What to do in the first hour after being scammed

Read this part first

If you have just realised money has gone, three things are true and worth saying plainly before anything else.

**Stop paying immediately.** Whatever the next requested payment is — a fee to release funds, a tax, a verification deposit, a final instalment, a charge to unlock your account — do not send it. The single most common way a moderate loss becomes a severe one is that the person continues paying for hours after the first doubt appeared, because stopping feels like accepting the loss. It is not. It is capping it.

**This was engineered.** These operations are built by people who do this full time, tested on thousands of targets, and refined until they work. Being deceived by a professional deception is not a character flaw, and the shame that follows is itself part of the mechanism — it is what keeps people from telling their bank quickly, which is exactly what the fraudster needs.

**Speed matters more than completeness.** An imperfect report made in the next twenty minutes is worth far more than a perfect one made tomorrow. Act now, tidy the details later.

This article is general education. It is not legal, financial or personalised advice, procedures vary by bank and country, and nothing here guarantees recovery.

Why the first hour is different: three clocks

The order of the steps below is not arbitrary. It follows from three independent timers that all start the moment you pay.

**The settlement clock.** Some payments have a window before funds finally settle or during which a recall can be attempted. Card payments, domestic transfers, international transfers and crypto transactions each behave differently, and the windows range from very short to effectively zero. You cannot know from the outside which applies, and that is the point: the only way to be inside a window is to act as though you are.

**The hop clock.** Received funds do not sit still. They are typically moved onward within minutes to hours — split across accounts, passed through intermediaries, converted, and pushed across borders. International standards exist that make tracing possible in principle, through customer identification and transfer traceability obligations on regulated institutions, but the process is slow relative to the speed at which funds move.Source^source Practically, this means the chance of freezing anything falls sharply once funds have hopped.

**The evidence clock.** Chat threads get deleted by the other side. Accounts disappear. Websites go dark. Apps revoke your access. Screenshots you did not take in the first hour are frequently impossible to take in the second.

Three clocks, three different jobs. That is why the sequence is Stop, Freeze, Report, Preserve, Contain, Record — and why "Report" comes before "Preserve" even though preserving feels more urgent.

Minute 0 to 5: Stop and freeze

**Stop all outbound payment.** Send nothing further, sign nothing further, and approve no pending authorisation. If a transfer is scheduled but not yet executed, cancel it.

**Do not close the conversation yet.** Resist the urge to block, delete or angrily confront. You need what is in that thread, and confrontation tells the recipient to move funds and disappear. Silence is more useful to you than a final message.

**Freeze what can be frozen.** If you have banking app access, use the card freeze or lock control for any card involved. If you gave card details, freeze that card. If you gave online banking credentials, this is also the moment to change that password — but only from a device you are confident is clean.

If you granted remote access to your computer at any point — a "support technician", a "bank security team", any screen-sharing or remote-control software — disconnect that device from the internet now, and do not use it for any of the steps that follow. Use a phone or another machine.

Minute 5 to 20: Report to the money, not the story

This is the highest-value block of the hour. Contact the institutions that actually hold or move money, in order of how much of your exposure sits with each.

**Your bank, first.** Call the fraud number printed on your card or in the official app. Do not use a number from a search result, and do not use any number the other party gave you.

Say these words early in the call, because they route you correctly: _"I believe I have been the victim of a scam. I have made a payment I want to report. Can you attempt a recall and place a block?"_

Have ready:

• Date, time and exact amount of each payment
• The payee name, account number, IBAN, card details or wallet address you sent to
• The reference used
• How you were contacted and what you were told
• Whether you shared any credentials, codes or documents

Then ask three specific questions and write down the answers:

1. Can a recall or chargeback be attempted, and by when must it be initiated?
2. Is my account being blocked, and what is the reference number for this report?
3. What is the next step and when should I expect contact?

Licensed banks operate under supervision and are expected to handle fraud reports; if the response is unsatisfactory, a regulatory complaint route exists and is worth knowing about from the start.Source^source

**Then every other money-holding party**, in the same call-block:

• Card issuers, if a different card was used
• Payment apps and wallets
• The crypto exchange, if you bought or sent through one — ask specifically whether they can flag the destination address and freeze anything still with them
• Any investment platform holding a balance
• The receiving bank, if you can identify it. This is often overlooked and sometimes the most effective single call, because that bank can act on the account actually receiving funds.

**Police.** Fraud and cybercrime should be reported to the relevant police authority, and a formal report is normally a prerequisite for anything further — bank escalation, insurance, employer notification, or any cross-border cooperation.Source^source Do this within the hour if you can; a report number unlocks doors that stay closed without one.

If credentials or documents were shared

Handle this in parallel, not afterwards, because it addresses ongoing access rather than a completed loss.

• **Banking or platform passwords shared:** change them from a clean device, then sign out all other sessions.
• **Email password shared:** treat this as the most serious item on the list. Change it, then check for added recovery phone numbers or emails, unfamiliar forwarding and filter rules, and unknown connected apps. An attacker who keeps the inbox keeps the ability to reset everything else.
• **One-time codes read aloud:** assume the associated account is compromised, not merely exposed.
• **ID documents sent:** photographs of a passport, Emirates ID, licence or utility bill can be used to open accounts in your name. Note precisely what was sent and when, include it in your police report, and watch for unexpected account-opening or credit correspondence.
• **Remote access granted:** assume anything stored or typed on that device was seen. Change the important passwords from a different device first, then deal with the affected machine.

