Credit card
Call the issuer and dispute the charge. Follow up in writing, and
keep a copy.
Credit cards carry dispute rights worth using straight
away, especially for a charge you did not authorize. The
outcome still depends on what happened. An unauthorized charge, a billing error, a
dispute about goods that never arrived, and a payment you were deceived into making
yourself are treated differently. To preserve your
billing-error rights, the issuer must receive your notice no later than 60 days after it
sent the first statement showing the problem. Put it in writing even if you called.
12 CFR § 1026.13 · Fair Credit Billing Act · CFPB
Debit card
Call the number on the back of your card now. Not a number from any
message. Ask them to freeze the card, reissue it, and open a dispute.
Why the speed matters. Under Regulation E, if you
report a lost or stolen card within two business days of learning about it, your
liability is capped at the lesser of $50 or the amount taken. Report an unauthorized
transfer that appears on a statement within 60 days of that statement and you avoid
liability for transfers that follow. Wait longer and those protections narrow. As with a
credit card, a payment you were tricked into authorizing yourself is a harder case than
one made without you.
12 CFR § 1005.6 · Regulation E
Zelle, a bank transfer, or a wire from your bank
Call your bank or credit union immediately, on a number you know is
real, and ask them to reverse the payment or attempt a recall. Then
file at ic3.gov, the FBI's Internet Crime Complaint
Center, with every account number, amount and timestamp you have.
Hours count here. A wire is
designed to be fast and final. The FBI runs a Recovery Asset Team that works with banks
to freeze funds sent to domestic accounts under fraudulent pretenses, and an IC3 report
is how that process starts. It does not apply to every case and it is not a guarantee.
Report it before you work through the rest of your list.
FBI Internet Crime Complaint Center · ic3.gov
A withdrawal from your account you did not authorize
Call your bank, say the words "unauthorized electronic transfer",
and ask them to open an error resolution claim. Do it in writing as well.
This is a different claim from a payment you made.
If someone took money from your account without your permission, whether by ACH debit,
a cloned card or account takeover, Regulation E error resolution applies, and the same
60-day clock from the statement runs. Say clearly that you did not authorize it. That
one distinction determines how the claim is handled.
12 CFR § 1005.6 and § 1005.11 · Regulation E
Cash App, Venmo, PayPal or another payment app
Report it in the app first. The FTC's instruction is to report it to
the payment app immediately and ask them to reverse the payment and refund your money.
Say clearly whether you sent the payment yourself or someone took over your account.
That distinction decides your protection. Transfers
you were tricked into authorizing are treated very differently from transfers made
without you. Say what actually happened. Then file at
reportfraud.ftc.gov.
FTC · What To Do if You Were Scammed · report it to the payment app · consumer.ftc.gov
Western Union, MoneyGram or another money transfer service
Call the transfer company's fraud line immediately and ask them to
stop the transfer and refund it. Find the number on your receipt or on the company's own
website, or in the FTC's guidance at
consumer.ftc.gov.
Do not use a number from any message. Then report at
reportfraud.ftc.gov.
If it has not been collected yet, it can sometimes be
stopped. That window is short and it closes the moment someone picks the money
up. This is worth doing within minutes rather than hours.
FTC · consumer.ftc.gov
Gift cards
Call the company that issued the card, not the shop that sold it.
The FTC lists the reporting route for fourteen card brands — Apple, Google, Amazon,
Target, Visa, Vanilla, Walmart and others — on
its
gift-card scam page. Start there. Then tell the shop where you
bought it. Keep the card and the receipt.
Sometimes the balance is still there. If the
scammer has not drained it yet, the issuer may be able to freeze it — so call as soon
as you can. Tell them a scammer tricked you into giving them the card number and PIN, and
ask for your money back. We cannot tell you how often that works, and we have no source for a general success rate, so we will not quote one. Then report at
reportfraud.ftc.gov.
