1. Stop the interaction
Hang up, close the pop-up, stop replying, or leave the chat. You do not need to prove to the scammer that you know it is a scam.
Do not let the person keep you on the phone while you “verify.”
2. Do not send money, codes, or remote access
A one-time security code, remote-control session, bank transfer, gift card number, cryptocurrency payment, or mailed cash can be difficult or impossible to undo.
Pause before any irreversible action.
3. Verify independently
Find the official phone number, website, app, or family contact yourself. Do not use the information supplied by the suspicious message.
SSA, Medicare, banks, carriers, and other organizations publish official contact information for this purpose.
4. If you paid, contact the payment provider immediately
The FTC advises contacting the company used to send money and asking whether the transaction can be reversed. Contact your bank, card issuer, wire service, payment app, cryptocurrency exchange, or gift-card company as appropriate.
Act quickly. Recovery is not guaranteed, but delay can reduce options.
5. If you shared credentials, secure accounts
Change exposed passwords from a trusted device, especially if they were reused. Review MFA, recovery information, forwarding rules, signed-in devices, and recent activity.
If you shared a one-time code, assume the related account may need immediate review.
6. If someone controlled your computer
End remote access and seek help from a trusted technical professional. Change important credentials from another trusted device if the scammer may have observed them.
Contact financial institutions if banking information or sessions were exposed.
7. Preserve evidence
Save screenshots, phone numbers, emails, transaction receipts, wallet addresses, usernames, and dates. Do not keep interacting solely to gather evidence.
This information can help banks and investigators.
8. Report the scam
Report general consumer scams to the FTC. Internet-enabled fraud can be reported to FBI IC3. Social Security impersonation can be reported to SSA OIG. Medicare fraud can be reported to Medicare. USPS-related smishing has its own reporting process.
Choose reporting channels based on the scam rather than submitting sensitive information everywhere.
9. Tell someone you trust
Scammers use embarrassment and secrecy to keep people isolated. Talking to someone can help identify follow-up attempts and secure accounts.
A scam attempt is a crime tactic, not a measure of intelligence.
Quick Reference
| What happened? | First action |
|---|---|
| Only received message/call | Stop, verify independently, report/block |
| Clicked link but entered nothing | Close page; review device if download occurred |
| Shared password | Change it; review account/MFA |
| Shared one-time code | Review account immediately |
| Sent money | Contact payment provider/bank immediately |
| Gave remote access | End access; trusted technical review |
| Shared Medicare/SSN data | Contact relevant agency; identity-theft steps as appropriate |
Check the Red Flags
Use the Scam Red-Flag Checker to review common warning signs without entering sensitive account information.
Stop before trying to prove the scammer wrong
Once you suspect a scam, continuing the conversation usually does not help. The person may change the story, become more threatening, or use your questions to learn what kind of explanation will persuade you.
End the call, close the message, or stop the chat. You can investigate safely without the scammer participating.
Write down what happened while it is fresh
Record the phone number, email address, website, username, payment method, amount, date, and the main claims. Save screenshots or messages when doing so does not require more interaction.
This information can help a bank, payment provider, platform, law-enforcement agency, or reporting service understand what happened.
Act quickly when money or account access was involved
If you sent money, contact the bank, card issuer, payment app, wire service, or other provider immediately and explain that the transaction may be fraudulent.
If you shared a password or code, secure that account from a trusted device and review connected accounts. If remote access was granted, end it and consider professional help checking the device.
Tell someone you trust even if no money was lost
Talking about an attempted scam can make the next decision easier and may help someone else recognize the same pattern.
Being targeted does not mean you did anything wrong. Scammers send enormous numbers of calls and messages and adapt their stories to whoever responds.
Use time and independent verification as your advantage
The person trying to scam you usually wants speed. Your advantage is that you can stop. You can hang up, close the message, call someone you trust, and verify the claim through an official route you choose yourself.
You do not have to identify the exact scam before protecting yourself. If an unexpected contact wants money, sensitive information, a security code, remote access, or secrecy, stop the interaction and verify before doing anything else.
Use the same verification routine every time
A consistent routine is easier to remember than a different response for every scam. Stop the interaction, identify what the person is asking for, and verify through a contact method you choose. Do not let the caller, text, or email supply the only route back to the organization.
For family emergencies, call the relative or another family member directly. For financial accounts, use the official app, card, or statement. For government or benefit questions, use the agency’s known website or published contact information.
Protect verification codes and remote access
One-time codes, password-reset links, security approvals, and remote-access permissions can give another person a direct path into an account or device. Treat them as highly sensitive even when the person asking sounds professional or urgent.
If you did not start the sign-in or support session yourself, do not approve it. A surprise request for a code or remote-control software is a reason to stop and verify independently.
Do not make payment while someone is pressuring you
Scammers often stay on the phone or in the chat while they tell you exactly how to buy gift cards, move money, use cryptocurrency, or complete a transfer. That constant contact prevents you from getting another opinion.
End the conversation before taking any payment step. A legitimate bill or emergency can be checked through another source, and a genuine organization will still be there after you verify the request.
Sources
Frequently Asked Questions
Should I keep talking to find out whether it is a scam?
No. End the interaction and verify using an independent source.
What if I already sent money?
Contact the payment provider or financial institution immediately and ask about reversal or recall options.
What if I only clicked the link?
Risk depends on what happened next. Close it, check whether anything downloaded, and secure accounts if credentials were entered.
Where should I report a scam?
FTC for general consumer fraud, IC3 for internet crime, and the relevant agency for specialized impersonation such as Social Security or Medicare.
Should I be embarrassed to tell someone?
No. Scam scripts are designed to manipulate attention and emotion. Sharing what happened can help limit further loss.
Keep this visual on Pinterest
Save the infographic so you can return to the checklist or comparison when you need it.
Save on Pinterest