You were scammed. Here is the order to do things in.

1. If you paid them

Find how you paid. The difference between these is not small — it is the difference between a $50 ceiling and no protection whatsoever.

By credit card

Call the number on the back of the card and say the charge was not authorised.

The strongest position of any payment method. Report it before anyone uses the card and you owe nothing; report it after and $50 is the most federal law can hold you to. If only the card number was taken and the card is still in your pocket — the usual case with a phone scam — you are not liable for any of it.

FTC — Lost or stolen credit, ATM, and debit cards

By debit cardTwo business days, then 60 days

Call your bank now, not tomorrow. This is the one where the delay costs you money.

Protection is real but it decays. Reported within two business days of learning about it, $50 is the cap. After that but within 60 calendar days of the statement that shows it, $500. Past 60 days, federal law stops protecting you and the bank may hold you to the whole amount, including money in linked accounts.

CFPB — Regulation E §1005.6, liability for unauthorized transfers

Through a payment app

Report it in the app and ask for the transfer to be reversed, then tell the bank behind the account.

A transfer you were tricked into authorising is treated differently from one you never made, and that distinction usually works against you. Ask anyway, in writing, and keep what they tell you.

FTC — What to do if you were scammed

By wire transferHours

Call the wire company — not just your bank — and ask them to reverse it because you were tricked into sending it.

Possible only while the money is still in transit. That is a matter of hours.

FTC — What to do if you were scammed

With a gift card

Call the card issuer on the number on the back of the card, with the card number and the PIN.

Some issuers can freeze a card that has not been drained yet. Keep the card and the receipt — you will be asked for both.

FTC — What to do if you were scammed

In cryptocurrency

Contact the exchange or the operator of the ATM straight away and ask them to stop the transfer.

There is no equivalent of the card rules here. Nobody is obliged to give it back, and a transfer that has settled is generally gone. Treat anyone who contacts you afterwards offering to recover it as a second scam.

FTC — What to do if you were scammed

Cash, in the postBefore it is delivered

Call the U.S. Postal Inspection Service on 1-877-876-2455.

If the package is still moving they can intercept it, for a fee.

FTC — What to do if you were scammed

Ask for everything in writing and keep the dates. If a bank refuses and you think the limits above should apply, those dates are the whole of your case.

2. Stop the next call, today

They will try again, and they will not be the only ones. The FTC puts it plainly: lists of people who have paid a scammer are bought, sold and traded, and each entry carries your name, your address and phone number, which scam worked on you and how much you paid. Scammers trade them expecting that people who have been scammed once are good targets for being scammed again. Your phone number is on one of those lists as of today.

This is the part people are not warned about, and it is why the phone comes before your credit. The second approach is usually an offer to get your money back, and it arrives by phone. Here is what it sounds like:

• Someone offering to recover the money you lost, for a fee or a "processing charge". There is no version of this that is real.
• Someone claiming to be from a government agency — the FTC included — with news about your case. The FTC does not have agents and does not phone people about refunds.
• A lawyer, a consumer group or a fraud department that happens to know what happened to you. They know because they bought the list.
• A cheque for more than you lost, with instructions to deposit it and send back the difference. The cheque is counterfeit and the difference is your money.

One rule covers all of it: nobody who can genuinely help you will phone you first and ask for money. Not a lawyer, not a refund department, not a government agency.

FTC — Refund and recovery scams

What to actually do about it

Blocking the number that called you will not help much — the next call comes from a different one, and the list has been sold to more than one buyer. What works is something deciding before your phone rings.

PhoneShield answers your calls first. Numbers already reported as scams are refused before your phone rings, and everyone else is asked who they are and what they want, so your bank and your family still get through while the follow-up attempts do not reach you at all. We built it, and we built this site from the same reports. Set it up before the callbacks start — that is usually days, not weeks.

Free and worth doing either way: turn on your phone’s own screening for iPhone or Android, and your carrier’s spam filter. It silences unknown numbers rather than screening them, so you will be checking voicemail for the calls that mattered — but it costs nothing and it is better than nothing.

3. If you gave them information

What they can do with it depends on what they got, and so does what you should do about it.

A card number

Call the issuer and ask for the card to be cancelled and reissued. A new number is the only fix.

A card number does not expire on its own, and it can be sold on long after the call.

Your bank account and routing number

Tell the bank the details are compromised and ask what they advise — usually a watch on the account, sometimes a new account number.

These are enough to attempt direct debits against the account.

Your Social Security number

Freeze your credit at all three bureaus, then start the plan at identitytheft.gov. See the section below on what can and cannot be locked.

