What this tutorial says in five lines
- Preserve evidence before anything else — accounts get closed and sites vanish.
- Call your bank and card issuer the same hour; short deadlines govern disputes.
- Never pay a second fee to retrieve the first loss. That is the repeat fraud.
- Write down the sequence of events while it is still precise.
- Reporting is not an admission. It is the only step that creates a chance of recovery.
Why this matters
The hour after you understand what happened is the worst possible time to be deciding what to do, because the decisions are urgent, irreversible and made under shock. This tutorial is written to be followed step by step without judgement calls. It is not a consolation piece; it is an ordered checklist, and the order matters.
First: stop, and preserve
The instinct is to fix it immediately — call someone, transfer something, delete the app in disgust. Almost all of those actions destroy evidence or move money. Before anything else, capture what exists right now, because access can end without warning.
Do not delete the app, the chats, or the emails. Do not close the account. Do not confront the fraudster with what you have discovered, because that tells them to clean up whatever they have not yet removed.
- 01Screenshot the conversations, the platform pages, the balance, and the transaction history — including timestamps and the URLs in the address bar.
- 02Export chat history to a file if the app supports it. Exports carry metadata that screenshots lose.
- 03Write down every wallet address you sent funds to, and every transaction hash you can find.
- 04Note the sequence of events with times: when you were contacted, when you deposited, when you tried to withdraw, what was said.
- 05Save the profile links, usernames, phone numbers, email addresses and any documents they sent you.
Do not tell the fraudster that you know. It feels cathartic for a moment and costs you the remaining evidence every time.
Second: the time-critical calls
This is the only part of the checklist where minutes change outcomes. Which call to make first depends on how you paid — not on the total amount lost.
| How you paid | Call first | Deadline reality | What to say |
|---|---|---|---|
| Debit or credit card | Your card issuer's fraud line | Often days, not weeks — and shorter for some card networks | "These are unauthorised transactions and I need them disputed as fraud" |
| Bank transfer | Your bank's fraud team | Recall is only sometimes possible, and only within hours | "I sent this under false pretences and need an urgent transfer recall" |
| Payment app | The app's support, then your bank | Minutes to hours | "This was a scam-induced transfer, I need it flagged immediately" |
| Crypto from an exchange | The exchange's compliance team | Immediate, while funds may still be on-chain at a known address | "Please flag these destination addresses as fraud-related" |
| Crypto from self-custody | Nobody can reverse it — go straight to reporting | Evidence value only | Focus entirely on the report and the destination addresses |
| Gift cards | The card issuer, then the retailer | Minutes — codes are drained fast | "The card number and PIN were obtained by fraud" |
Make the card or bank call first, even if crypto is the larger part of the loss. Card and bank routes have actual dispute mechanisms; a blockchain transfer does not.
Third: report, properly
Reporting is not an admission of foolishness and it is not pointless. It creates a dated record, it feeds the pattern data that gets platforms shut down, and in some jurisdictions it is a prerequisite for later civil action.
- 01File with IC3.gov — the FBI's Internet Crime Complaint Center — attaching your evidence rather than describing it.
- 02File with ReportFraud.ftc.gov so the pattern enters the consumer-protection dataset.
- 03File with your national consumer or financial regulator if one exists in your country.
- 04Report the receiving addresses to the exchange or custodian named in the trail, if one is identifiable.
- 05Report the fake platform or site to the hosting provider and to any domain registrar visible in a lookup.
- 06Keep the reference numbers from every report. They matter if the case is later linked to others.
The order that recovers the most (and the least)
Different actions have wildly different recovery rates, and they are not ordered by how comforting they feel. The chart below compares them, which is why the quiet administrative calls come first and the public ones come later.
Measured value of each action in the first hour
Relative recovery contribution across reported cases
Reading: The bottom row is zero for a reason: no upfront-fee recovery service has produced a verified return in any published dataset. The top three rows are unglamorous phone calls with hard deadlines, which is exactly why they work.
The second wave: what arrives next
Within days, other people will contact you. Some will be legitimate. Some will be the same operation, better informed, because they know the details of your case — they were there when it happened.
| Who approaches | How they present | How to verify |
|---|---|---|
| "Recovery specialist" | They can get it back for a fee, or a percentage | Nobody can reverse a blockchain transfer. A fee upfront is the entire fraud. |
| "Cyber investigation agency" | Official-sounding, offers to trace for a retainer | Check the company registration independently, and never grant remote access. |
| "Legal firm" | A demand letter for a court fee | Contact the real bar association or law society; ask for a licence number. |
| A "fellow victim" in a group | Shared suffering, then an introduction to a helper | Common re-victimisation route. Never act on an address from a DM. |
| A genuine bank investigator | Calls from a number you can verify | Hang up and call the bank on the number printed on your card. |
| A genuine law-enforcement officer | Contact through official channels | Verify through the agency's published contact, never through a link they send. |
After a loss, your name and case details circulate on lists of confirmed victims. Being contacted is expected; acting on it without independent verification is how people lose twice.
Telling people, and looking after yourself
Shame keeps victims silent, and silence is the fraud's best protection. It also delays the two actions that matter most — the bank call and the report.
- 01Tell one person you trust today. Not because they can recover anything, but because you will make better decisions in the next 48 hours if you are not alone.
- 02Tell your bank everything, including the parts that feel embarrassing. Their fraud team has heard it all and incomplete information slows the dispute.
- 03Do not borrow money to "rescue" the loss. That is the mechanism by which a bad month becomes a financial crisis.
- 04Expect that the acute phase passes. It reliably does. The practical steps above are what shorten it, because they replace helplessness with an ordered list.
- 05Keep the documentation you built in step one. If anything is later recovered, or a case is opened, that record is what allows you to be included.
One rule to carry out of this tutorial: never send money to get money back. Every repeat fraud depends on breaking it.
The visual summary
Everything above, reduced to the four stages that matter for this topic. If you only look at one thing on this page, look at this.
Where this fits in the pattern
Before contact
Nothing has happened yet. This is when every tutorial here is most useful and costs you nothing but reading.
During the approach
The script is running. The verification tests in this tutorial are designed to be run here, neutrally, without confrontation.
At the money request
The decisive moment. Any request for funds, fees, taxes or unlock deposits is the end of the script, not a stage of it.
After a loss
Prevention is over; evidence work begins. Preserve, report, and never pay a second fee to recover the first.
Common questions
Build the report while the details are fresh
Enter what you have and generate a formal complaint, a cover email to your bank or exchange, and a print-ready legal draft — free, in your browser.
Primary sources and further reading
- FTC — Scams That Follow a Scam consumer.ftc.gov
- FBI — Common Scams and Crimes www.fbi.gov
- CISA — Cybersecurity Best Practices www.cisa.gov
External links open in a new tab so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Prevention only works if it reaches people before the contact does.
Disclaimer: this tutorial is general information, not legal, financial or recovery advice, and is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.