If your bank account was hacked or your money was stolen, the first hour matters most. Call the company that moved the money, using the number on your card or in its app. Tell them the payment was fraud, ask them to stop or reverse it, and write down who you spoke to. After that, freeze whatever the scammer can still reach, save your evidence and file a police report. Never pay anyone who offers to “recover” the money for a fee.
How we checked this
This guide is based on official guidance from the FTC, FBI IC3, the UK Payment Systems Regulator, Stop Scams UK, Stop! Think Fraud, Report Fraud, the Banco de España and INCIBE. Facts checked on September 24, 2026. It is general information, not legal advice: rules depend on your country, bank and payment type, and for a large loss, talk to a consumer lawyer or a free advice service.
Minute zero: three things for every payment type
- Call from a number you already trust. Use the number on the back of your card, in your banking app or on the provider’s website. In the UK you can dial 159, which Stop Scams UK says connects you to most major banks and never calls you.
- Use the word “fraud” and ask for a reversal. A script you can read out: “I’m reporting a fraudulent payment. On [date] at [time], [amount] went to [recipient/account/wallet]. I was tricked by [short description]. Please stop or recall the payment, ask the receiving bank to freeze the money, and open a fraud claim. What is my reference number?”
- Start a written log now. Include the date, time, name of the person you spoke to, the reference number and what they promised. The FTC says to follow up any phone report in writing and keep copies.
Evidence to save for every case: screenshots of the chat, email or text (with the sender’s number or address visible), the payment confirmation, the recipient’s account number, IBAN or wallet address, and any website links. Don’t delete anything.
Card payments (credit or debit)
Who to call: the bank that issued the card. The FTC says to report right away, whether someone used your card without permission or tricked you into paying them, and to ask for a refund.
What to freeze: the card. Once you’ve reported a lost or stolen card, you are not liable for charges made after the report, according to the FTC.
Why speed matters (US): for a credit card, the most you can owe for unauthorized charges is $50. For a debit card, the limit depends on how fast you report it. It is $50 if you report within 2 business days of learning about the loss, up to $500 after that, and possibly everything if you wait more than 60 days after your statement is sent, per the FTC’s table.
Evidence: the statement, plus a follow-up letter to the issuer’s dispute address.
Bank transfer, SEPA and wire
Who to call: your own bank, the one that sent the money. Ask it to recall the payment and contact the receiving bank.
- US: the FBI’s IC3 tells victims to contact the sending bank “as soon as fraud is recognized to request a recall or reversal,” then file a detailed complaint at ic3.gov with the banking details (IC3 Financial Fraud Kill Chain brochure). IC3’s Recovery Asset Team can ask a US receiving bank to freeze the account. In 2025 it froze $507 million of $833 million reported across 3,574 incidents, a 61% rate for cases it took on, not a promise for yours.
- UK: Faster Payments and CHAPS transfers made on or after 7 October 2024 are covered by mandatory reimbursement for authorised push payment (APP) fraud. The Payment Systems Regulator says to report within 13 months, and firms should normally pay out within 5 business days, with up to 35 business days if they need more information. The claim limit is £85,000, and firms may deduct an optional excess of up to £100. You may not be refunded if you were complicit or grossly negligent.
- Spain (SEPA): a transfer order can’t be revoked, but the Banco de España describes (in its 2016 complaints report) the banking association’s interbank fraud protocol. Your bank asks the receiving bank to hold the money, then must confirm within two business days with a copy of your police report (denuncia). The receiving bank then has three days to return what is left. File the denuncia fast. For transfers you never authorized, the bank generally must refund you immediately unless it shows fraud or gross negligence.
What to freeze: online banking, if anyone saw your login or codes. Change the password.
Instant payment apps (Zelle, Venmo, Cash App, PayPal, Bizum)
Who to call: the app first, then your bank. The FTC says to report a Venmo, Cash App or PayPal payment to the app immediately and ask for a reversal. For Zelle, it says to report the payment to your bank or credit union. For Bizum in Spain, follow the bank-transfer steps above.
What to freeze: unlink your card or bank account if the scammer may have access; change the password and turn on two-factor authentication. Screenshot the transaction ID and recipient’s username.
Crypto and stablecoins
Who to call: the exchange or crypto ATM operator you used. Tell them the transaction was fraud and ask them to reverse it, per the FTC. Then report it to ReportFraud.ftc.gov (US).
Recovery odds: low. The FTC says crypto payments are typically irreversible, lack card-style legal protections, and usually come back only if the recipient returns them.
Evidence: the transaction hash, both wallet addresses, the amount and network, and the ATM receipt. The IC3 complaint form asks for these details (IC3 FAQ).
Gift cards
Who to call: the company that issued the gift card, using the number on the back of the card. Tell them a scammer got the card number and PIN, and ask for a refund (FTC).
Evidence: keep the physical card and the receipt. The FTC says you may need them to follow up on your claim.
Report it: who to call, by country
| Where | Report to | Notes |
|---|---|---|
| US | ReportFraud.ftc.gov and ic3.gov | IC3 won’t update you on your case. Save or print your complaint when you submit it, because it’s the only copy you get (IC3 FAQ). If your case is time-sensitive, also call local police. |
| England, Wales, Northern Ireland | Report Fraud (the police national reporting centre; older pages say Action Fraud), online or 0300 123 2040 | Stop! Think Fraud |
| Scotland | Police Scotland, 101 | Stop! Think Fraud |
| Spain | A police report (denuncia), your bank, and INCIBE’s free 017 helpline (8:00–23:00 every day) | INCIBE; your bank will ask for the denuncia (Banco de España) |
If you gave away your passwords, change them and turn on two-factor authentication. If you gave away your Social Security number and it has been used, go to IdentityTheft.gov (FTC). For more steps, see our 12-point account protection checklist.
What to watch out for
The recovery scam. Once you’ve lost money, expect someone to contact you offering to get it back. The FTC says scammers buy and sell lists of people who have already paid a scammer. They pose as a government agency, a law firm or an advocacy group, then ask for an upfront “retainer fee,” “processing fee” or “tax,” or for your account numbers. The IC3 says it does not work with law firms or crypto services to recover money and will never contact you directly to ask for information or money. If you get a check for more than you lost, don’t deposit it. That’s a known version of the same scam.
For other patterns, see AI scams that steal money in 2026.
