Find the category closest to your situation. Each one sets out what typically happened, the immediate steps that matter most, the evidence to preserve, and who to contact.
Beware of recovery scams. If someone promises guaranteed recovery and demands an upfront payment, stop and verify their identity independently.
Investment scams
Promised returns from a trading, forex, commodity or fund opportunity that cannot be independently verified.
What happened
You were introduced to an investment opportunity - often through social media, messaging apps or a referral - that showed steady profits on a dashboard you did not control. Withdrawal requests were delayed, refused, or met with new fees.
Immediate steps
Stop making further payments, including any requested 'tax', 'release' or 'verification' fee
Contact your bank or payment provider and report the payments as suspected fraud
Do not delete the account, app or conversation - export it instead
Revoke any card authority, standing order or recurring payment set up for the platform
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Screenshots of the platform dashboard, balances and withdrawal attempts
The website domain, app store listing and any company registration numbers quoted
Who to contact
Your bank, card issuer or payment provider
The financial regulator in your country
The national fraud or cybercrime reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Cryptocurrency scams
Transfers of digital assets to a wallet, platform or 'trading manager' that cannot be reversed by you.
What happened
You transferred cryptocurrency to an address or platform on the strength of promised profits, a support agent, a giveaway, or an urgent security warning. Blockchain transfers settle immediately and are not reversible by the sender.
Immediate steps
Send no further transfers, regardless of what is promised in return
Revoke token approvals and disconnect your wallet from unknown applications
Move remaining assets to a new wallet with a newly generated recovery phrase, created offline
Report the receiving addresses to the exchange or platform you sent from
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Every transaction hash and the sending and receiving wallet addresses
Exchange withdrawal confirmations and account statements
Who to contact
The exchange or wallet service you used
Your national cybercrime reporting body
The receiving exchange, if a transaction can be traced to a known service
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
The asset and network used for each transfer, such as BTC, ETH or a specific chain
Romance scams
A relationship formed online that became a series of financial requests, often escalating into an 'investment'.
What happened
Someone built trust over weeks or months, avoided verifiable video contact, and then introduced emergencies, travel costs, medical bills, customs fees, or an investment platform they wanted to help you use.
Immediate steps
Stop all payments and gift-card or crypto purchases immediately
Preserve the profile, chats and images before blocking the account
Contact your bank about recent and pending transfers
Tell someone you trust - isolation is part of how the scheme works
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Profile links, usernames and any photographs sent to you
A written timeline of the relationship and each request for money
Who to contact
Your bank or money transfer provider
The platform where you met, through its reporting tool
The national fraud reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Online shopping scams
Goods or services paid for that never arrived, or arrived materially different.
What happened
You bought from a website, marketplace listing or social-media seller. The seller pushed you toward bank transfer or a friends-and-family payment, then stopped responding after payment.
Immediate steps
Open a dispute or chargeback with your card issuer or payment platform without delay
Keep the listing, order confirmation and all seller messages
Check the domain registration date and contact details of the website
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
The product listing, order number and delivery promises
Proof of payment and any tracking information supplied
Who to contact
Your card issuer or payment platform's dispute team
The marketplace or social platform hosting the listing
Your national consumer protection body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Business email compromise
A payment redirected after an email appearing to come from a supplier, executive or client.
What happened
An attacker gained access to or convincingly imitated a mailbox, then sent updated bank details or an urgent payment instruction. The change often arrives late in the day or during a known absence.
Immediate steps
Ask your bank to attempt a recall of the payment immediately - speed matters
Reset passwords and revoke sessions on the affected mailbox, then enable multi-factor authentication
Check mailbox rules and forwarding settings for attacker-created entries
Verify the real counterparty details using a phone number you already held
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Full email headers of the fraudulent messages
Mailbox audit and sign-in logs, plus any rules or forwarders you found
The invoice, payment instruction and bank confirmation
Who to contact
Your bank's fraud team, and the receiving bank via your bank
Your IT or security provider
The national cybercrime reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
The beneficiary account name, number, sort code or IBAN used
Phishing
Credentials or codes entered on a page or call that imitated a service you use.
What happened
A message, call or advert directed you to a convincing sign-in page, or a caller talked you through 'securing' your account. Whatever you typed was captured and used quickly.
Immediate steps
Change the password for the imitated service from a different, trusted device
Sign out of all sessions and enable or reset multi-factor authentication
Check for changed recovery email addresses, phone numbers and payees
Tell your bank if any financial credentials or codes were shared
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
The full phishing URL and message source, without clicking links again
Times you entered data and any codes you were asked to read out
Who to contact
The imitated organization's official support channel
Your bank, if payment details or codes were involved
The national phishing or cybercrime reporting service
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Identity theft
Your personal details used to open accounts, borrow, or transact in your name.