Minute 20 to 40: Preserve the evidence

Now capture everything, on the assumption it will vanish. Take screenshots rather than relying on the platform continuing to exist.

Collect:

• The full conversation thread, scrolled from the beginning, including the profile page, display name, handle, phone number and any changes to them
• The website address, spelled exactly, plus screenshots of key pages and any documents, licence claims or certificates shown
• Every payment confirmation and bank reference
• The destination details — account number, IBAN, name on the account, wallet address, transaction hash
• Any app screens showing your "balance", positions or withdrawal requests
• Emails with full headers where your provider allows it
• Names, titles and phone numbers used by anyone who spoke to you

Two practical notes. Save copies off the device, to cloud storage or another machine, in case the device is later compromised, wiped or handed over. And record the _timeline_ in plain sentences — first contact, first payment, what was promised, what triggered your doubt — while it is fresh. That narrative is what an investigator reads first, and it is far harder to reconstruct next week.

Do not delete the app or block the contact until you have captured everything. Blocking feels decisive and is the single most common way people destroy their own evidence.

Minute 40 to 60: Contain the spread

A scam rarely stays inside the account it started in. Spend the last block closing adjacent exposures.

• **Review recent activity** across all accounts, not just the affected one, going back further than the incident. Look for small unfamiliar transactions, which are often used to test whether details work.
• **Check for changed contact details** on your financial accounts — a changed email or phone is a sign of ongoing access rather than a one-off loss.
• **Cancel recurring authority.** If you gave card details, look for subscriptions or standing authorisations set up quietly.
• **Warn the people around you.** If the approach came through a group, a community, a workplace or a family chat, others are being worked at the same time. Tell them plainly what happened. This is often the highest-value thing you do all hour, and it is also the step that shame most reliably prevents.
• **Tell your employer** if a work account, work device or work email was involved. Reluctance here turns a personal problem into an organisational one.

The second scam is coming: recovery fraud

You need to know this now, before it arrives.

Within days to months, you will likely be contacted by someone offering to recover your money. They may present as a law firm, a blockchain forensics specialist, a government recovery unit, a regulator, or a fellow victim who succeeded. They will often know real details of your case — the amount, the platform name, the dates — because victim lists are traded, and because it is frequently the same operation running a second pass on people it has already tested.

The request will be an advance payment: a retainer, a filing fee, a tracing charge, a tax, a bond, a "release fee" on funds they claim to have located.

Apply one rule with no exceptions: **money that is genuinely coming to you never requires money to leave you first.** Real recovery, where it happens at all, runs through your bank, the police and the courts — routes you initiate, using contact details you found yourself on official sites, not routes that find you.

Be especially careful with anyone who claims to be from a regulator or police force and contacts you first. Verify by calling that body on a number you obtained independently.Source^source A genuine authority will not object.

Setting expectations honestly

It would be kind and wrong to imply that fast action usually restores the money.

Recovery is possible and does happen, particularly when the payment was made by card, when the transfer was domestic and reported within a short window, when the receiving account is at a bank that can still freeze a balance, or when funds are still sitting with a regulated exchange. Speed materially improves each of those.

Recovery is unlikely once funds have been converted, moved across several institutions or jurisdictions, or withdrawn. International standards support tracing in principle, but the cooperation involved operates on a timescale of weeks and months while the money moves in minutes.Source^source

So the honest framing of the first hour is this. Its primary purpose is to stop the second loss — further payments, ongoing account access, and identity misuse. Its secondary purpose is to buy a chance at recall while a window may still be open. Recovery is a possible outcome of doing the right things quickly, not the reason to do them.

Outcomes on reimbursement vary by jurisdiction, by product, and by circumstance, and where a bank's handling of your case seems inadequate there is generally a documented complaint escalation route to follow.Source^source

After the hour: the days that follow

Once the immediate block is done, three things carry the case forward.

**Keep one file.** A single folder or document holding the timeline, every reference number, every person spoken to with date and time, and copies of all evidence. Cases are frequently lost to disorganisation rather than to a decision on the merits.

**Follow up on a schedule rather than on emotion.** Ask each institution when you should expect an update, note the date, and chase on it. Ask in writing for confirmation of what was reported and what was done. Written records are what escalation runs on.

**Attend to the human part.** The financial damage is measurable; the effect on sleep, trust and confidence often lasts longer and is under-discussed. Telling one person you trust is not a weakness in your response — it is part of it, and it materially reduces the chance of being drawn into the recovery scam later.

The short version

If you remember nothing else from this article, remember the sequence and the one rule.

1. Stop paying. Now, and permanently.
2. Freeze cards and lock accounts you can reach.
3. Call your bank's official fraud number, then every other money-holding party, then the police.
4. Screenshot everything before you block or delete anything.
5. Secure your email specifically, and any account whose credentials or codes were shared.
6. Warn the people in the same room, group or workplace.
7. Write it all down, with reference numbers.

And the rule that protects you from what comes next: **no one who genuinely owes you money will ask you to pay them first.**

Source^source: Central Bank of the UAE — https://www.centralbank.ae

Source^source: UAE Ministry of Interior — https://www.moi.gov.ae

Source^source: Financial Action Task Force — https://www.fatf-gafi.org