FTC · What To Do if You Were Scammed · consumer.ftc.gov
Cash reload card (MoneyPak, Reloadit)
Report it to the card program, and keep the card and the receipt.
The FTC publishes the reporting route for both MoneyPak and Reloadit on
its
gift-card and reload-card page — go there for the current one rather than searching,
and never use a number or link from the message that started this.
Do it right away. The FTC's instruction for any
payment method is to contact the company you used to send the money, tell them it was
fraud, and ask them to stop or reverse it. For a reload card that company is the card
program. Then report the scam at
reportfraud.ftc.gov. We send you to the FTC's
page rather than printing a phone number here, because the FTC keeps that list current
and we would rather you reach a number that still works than one we typed once. We are
not going to tell you what legal protections these products do or do not carry — that
varies by product and by how it was funded, and we will not invent an answer.
FTC · Avoiding and Reporting Gift Card Scams (lists MoneyPak and
Reloadit) · and FTC · A way to spot scams: how someone asks you to pay · 22 July 2026 ·
consumer.ftc.gov
Cryptocurrency
Contact the exchange or the crypto ATM operator you used, straight
away. Tell them it was a fraudulent transaction and ask them to reverse it. Then
preserve every wallet address and transaction ID, and report at
ic3.gov and
reportfraud.ftc.gov.
We are not going to tell you this is likely to come
back. Crypto transfers are usually irreversible, and generally you only get
your money back if the person you paid sends it back. The exchange or ATM operator is
the one party who might still be holding it, which is why they come first. Reporting
still matters, because it feeds investigations that stop the operation reaching other
people. Anyone who contacts you promising to recover crypto for a fee is running the
second scam.
FTC · consumer.ftc.gov · FBI IC3 · ic3.gov
Cash or a check sent by mail
Call the U.S. Postal Inspection Service at
1-877-876-2455 now. If
the package has not been delivered, they can sometimes intercept it, and the FTC notes
there is a fee for doing so. If you sent a check, call your bank and ask them to stop
payment.
The two halves of this go to different places. If you posted cash, the Postal Inspection Service is the party that can act, and only while the item is still in the system — the FTC notes a domestic shipment can be intercepted for a fee if it has not been delivered. If you sent a check, it is your bank: ask for a stop payment.
U.S. Postal Inspection Service · uspis.gov · number verified 28 August 2026
I clicked a link, but I did not type anything
Update your device's security software, then run a scan and remove
anything it flags. That is the FTC's instruction for someone who clicked a link or opened
an attachment that may have installed something.
Do not go back to the page. A phishing link can
install software on your device, which is why the scan matters even though no money moved.
If you also entered a password, use the next section instead.
- Do not enter anything on that page, and close it.
- Install nothing it offered you — not a "security" tool, not an
update, not a support program.
- Watch your accounts and report anything you did not do.
FTC · How To Recognize and Avoid Phishing Scams · consumer.ftc.gov
No money moved, but they have your information
Start at identitytheft.gov. It asks what was exposed and builds a recovery plan for that specific situation, which is why it comes before anything else here — the right next step is different for a password than for a Social Security number.
If they have identity details, freeze your credit. Where a
Social Security number, date of birth or account details were exposed, a freeze with all three
bureaus is free and stops lenders opening new credit accounts using your report. It does not
undo fraud on accounts you already have, and it does not stop every kind of identity theft. If
what they got was a password, the password change and two-factor below matter more than a
freeze does.
- Change the password on any affected account, and on anything else
where you used the same one. Do it from a device you know is clean, not the one they
talked you into installing something on.
- Turn on two-factor authentication where it is offered, on email
first. Start with email because many of your other accounts use it to send password
resets.
- Call your phone carrier and ask for a port-out PIN or SIM lock if
they have your number and date of birth. A hijacked number can defeat security codes sent by text.
- Tell the institution whose account or card details were exposed,
even though nothing has happened yet, and ask them to flag the account.
- Keep the messages and alerts. Do not delete them. They are the
record of what was taken and when.
FTC · identitytheft.gov