Table of Contents
Realising you have been scammed is disorienting and frightening. But the first day matters more than any other, because stolen crypto moves fast and evidence disappears faster. This is a calm, ordered checklist for that window. Work through it in sequence — securing what is left, preserving what happened, and reporting before the trail goes cold.
Two things first.
Stop all contact with the scammer, and do not send another cent — especially not to "unlock," "release," or "tax" your funds. That request is always an advance-fee scam.
Hour 1: Secure what is left
Before anything else, make sure the bleeding stops.
- 1
Move remaining crypto to safety
If you still hold funds in a wallet the scammer may have touched — or whose seed phrase you may have exposed — move them to a brand-new wallet with a fresh seed phrase now.
- 2
Revoke token approvals
If you connected your wallet to any site, revoke its permissions using a token-approval tool, so a drainer cannot keep pulling funds.
- 3
Freeze the money trail
Call your bank or card issuer. If you paid via card or transfer, ask them to stop, recall, or dispute the payment immediately — speed can still catch it.
- 4
Lock down accounts
Change passwords and enable two-factor authentication on your email, exchange, and bank accounts, especially if you shared any details.
If a seed phrase or private key may have leaked, treat that wallet as lost for good — our guide to private key vs seed phrase explains why and what to do.
Hours 2–6: Preserve the evidence
Evidence is what makes every later step possible. Capture it before apps are deleted or chats vanish.
| Save this | Why it matters |
|---|---|
| Transaction hashes | The unique receipts proving each transfer — the backbone of any trace |
| Wallet addresses | Where your money went; the thread investigators follow |
| Chat logs & profiles | Establishes the deception and the people involved |
| Fake platform screenshots | Shows the scam site, your "balance," and withdrawal blocks |
| Payment records | Bank transfers, card statements, exchange purchase history |
Note the network each payment used, and keep everything in one place. Our explainers on what a transaction hash is and wallet addresses help you find these quickly.
Hours 6–24: Report to the right places
Reporting is not a formality — it is what enables a fund freeze, feeds investigations, and, where schemes exist, opens the door to restitution.
- 1
Report to law enforcement
File with your national fraud body — the FBI's IC3 and the FTC in the US, Action Fraud in the UK, Scamwatch in Australia, or ScamShield in Singapore.
- 2
Notify any exchange involved
If funds moved through a regulated exchange, alert its compliance team through official channels with the addresses and hashes — this is where a freeze can happen.
- 3
Tell your bank in writing
Follow up any phone report in writing, and ask specifically about your reimbursement or dispute rights for your country.
- 4
Do a quick self-trace
Follow the first hops on a blockchain explorer to strengthen your report — but leave deep tracing to professionals.
Your rights at the bank stage depend entirely on where you are: see our guides to the UK, Australia, Singapore, and the US. Our full reporting guide walks through the paperwork.
What not to do
Protect yourself from the second scam.
Do not respond to anyone who contacts you promising to recover your funds for an upfront fee — they read victim reports and complaints to find you. It is a recovery scam, and it targets people at their most desperate.
Finally, be gentle with yourself. These operations are professional and psychologically sophisticated; being caught by one is not a sign of foolishness. Once the urgent steps are done, read our honest assessment of whether stolen crypto can be recovered so your expectations stay grounded and you avoid throwing good money after bad.
Frequently asked questions
Is it too late if it has already been a few days?
No — still do everything on this list. Recovery odds drop with time, but reports remain valuable for investigations, potential freezes, and any future restitution program. Later is far better than never.
Should I confront the scammer to get my money back?
No. Cut contact. Confronting them only warns them to move funds faster and can expose you to further manipulation or threats.
Who should I actually report to first?
Your bank or card issuer (to try to stop the money) and your national fraud reporting body. If a specific exchange received the funds, alert it too. Do all three as fast as you can.
Key takeaways
- Act in order: secure remaining funds, preserve evidence, then report — all within 24 hours.
- Move any at-risk crypto to a new wallet and revoke token approvals immediately.
- Save transaction hashes, addresses, chats, and screenshots before anything disappears.
- Report to your bank and national fraud body fast; your refund rights depend on your country.
- Ignore upfront-fee recovery offers — they are a second scam aimed at victims.
Know someone who needs this? Share it.
Scambulance will never ask for your private keys, passwords, or seed phrases. Anyone promising guaranteed fund recovery is likely a scammer.