What happened
Someone used your identity documents or personal data to obtain credit, a phone contract, a benefit or an account. You may have found out from a letter, a credit alert or a declined application.
Immediate steps
Request your credit files and place a fraud alert or freeze where available
Report each fraudulent account to the institution that opened it
Change passwords and secure your email and mobile accounts first
Keep a log of every call, reference number and person you speak to
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Credit report entries and account opening letters
Any documents or data you believe were exposed, and how
Who to contact
Credit reference agencies in your country
Each institution where a fraudulent account exists
The national identity theft or fraud reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Payment fraud
Unauthorized card, transfer or direct debit activity on your accounts.
What happened
Transactions you did not authorize appeared on a card or account, possibly after a data breach, a lost device, or card details captured at a compromised merchant.
Immediate steps
Freeze or cancel the affected card through your provider's app or fraud line
List every disputed transaction with date, amount and merchant name
Ask your provider to raise a formal unauthorized transaction dispute
Review and remove stored cards and unfamiliar payees
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Statements with each disputed transaction marked
Provider case or dispute reference numbers
Who to contact
Your card issuer or bank fraud team
The financial ombudsman or dispute body in your country if the outcome is unfair
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Account takeover
Someone else gained control of your email, banking, exchange or social account.
What happened
Login credentials were reused, phished, or a SIM swap intercepted your codes. The attacker changed recovery details to lock you out and then transacted.
Immediate steps
Recover your email account first - it controls resets everywhere else
Contact your mobile provider if you lost signal or service unexpectedly
Reset passwords on a clean device and enable app-based or hardware multi-factor authentication
Notify any financial account linked to the compromised email
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Account activity and device-login logs
Security notification emails, including changes you did not make
Who to contact
The platform's account recovery and security team
Your mobile network operator
Your bank and the national cybercrime reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Social engineering
Pressure, authority or urgency used by phone or message to make you act against your interests.
What happened
A caller claimed to be from your bank, a technology provider, a delivery service or an official body, and created urgency so you would move money 'to a safe account' or install software.
Immediate steps
End the contact and call the organization back on a number you look up yourself
Uninstall any remote-access software you were asked to add, then scan the device
Report the transfers to your bank as authorized push payment fraud
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Caller numbers, times, and the script or claims used
Names of any software you were asked to install
Who to contact
Your bank's fraud team
The organization that was imitated
The national fraud reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Fake investment platforms
A professional-looking trading site or app that displays fabricated balances and blocks withdrawals.
What happened
The platform showed rising profits and a responsive 'account manager'. Withdrawals triggered new conditions: fees, taxes, upgraded account tiers, or a demand to deposit more first.
Immediate steps
Make no further deposits under any condition
Export all account screens, statements and chat history before access is removed
Check the operator against your regulator's register and warning list
Report the payments to your bank or exchange
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
Domain names, app links, and copies of terms or 'certificates' shown to you
Account manager names, phone numbers and messaging handles
Who to contact
Your financial regulator
Your bank, card issuer or exchange
The national cybercrime or fraud reporting body
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Recovery scams
A second scheme that targets fraud victims by promising to retrieve the money already lost.
What happened
You were contacted by someone claiming to be an investigator, lawyer, blockchain specialist, bank officer or official, offering recovery in exchange for an upfront fee, a deposit, or your account credentials.
Immediate steps
Pay nothing and share no credentials, codes or recovery phrases
Verify any claimed identity independently, using official published contact details
Preserve the approach - it is evidence, and it is often linked to the original scheme
Report the approach to your national fraud reporting body
Evidence to preserve
Dated screenshots of every conversation and web page
Transaction records, receipts and reference numbers
Email headers and the full text of messages
The exact claims made about affiliation, licences or guaranteed outcomes
Payment details, wallet addresses and documents they sent you
Who to contact
Your national fraud or cybercrime reporting body
The organization the contact claimed to represent
Your bank, if any payment was made
What information to provide
Dates and approximate times of each payment or contact
Amounts, currencies and payment methods used
Reference numbers, transaction IDs or wallet addresses
Names, usernames, phone numbers and domains used by the other party
Independent service. FraudGuard Recovery & Cyber Safety is an independent private service. We are not a law enforcement agency, government body, bank, regulator or law firm, and we have no government affiliation. We do not guarantee the recovery of lost funds. Outcomes depend on the circumstances of each case and on the institutions involved.
Need help understanding what happened?
Document the incident, protect your accounts, and identify the appropriate next steps.