Act now: stop contact and protect your money
Scams can involve a fake seller, investment, job offer, romance, impersonated official or changed supplier bank details. Being deceived is not a reason to stay silent. A prompt report gives providers the best opportunity to act, although recovery is never guaranteed.
Stop sending money and information. End the call or conversation. Do not send a fee, tax or “verification payment” to release funds. Save the messages before blocking the sender.
Contact the payment provider immediately. Use its official app, a number on your card or a known website. Say you suspect fraud and ask what can be blocked, recalled, reversed or disputed. Keep the case reference.
Use a clean device. If someone controlled your screen or asked you to install an app, disconnect the affected device and contact the provider from another trusted device.
Choose the action that matches the payment
Bank transfer or changed invoice: give your bank the transaction reference, time, amount and beneficiary details. Businesses should involve finance and verify pending supplier changes by calling known contacts.
Mobile money: contact your mobile-money provider promptly through its official channel. Keep the original transaction message. Do not follow a stranger's reversal instructions or send a separate payment back.
Card purchase: tell the issuer whether your card details were exposed or the payment was unauthorised. Ask about blocking or replacing the card and the applicable dispute process.
Marketplace, wallet or crypto platform: use the platform's verified fraud support. Preserve order details, wallet addresses and transaction hashes where relevant. A transfer may be irreversible; no recovery agent can guarantee a return.
If you shared a password, code or identity document
From a trusted device, secure your main email and affected accounts. Replace reused passwords, revoke unfamiliar sessions and review recovery settings. A shared one-time code may already have authorised access or a payment; contact the relevant provider even if the code has expired.
Follow the account compromise playbook for stolen sign-ins. If you sent an ID image, bank statement or other identity material, use the identity theft playbook and watch for accounts opened in your name.
Build a useful evidence pack
Keep original chats or emails, the profile or website address, advertised offer, receipts, transaction references and a short timeline. Record what was requested, what you shared and when you contacted each provider. Preserve message headers where available. Do not reopen suspicious attachments to collect evidence.
Prepare a report through NC4 reporting guidance and check current contact information. Read the intake notice: preview submission does not lodge an operational report. Report suspected crime to police and keep the report reference. Providers may need their own fraud or dispute forms.
Watch for a second scam
Someone may claim to be a lawyer, investigator or technical expert who has found your money. Treat unsolicited recovery offers as a warning sign, especially requests for advance payment, credentials, remote access or a wallet seed phrase. Verify any claimed organisation independently before sharing evidence.
Warn family, colleagues or customers through a separate trusted channel if the scammer impersonated you. Ask a trusted person to help review the timeline and follow-up tasks; distress and urgency make decisions harder.
Recovery check: follow up and close the gaps
Every affected provider has a case reference and you know the next action and expected update.
Exposed cards, accounts and devices have been secured.
You have checked statements and upcoming payments for further activity.
Your evidence is stored privately, and you are watching for repeat approaches.
For safer everyday decisions, explore protection guidance.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.