blocked and for a recall of the funds; for a card payment, a dispute and a block on the card.
- Cut off all contact with the scammer, without deleting anything from your exchanges.
You gave out your bank card or a verification code
- Hang up if the exchange is still going on, then call your bank yourself, on the number on the back of your card.
- Block your card, even if nothing has been charged yet.
- Don't approve any further notification or code until the bank has confirmed it.
You entered a password on a page
- Change it from the real service, opened through a bookmark or the app — never through the link you received.
- Sign out every open session on the account.
- Change the same password everywhere it was used, starting with your email, and turn on two-factor authentication.
You can no longer access an account, or it sends messages without you
- Start the service's recovery procedure without waiting, from a clean device.
- Sign out sessions, change the password, then restore the recovery email address and number.
- Warn your contacts through another channel: they may be receiving requests in your name.
You installed software or let someone take control of your device
- Disconnect the device from the internet.
- Uninstall any remote-control tool installed at your caller's request, then have the device checked.
- From another device, sign out your accounts' sessions, then change the passwords, starting with your email and your bank.
In every case, afterwards
- Keep the evidence: messages, numbers, addresses, screenshots, payment references, times of calls.
- File a police report: it is also the basis for your dealings with your bank.
- Report what happened to Cybermalveillance.gouv.fr (in France). A fraudulent text message can also be forwarded to 33700 (France's spam-text reporting number).
- Don't pay anything to someone who then offers to help you get your money back.
Keep it next to a relative's computer, or send it to them.
This checklist restates the advice on the pages of the attack encyclopedia. It does not replace instructions from your bank or official services, which take precedence. Source: Cybermalveillance.gouv.fr.