An SSN is the key to opening credit in your name, which is why the freeze matters more than anything else on this list.

A password or a login

Change it there, and change it everywhere else you used the same one. Turn on two-step sign-in while you are in the settings.

Reused passwords turn one disclosure into several accounts.

A code from a text or an app

Go to that account now and check for devices, forwarding rules and recovery addresses you do not recognise, then change the password.

A code is the last step of signing in. Someone asking for one already had your password, so read this as an account takeover in progress rather than a disclosure.

Remote access to your computer or phone

Disconnect it from the network, change the passwords of anything you signed into on it from a different device, and have it looked at before you bank on it again.

Anything typed on that device while they were connected should be treated as known to them.

4. “Can I freeze my Social Security number?”

No. There is no such thing. A Social Security number cannot be frozen, cancelled or reissued on request the way a card can, and nobody can make it stop working. It is one of the first things people go looking for after handing one over, which is reason enough to say plainly that it does not exist — and then say what does.

Four protections exist. They do different jobs, they are all free, and the first one matters most.

A credit freeze is not the same as a “credit lock” sold on subscription. The freeze is a legal right, it is free, and it does the same job. If something is charging you monthly for it, you are paying for something the law already gives you.

5. Then report it

Four places, each with a different job. None of them will get your money back — that was step one — but an identity theft report is what unlocks the longer protections, and the FTC’s data is what makes the next person’s warning possible.

identitytheft.gov

Start here if information was taken rather than money. It asks what happened and produces a written recovery plan with the letters and affidavits you will need, which is also what gets you the seven-year fraud alert.

reportfraud.ftc.gov

The general report. It feeds the data this site is built from, and reported numbers go out to carriers and blocking services every business day. No account needed.

consumercomplaints.fcc.gov

For a faked caller ID — a number near yours, your own number, or a real organisation the caller was pretending to be.

Your local police

Worth the hour it takes if you lost money. Banks and insurers often want a report number, and an identity theft report is what unlocks the longer protections.

Reports to the FTC are also where this site’s data comes from, which is why a number you report today can end up warning someone next week. You can report the number here too — it shows on that number’s page straight away, and it takes about a minute.

One thing not to do

Do not spend the evening working out who they were. It feels like the useful thing and it is the one step that changes nothing: caller ID can be faked, so the number on your screen may belong to a stranger who never called anyone, and the person behind it is very likely not in the country. Nothing here undoes what happened. The four steps above are the ones that affect the outcome, in that order.

If you want to know what the number has been reported for, look it up — that is worth a minute, and your report helps the next person. Then stop. Why you are getting so many calls explains the rest.

Questions people ask

Can I freeze my Social Security number?

No. There is no freeze on a Social Security number the way there is on a credit report. What exists instead is a credit freeze at the three bureaus, a fraud alert, an IRS Identity Protection PIN, and an SSA block on electronic access to your record. The credit freeze is the one that stops new accounts being opened in your name.

What do I do first after being scammed?

Money, then the phone, then your credit, then the reports. Call your card issuer or bank first and say the payment was not authorised, because that window closes on its own. Then stop the follow-up calls, because lists of people who paid a scammer are bought and sold and the next approach comes by phone. Then freeze your credit if a Social Security number was involved. Reports matter, but no report moves as fast as your bank can.

Will the scammers contact me again?

Very likely, and not only the same ones. The FTC says lists of people who have paid a scammer are bought, sold and traded, carrying your name, address, phone number, which scam worked and how much you paid — because someone scammed once is considered a good target. The follow-up is usually an offer to recover your money for a fee, and it comes by phone. Nobody who can genuinely help will phone you first and ask for money.

How much am I liable for if I paid by card?

On a credit card, $50 at most under federal law, and nothing at all if only the number was taken and you still have the card. On a debit card it depends on speed: $50 within two business days of learning about it, $500 after that but within 60 days of the statement, and potentially everything after 60 days.

Is a credit freeze free?

Yes. Placing and lifting a freeze is free by law at all three bureaus, and it lasts until you lift it. Online or by phone, a bureau has to place it within one business day and lift it within one hour.

Who do I call about identity theft?

Start at identitytheft.gov, the FTC’s own service. It asks what happened and produces a written recovery plan with the letters and affidavits you need. Add a police report if you lost money, because banks and insurers often ask for the report number.

Can I get my money back?

It depends entirely on how you paid. Card payments have real legal protection. Wire transfers can sometimes be stopped within hours. Cryptocurrency and cash generally cannot be recovered at all, and anyone who contacts you afterwards offering to recover them should be treated as a second scam.