The recovery playbook: what to do in the first 72 hours after a scam

Discovering you've been scammed brings a wave of shame that makes people go quiet and do nothing — which is exactly what the scam needs. Recovery is a race against clocks: payment reversals expire, funds get moved offshore, and reporting windows close. The people who get money back are almost never the smartest victims; they're the fastest ones. This is a triage playbook for the first 72 hours, ordered by what stops the bleeding soonest. Work top to bottom, and don't wait to feel ready — the money doesn't care that you're embarrassed.

Hour 0–1: stop the bleeding

1. Cut off access immediately. If you gave account logins, remote-desktop access, or card numbers, change passwords, revoke any remote-access software (AnyDesk, TeamViewer), and enable app-based 2FA before doing anything else.
2. Call the payment source, not the scammer. Phone your bank, card issuer, or the payment app and say the words 'fraud' and 'unauthorized' — those trigger different, better handling than 'I made a mistake.'
3. Try to reverse the payment. Card charges can be disputed; some bank wires and app payments can be recalled if you move within hours. Speed is everything — ask specifically for a wire recall or ACH reversal.
4. Freeze your credit at all three bureaus. If any personal data was exposed, this blocks the follow-on new-account fraud that scammers commit weeks later.

Hour 1–24: document and dispute

Once access is cut and reversals are requested, build the paper trail that every downstream process will demand. Screenshot everything — messages, transaction records, the scammer's phone number, email, wallet address, and any website. Write a plain timeline of what happened and when. This documentation is what turns a bank dispute, a police report, and an insurance claim from 'your word' into a case. For card disputes, file in writing (not just by phone) to preserve your rights under the Fair Credit Billing Act, and get every claim number in writing.

Hour 24–72: report to the right places

Reporting does two things: it occasionally recovers money (especially wire and crypto fraud, where the FBI can sometimes claw back funds fast), and it creates the official record that unlocks bank reversals, insurance, and tax write-offs later. Report to all of the relevant channels — they don't overlap the way you'd expect, and each serves a different purpose.

• FTC at ReportFraud.ftc.gov — the national clearinghouse; generates a report you can use everywhere else.
• FBI's IC3.gov — critical for wire and crypto fraud, where a fast report can trigger a recovery request to the receiving bank.
• IdentityTheft.gov — if personal data was stolen; it builds a recovery plan and an official identity-theft affidavit.
• Your local police — a report number is often required by banks and insurers even if police can't investigate directly.
• The relevant platform — the bank, card network, payment app, crypto exchange, or marketplace where it happened.
• Your state attorney general and, for investment fraud, the SEC or CFTC.

Week 1 onward: repair and rebuild

1. Follow up on every dispute in writing and track deadlines — banks have defined timelines to resolve fraud claims, and you can escalate to the CFPB if they stall.
2. Place a fraud alert or keep freezes on at the bureaus, and pull your credit reports to catch any new-account fraud early.
3. Replace compromised credentials and rebuild account security with app-based 2FA and unique passwords.
4. Save documentation for taxes — some theft losses may be deductible, and you'll want the paper trail if the case ever moves.
5. If the emotional toll is heavy, tell someone; isolation is what makes people vulnerable to the second-wave recovery scam.

The bottom line

Recovery is a footrace, and shame is what makes people lose it. In the first hour, cut off access and demand reversals; in the first day, document everything and dispute in writing; in the first three days, report to the FTC, IC3, and your bank to unlock every downstream remedy. Then freeze your credit, watch for the second-wave 'recovery' scam, and rebuild your security. The victims who get money back aren't the ones who never make mistakes — they're the ones who move within hours instead of days.