Maybe you clicked the link.
Maybe you entered your password.
Maybe you gave someone your bank information.
Maybe you sent a verification code.
Maybe you gave out your Social Security number.
And now you are thinking:
I think I made a mistake. What do I do now?
First, focus on what you can do next.
The right steps depend on exactly what information you shared, but acting quickly can help limit the damage.
Start With One Question: What Did You Give Them?
Before doing anything else, identify exactly what happened.
Did you give someone:
A username or password?
A verification code?
A credit or debit card number?
Bank account information?
Your Social Security number?
Your date of birth or address?
Access to your phone or computer?
Money?
A photo of your identification?
Different situations require different responses.
Once you know what was exposed, you can start protecting it.
If You Gave Them a Password
Change the password as soon as possible.
Do this by going directly to the legitimate website or app — not through any link the suspicious person sent you.
Create a new password that you are not using anywhere else.
If you reused that same password on other accounts, change those too.
Then turn on two-factor authentication if the account offers it. The FTC recommends changing compromised passwords and enabling two-factor authentication when account credentials may have been exposed.
Start with the accounts that could give someone access to other parts of your life, especially your:
Email
Banking
Social media
Shopping accounts
Cloud storage
Your email account is particularly important because password-reset messages for other accounts may go there.
If You Gave Someone a Verification Code
Treat the account connected to that code as potentially compromised.
Go directly to the legitimate account and:
Change the password
Review recent logins or activity
Sign out of unfamiliar devices if that option is available
Check recovery email addresses and phone numbers
Turn on or review two-factor authentication
Do not send any more codes to the person.
A verification code is often designed to prove that you are the person trying to access an account.
If You Gave Them Your Credit or Debit Card Number
Contact the card issuer or your bank using the number printed on your card or another trusted source.
Tell them that your card information may have been compromised.
Ask what they recommend doing next.
Depending on the situation, that may include:
Replacing the card
Blocking the existing card
Reviewing recent transactions
Disputing fraudulent charges
The FTC specifically recommends contacting the bank or card issuer if you paid a scammer and asking whether a fraudulent transaction can be reversed.
Do not wait until you see a fraudulent charge before contacting them if you already know the card information was exposed.
If You Gave Them Bank Account Information
Contact your bank directly.
Explain exactly what information was shared.
Ask the fraud department what protections they recommend.
Watch your account closely for:
Withdrawals you do not recognize
Transfers
New payment recipients
Changed contact information
Other unexpected activity
If money has already moved, report it immediately.
The sooner your financial institution knows what happened, the sooner it can tell you what options may still be available.
If You Sent Money
Contact the company you used to send the payment as quickly as possible.
How you paid matters.
For example, if you used:
A credit or debit card — contact the card issuer
A bank wire — contact your bank
A payment app — report the transaction through the payment service and contact your linked bank or card issuer when appropriate
Cryptocurrency — contact the company you used to send it and report the transaction
A gift card — contact the company that issued the card and keep the card and receipt
Recovery is not guaranteed, but the FTC advises contacting the payment provider and asking whether there is any way to reverse or recover the transaction.
If You Gave Them Your Social Security Number
This requires additional attention because a Social Security number can potentially be used for identity theft.
The FTC directs people whose Social Security number may have been compromised to IdentityTheft.gov, which provides steps based on the specific situation.
You may also want to review your credit reports and consider protections such as a fraud alert or credit freeze, depending on your circumstances.
A fraud alert tells potential creditors to take additional steps to verify your identity before opening credit.
If You Gave Someone Remote Access to Your Computer or Phone
Maybe someone claiming to be “tech support” convinced you to install software or let them control your screen.
End the connection.
Then take the possibility seriously.
The FTC recommends updating your security software, running a security scan, removing anything the scan identifies as a problem, and changing passwords.
When changing sensitive passwords, it may be safer to use another device you trust until you are confident the affected device is secure.
Check Whether Anything Has Already Changed
Do not just secure the account and walk away.
Look around.
Check for:
Password changes you did not make
New email forwarding rules
New phone numbers or email addresses attached to accounts
Purchases you do not recognize
New bank transfers
Messages sent from your account
New accounts opened in your name
Password-reset emails you did not request
Sometimes the first sign of unauthorized access is a small change.
Save Evidence
Before deleting everything, save what you can.
Take screenshots of:
Text messages
Emails
Social media conversations
Payment requests
Usernames
Phone numbers
Email addresses
Websites
Receipts
Transaction numbers
You may need this information when speaking with your bank, a payment provider, law enforcement, or a reporting agency.
Report the Scam
In the United States, scams can be reported to the Federal Trade Commission through ReportFraud.ftc.gov. The FTC says reports help it identify scam patterns and support investigations and consumer education.
Internet-related fraud can also be reported to the FBI's Internet Crime Complaint Center, commonly known as IC3.
One important warning: scammers sometimes target people who have already lost money by pretending they can recover it. The FBI has warned about criminals even impersonating IC3 personnel to target previous scam victims.
Be extremely cautious with anyone who unexpectedly contacts you and promises to recover lost money for a fee.
Tell Someone You Trust
This step is easy to overlook.
Scammers often rely on embarrassment and secrecy.
Tell someone what happened.
A second person may notice something you missed or help you work through the next steps.
You do not need to solve everything by yourself before telling anyone.
Don't Let Embarrassment Stop You From Acting
Scammers can be extremely convincing.
They may know personal details.
They may impersonate legitimate companies or government agencies.
They may use fear, urgency, authority, romance, or sympathy.
What matters now is not replaying the moment when you responded.
What matters is what you do next.
Make a Simple Recovery List
When you are overwhelmed, keep it simple.
Write down:
What information did I give them?
Which accounts could be affected?
What passwords need to change?
Who do I need to call?
Did money leave my account?
What should I monitor?
Then work through the list one step at a time.
The Bottom Line
If you think you gave a scammer information, do not ignore the situation and hope nothing happens.
Identify what was exposed.
Secure the affected accounts.
Contact financial institutions when necessary.
Monitor for suspicious activity.
Save evidence.
Report what happened.
And be cautious of anyone who suddenly appears offering to “fix” the situation for money.
The moment you realize something may be wrong is not the end of the story.
It is the moment to start protecting yourself.
If it feels off now, act on that feeling — and start securing what you can.
