You just realized the call was fake, or the charge on your statement is not yours, and the panic is immediate. Panic is the worst next move. A well-worn sequence limits the damage, and the people who recover well are the ones who acted quickly and did not let embarrassment freeze them.
Speed is the lever, and shame is the enemy
Two forces decide how an incident ends. The first is speed: federal rules tie how much you can lose to how fast you report it, and the clock is strict:
| What was used | If you report… | The most you can be liable for |
|---|---|---|
| Credit card | Before the card is used | $0 |
| Credit card | After unauthorized charges | $50; most card agreements waive even that |
| Debit card or bank account | Within 2 business days of learning of the loss | $50 |
| Debit card or bank account | After 2 business days | Up to $500 |
| Debit card or bank account | More than 60 days after the statement showing the fraud | The full amount of transactions after the 60-day mark |
Once you notify your bank of an unauthorized transaction it generally has 10 business days to investigate (20 for an account under 30 days old) and must give you a provisional credit if it needs longer. Acting within days is the biggest lever, and one reason a credit card is the safer tool online.
The second force works against the first: shame. The "how did I fall for this?" makes people go quiet exactly when speaking up matters most. Reporting is how money gets recovered and how the next person gets warned; silence is the scam's final win.
The response sequence
The steps are roughly in order, though several can happen the same day: cut off the bleeding, lock the doors, create a paper trail, start the formal recovery.
| Step | What it does | Why it matters |
|---|---|---|
| 1. Stop contact | End the call or chat; send no more money | Scammers pivot to "recovery" follow-ups |
| 2. Document | Save messages, numbers, amounts, dates | Disputes and reports all need this record |
| 3. Call the bank or card issuer | Freeze or reissue the card, flag the account | Speed here drives how much is recoverable |
| 4. Fraud alert or credit freeze | Lock your credit report | Stops new accounts being opened next |
| 5. Report | IdentityTheft.gov and the FBI's IC3 | Creates an official record and aids recovery |
| 6. Dispute the charges | Formally contest fraudulent transactions | The mechanism that reverses the money |
| 7. Change credentials | New passwords, starting with email | Closes the door the scammer came through |
Calling the bank is the highest-value first call, because the institution holding the money has the most power to stop or reverse it — flagging the account, reissuing a card, attempting a recall. Use the number on your card, never one the scammer gave you. A fraud alert or credit freeze matters when identity details were exposed, not just a card number; both are free, as the previous lesson covered.
Reporting has two front doors: IdentityTheft.gov, run by the FTC, generates an official identity-theft report and a recovery plan, and the FBI's IC3 takes reports of internet-enabled fraud. A police report is sometimes needed too. Disputing — a chargeback on a card — is the formal process through your bank or issuer that reverses the money; the documentation from step 2 makes it stick.
Locking down credentials
If a login, password or one-time code was exposed, the door it opens needs new locks: email first, since it can reset almost everything else, then the bank and any site that shared the leaked password. This is where the layers from the previous lesson pay off: unique passwords mean a single leak does not cascade.
Knowing the sequence turns the moment fraud is discovered from helpless panic into concrete moves: stop contact, document, call the bank, lock the credit file, report, dispute, change credentials — fast, in that order.