How to Respond When You’ve Been Scammed Online: A Step-by-Step Guide

In brief: what you do in the first 24 to 48 hours matters most. Stop all contact and payments, preserve chats, emails, payment details and wallet addresses, secure your accounts, report to the police and to your bank or exchange, and only then decide whether professional investigation is proportionate to your loss. Be wary of "recovery" services that promise a guaranteed refund: that is usually a second scam.

Being scammed online is a disorienting experience. Whether it was a fraudulent investment, a romance scam, a fake online store, or an impersonation scheme, the immediate aftermath often brings a mix of shock, anger, and uncertainty. Most people do not know what to do first. Some freeze. Others make moves that inadvertently harm their chances of recovery.

This guide provides a practical, step-by-step approach to responding after you have been scammed. It is written for individuals, but the principles apply whether you lost a few hundred euros or a few hundred thousand. The most important thing to understand is this: what you do in the first 24 to 48 hours can significantly affect whether your money is recoverable and whether the perpetrator is identified.

Step 1: Stop All Contact with the Scammer

This is the most urgent step and the one people most often get wrong. Once you realize you have been scammed, cease all communication with the perpetrator immediately. Do not send more money under any circumstances, even if they claim it is needed to “release” your funds. Do not confront them or let them know you are aware of the fraud. Scammers who realize they have been discovered will often delete accounts, destroy evidence, and move stolen funds to less traceable locations.

If the scam is ongoing (for example, you are in the middle of a transaction), stop the process. Contact your bank to halt any pending transfers. If you have given the scammer remote access to your computer, disconnect from the internet immediately and do not reconnect until you have secured your system.

Step 2: Preserve Evidence Immediately

Before you do anything else, document everything. This is critical because platforms, websites, and social media accounts used by scammers are frequently deleted within hours or days of the fraud being completed. Once that content disappears, it becomes significantly harder to investigate.

Preserve the following:

• Screenshots of all conversations (WhatsApp, email, social media messages, dating apps). Capture the full thread, including profile names and profile pictures.
• Transaction records from your bank, payment provider (PayPal, Wise, etc.), or cryptocurrency exchange. Include transaction IDs, dates, amounts, and recipient details.
• Email headers from any emails received from the scammer. These contain technical metadata that can help trace the sender.
• Cryptocurrency wallet addresses used by the scammer. Even if the name attached to the wallet is fake, blockchain addresses are permanent and traceable.
• Website URLs of any fraudulent sites. If possible, use a web archiving tool to save a copy of the page before it is taken down.
• Any documents, contracts, or identification the scammer provided to you. These may be forged, but they still contain investigative leads.

Store all of this evidence in a dedicated folder. Create backups. You will need this material for every step that follows.

Step 3: Secure Your Accounts

If you shared personal information, login credentials, or financial details with the scammer, you need to act quickly to limit further damage.

• Change passwords for all accounts that may have been compromised. Start with your email and banking accounts.
• Enable two-factor authentication (2FA) on every account that supports it.
• Review your bank statements and credit card activity for unauthorized transactions.
• If you shared identity documents (passport, driving license), consider contacting the relevant authority about potential identity theft.
• If the scammer had remote access to your device, have it professionally checked for malware or keyloggers.

Step 4: Report to Authorities

Filing an official report creates a formal record of the crime. This is important for several reasons: it may trigger an investigation, it supports any future legal proceedings, and it is often required by banks and insurance companies for refund or compensation claims.

Where to report depends on your location:

• Netherlands: File a police report (aangifte) at your local police station or online. Also report to the Fraudehelpdesk (fraudehelpdesk.nl).
• United States: Report to the FTC at reportfraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov.
• United Kingdom: Use Report Fraud (reportfraud.police.uk or 0300 123 2040), the national fraud and cybercrime reporting service for England, Wales and Northern Ireland, run by the City of London Police; it replaced Action Fraud in December 2025. In Scotland, report to Police Scotland on 101.

When filing your report, include all the evidence you collected in Step 2. Be specific about amounts, dates, methods, and any identifying details about the scammer.

Step 5: Report to Platforms and Financial Institutions

Separately from law enforcement, report the fraud to every platform and financial institution involved:

• Your bank or payment provider: Request a chargeback or reversal where possible. Banks have time limits for these requests, so act promptly.
• Cryptocurrency exchanges: If the scammer received funds through an exchange, report the wallet address and request that the account be flagged or frozen.
• Social media platforms: Report the scammer’s profile for fraud. This helps protect other potential victims.
• Website hosting providers: If the scam involved a fake website, report it to the hosting provider and to Google Safe Browsing.

Step 6: Assess Whether Professional Investigation Is Warranted

Law enforcement handles a high volume of fraud cases, and not all receive active investigation. In many jurisdictions, online fraud reports are collected for intelligence purposes but may not lead to individual case investigation. This is especially true for cross-border cases.

Consider engaging a professional investigator when:

• Significant money is involved and recovery is a priority.
• You have limited information about the perpetrator and need identification.
• You need evidence documented carefully enough (source, timestamp, method) to be usable in legal proceedings.
• Law enforcement is not actively pursuing your specific case.
• The case involves cryptocurrency, which requires specialized blockchain analysis tools.
• The fraud is cross-border and involves multiple jurisdictions.

A professional investigator can identify the person behind anonymous accounts, trace the flow of funds (including through cryptocurrency wallets), compile evidence into reports designed for use in legal proceedings, and provide intelligence that supports law enforcement or civil proceedings.

Step 7: Manage Your Expectations

This is difficult but necessary. Recovery of stolen funds is not guaranteed. The probability of recovery depends on many factors: how quickly you acted, the payment method used, the jurisdiction of the perpetrator, and the level of cooperation from banks and exchanges.

Bank transfers are sometimes reversible if caught early. Credit card payments offer chargeback protection. Cryptocurrency is traceable but recovery depends on whether the funds can be frozen at an exchange and whether the relevant jurisdiction cooperates. Cash and gift cards are the most difficult to recover.

Time is the most critical factor. The sooner you act, the better your chances. Every day of delay gives the scammer more opportunity to move, convert, or withdraw the stolen funds.

What NCRB Can Do

NCRB investigates online fraud professionally. We have experience across romance scams, investment fraud, business email compromise, identity theft, and cryptocurrency fraud. We work with individuals and organizations across 20+ countries.

Specifically, we can:

• Identify perpetrators behind anonymous profiles and shell companies.
• Trace the flow of funds, including cryptocurrency through blockchain analysis.
• Document evidence with source, timestamp and method, so it can be used in legal proceedings.
• Provide intelligence reports that support law enforcement and legal proceedings.
• Coordinate with international counterparts in cross-border cases.

If you have been scammed and need professional help, contact us for a confidential assessment. There is no obligation, and the initial consultation is designed to help you understand your options and the realistic prospects for your case.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Every situation is unique. If you believe you have been the victim of fraud, we recommend consulting with a qualified legal professional in your jurisdiction. NCRB provides investigative services but does not provide legal advice or guarantee outcomes.