I have just sent money to a scammer — what do I do in the first hour?
A UK-specific procedure in order — the fraud line, the recall, the accounts, the evidence — written to be worked through while it is still happening.
- Difficulty
- beginner
- Time
- 1 hr
- Read
- 5 min
- Safety
- warning
Short answer
Ring your bank's fraud line right now: 159, or the number on the back of your card. Say the words "I have been the victim of a scam, I need to report a fraudulent payment and request a recall". Then, from a device you trust, change your email password, then your banking password. Write down times and amounts as you go. Report to Action Fraud afterwards, not before.
This page assumes it has already happened and that you are shaken. Work down it in order. The order matters more than the detail: money first, because it is the only part that is time-critical; access second; evidence third; reporting last, because Action Fraud cannot stop a payment and your bank can.
Safety
What you'll need
- Your bank card, for the number on the back
- A phone that the scammer has not been in control of
- Somewhere to write times, amounts and names
- A second device you trust, for password changes (optional)
Step by step
- Ring the bank now, on 159 or the number on your card.Not the app chat, not email, not tomorrow. Fraud lines are staffed overnight. If you are on a landline the scammer called, use a mobile, or wait several minutes for the line to clear first.
- Use the right words.Say you are reporting a scam, that you were deceived into making the payment, and that you want it recorded as authorised push payment fraud and a recall requested. Ask for the reference number before you hang up.
- Give them the payment details exactly.Date, time, amount, sort code, account number and the account name you were given. If there were several payments, list them all, including small ones. The receiving bank can only freeze what it is told about.
- Ask them to block the card and check for anything else.Ask whether new payees, new devices, changed contact details or pending payments have appeared on the account, and have them removed. Ask whether any other account of yours has been touched.
- Disconnect any device the scammer controlled.If you installed anything at their request or let them see your screen, turn off its Wi-Fi and mobile data and stop using it for anything financial. Everything below is done on a different device.
- Change your email password first, then banking.Email is the reset route for every other account, which is why it comes before the bank's own login. Then turn on two-factor authentication on both if it is not already on.
- Sign out of all other sessions.Most services have a "sign out everywhere" option in security settings. It ends any session the scammer still holds, which a password change alone does not always do.
- Write the timeline down while it is fresh.Times, amounts, phone numbers, names used, what was said, what you clicked, what you installed. Every stage after this — the bank's investigation, Action Fraud, the Ombudsman — asks for it, and memory degrades fast.
- Report to Action Fraud, or Police Scotland on 101.Do this after the bank, not before. You get a crime reference number that the bank and any insurer will ask for. In Scotland, report to Police Scotland on 101.
- Tell one person.A partner, a friend, an adult child. Not for the money — for the next twenty-four hours, which is when the follow-up approach usually arrives and when a second opinion is worth most.
- Refuse every offer of help that arrives unsolicited.Anyone who contacts you in the following days offering to recover the money is committing a second fraud, including if they claim to be your bank, the police or the Ombudsman.
Tips
- If you paid by card rather than transfer, say so — card payments have chargeback and, above a threshold, Section 75 joint liability, which are different and often better routes.
- If you paid in cryptocurrency, tell the exchange as well as the bank, immediately. Recovery is unlikely but exchanges can sometimes freeze an account that has not yet cashed out.
- Keep every message, screenshot and email. Do not delete the conversation in disgust — it is the evidence for the claim.
Common mistakes
- Waiting until the branch opens — Criminal accounts are emptied within minutes to hours. The overnight call is the one that sometimes recovers money; the morning call almost never does.
- Changing passwords on the compromised device — If remote-access software or a keylogger is present, the new password is captured as you type it. Use a different device.
- Reporting to Action Fraud first — Action Fraud is an intelligence and reporting service. It does not contact your bank or stop payments. The bank is the only party who can act in the first hour.
- Assuming a small first payment is not worth reporting — It establishes the pattern, it is often followed by larger ones, and reporting it early strengthens the reimbursement claim.
Questions people ask
Will my bank get the money back?
Sometimes, if the receiving account still holds it, which depends almost entirely on speed. Separately, most sterling transfers between UK accounts fall under mandatory reimbursement rules — that is a claim rather than a recovery, and there is a separate guide here on how it works.
Should I close my bank account?
Usually not immediately. Ask the bank — they may move you to new account details rather than closing, and closing an account in the middle of a fraud investigation complicates the claim.
What if the bank says it was my own fault?
That is a decision you can challenge. Get their reasoning in writing, complain formally, and take it to the Financial Ombudsman Service, which is free. There is a guide here on that route.
Should I tell the police as well as Action Fraud?
Action Fraud is the police reporting route for fraud in England, Wales and Northern Ireland. Ring 999 only if you are in immediate danger or someone is at your door.