Scammed? What to do in the first hour, and after

The first hour, in order

Stop all contact first. Hang up, stop replying, don’t open anything else they send, and don’t let anyone back onto your computer or phone.

Then your bank. If you sent money or shared card or account details, ring the bank straight away on the number on the back of your card, or dial 159. 159 puts you through to your own bank, cannot be spoofed and will never ring you, so any call claiming to come from 159 is a scam. Don’t assume it is free: the cost depends on your phone provider and is often the national rate. Tell the bank which payments were the scam and ask what it can stop or recall.

Then your passwords, starting with email. Whoever controls your email can reset almost everything else, so change that one first, then online banking, then anything sharing the same password. The National Cyber Security Centre says to turn on 2-step verification for your most important accounts (email, banking, social media, online shopping) even where the password is strong. If the scammer was given remote access to a device, don’t use it for banking until it has been checked and secured.

If you feel threatened or unsafe, call 999 before any of this. In England and Wales, Citizens Advice also says to ring the police on 101 straight away if the scammer is in your area or you transferred money to them in the last 24 hours.

Report it: the right service for your nation

The reporting service changed recently and many pages haven’t caught up. Since 4 December 2025, fraud and cyber crime in England, Wales and Northern Ireland is reported to Report Fraud, run by City of London Police, which replaced Action Fraud; the full public launch followed in January 2026. Report online at reportfraud.police.uk or phone 0300 123 2040 (unchanged from Action Fraud), Monday to Friday, 8am to 8pm. Relay UK users dial 18001 then 0300 123 2050. You get a crime reference number, which can help when you deal with your bank.

Report Fraud is not an emergency service. If you are in immediate danger, dial 999.

Scotland is not covered by Report Fraud. If you live in Scotland or the crime happened there, report it to Police Scotland on 101, through its online form or in person at a station, and on 999 in an emergency.

Northern Ireland uses Report Fraud for the crime reference number, with one extra route. Phone PSNI on 101 (999 in an emergency) and ask for a ‘call for service’ if the fraud is happening now or happened within the last 24 hours, you know the suspect and they live in Northern Ireland, the victim is vulnerable, or evidence needs securing or a loss preventing. You can also report to Consumerline, which can pass the case to NI Trading Standards and the National Scams Team.

Texts, emails, calls and adverts

These take a minute each. Forward scam texts free to 7726 (it spells SPAM on a keypad), which alerts your mobile provider. For a scam call, copy or share the caller’s number in a text to 7726, also free. If you lost money or gave details, report the call as above too. Forward suspicious emails to report@phishing.gov.uk, where the National Cyber Security Centre investigates them. HMRC impersonations go to phishing@hmrc.gov.uk, or 60599 for texts; scam post goes to Royal Mail on 0800 011 3466.

If it began with a paid-for advert online, report it to the Advertising Standards Authority too; it works to get scam ads removed but won’t reply personally. Our deepfake adverts guide covers how those ads work, and the voice cloning guide covers calls that sounded like someone you know.

Getting the money back: bank transfers

If you were tricked into paying by UK bank transfer (Faster Payments or CHAPS, from one UK account to another) on or after 7 October 2024, mandatory reimbursement rules apply, currently run by the Payment Systems Regulator. Your bank must normally refund you, up to £85,000 per claim, a cap the regulator says covers over 99% of claims. Report the payment to your bank as soon as you can, and within 13 months. Reimbursement should arrive within 5 business days; if the bank needs longer to investigate, it must reach an outcome within 35 business days.

Two limits to know about. The bank may take an excess of up to £100, or less, or none, but never from a customer it should treat as vulnerable. And it can refuse if you were complicit or grossly negligent, which the regulator calls “a high bar” and which again does not apply to vulnerable consumers.

The rules are mostly working. The regulator’s dashboard shows 88% of the money lost to in-scope scams (£316m) was reimbursed between October 2024 and March 2026, and in the first three months of 2026, 82% of claims were closed within five business days and 98% within 35.

International payments are outside the rules. So are card, cash and cheque payments, which have separate protections: if you paid by card, ask your bank early what applies, including a chargeback.

If the bank says no

Complain to the bank and ask for a final response in writing. For fraud, scam and payment complaints the bank has 15 days to reply, not the usual eight weeks. If it refuses, or the deadline passes, you can take the complaint to the Financial Ombudsman Service, which is free, within 6 months of the date on the final response. You must usually have complained to the bank within 6 years of the problem, or 3 years of realising you had cause to.

The Ombudsman can award up to £455,000 for complaints referred on or after 1 April 2026 about events on or after 1 April 2019 (£205,000 for earlier events). Older pages still quote lower limits.

Afterwards: your identity, and the second approach

If personal details went with the money (date of birth, address, account numbers, ID), consider Cifas Protective Registration. It costs £30 for two years and places a warning flag against your name in the National Fraud Database, so organisations run extra checks before approving applications. It is for individuals, applied for online, doesn’t affect your credit score and doesn’t cover card transactions. Cifas won’t remind you when it expires, so put the date in your calendar.

Be ready for a second approach: ‘recovery’ fraudsters contact people who have already been scammed, offering to get the money back for an upfront fee. The FCA says these approaches usually come from webmail addresses (Gmail, Yahoo, Hotmail, Yandex), and that the FCA, government, law enforcement and law firms never use webmail to contact consumers. Treat any later call about the original scam, from ‘the bank’, ‘the police’ or a firm you have never heard of, the same way: hang up and ring back on a number you already have, or 159 for your bank.

The same goes for calls that sound like family. A family safe word settles those in seconds; The Family File is gaining a ‘Scams and our safe word’ page to record who knows it, never the word itself.

If you want to talk to someone: the Citizens Advice consumer helpline is 0808 223 1133 (Welsh-language 0808 223 1144), Monday to Friday, 9am to 5pm; the Age UK Advice Line is 0800 678 1602, 8am to 7pm every day of the year; Victim Support’s Supportline is 08 08 16 89 111, free, 24 hours a day, independent of the police, and for England and Wales only. In Scotland, Advice Direct Scotland gives consumer and scam advice on 0808 164 6000.

Keep a record

Write these down now, in one place, before the details blur: the date and time of every contact and every payment; each amount, and the account or card it left from; the name, phone number, email address or website the scammer used; screenshots of messages and adverts; when you told your bank, and who you spoke to; and your crime reference number. Your bank, and the Ombudsman if it gets that far, will ask for parts of this, and the 13-month and 6-month clocks run from dates you will want to be sure of.