What to Do If You Get Scammed: First 48 Hours (2026)

The night the money disappears, most victims do exactly what the scammer hopes. Some confront the fraudster in the chat window — which tells a professional operation it is time to burn the evidence. Most say nothing at all, frozen by shame, while the stolen funds move down a laundering chain that gets harder to trace by the hour.

Here is what to do if you get scammed, in order: stop all contact without announcing it, document everything before you delete anything, call your bank or card issuer within the hour, and report the crime at ic3.gov and reportfraud.ftc.gov — or Action Fraud if you are in the UK. If your crypto moved through a legitimate exchange, open a fraud ticket with that exchange today. And when the “recovery agents” find you — they will find you — ignore every single one. That is the second scam, precision-built for people in your exact situation.

Speed beats perfection. The FBI's Recovery Asset Team froze roughly $561.5 million in fraudulent transfers in 2024, succeeding in two-thirds of cases — but intervention works best inside the first 24 to 72 hours. After that, the money is usually beyond reach.

The first hour: cut the line, quietly

Stop replying. No goodbye message. No “I know what you are.”

Silence is not politeness — it is tactics. The instant a scammer realizes you have caught on, the operation flips into liquidation mode: the Telegram group dissolves, the platform goes “under maintenance,” the number dies, and whatever you had not captured is gone. Worse, the exit script ends with one last extraction — a “withdrawal tax,” an “unlock fee” — that victims pay precisely because they are panicking.

Stay dark while you work; every message you send is a countdown timer on their evidence destruction.

If the scheme was the long con called pig butchering — weeks of romance, then a trading platform — brace for emotional whiplash too. The person you trusted may never have existed; the hands typing those messages may belong to another victim. The UN human rights office estimates at least 120,000 people in Myanmar, and roughly 100,000 in Cambodia, may be held in compounds and forced to run these scripts. Anger is natural. Aim it at the operation.

Document everything — then delete nothing

Memory degrades fast, and the platform is already evaporating. Tonight, build a folder:

• Every wallet address they ever gave you. Each “deposit address” is a lead.
• Transaction hashes (txids) for every crypto transfer, copied from your exchange history and screenshotted.
• The platform's URL and every mirror domain. Run each through our guide on how to check if a website is legit — domain age often tells the story.
• Usernames, phone numbers, email addresses, Telegram and WhatsApp handles, profile photos.
• Full chat logs — export where the app allows, screenshot where it doesn't, and keep the “boring” small talk; that is where investigators find the script.
• Bank statements, wire confirmations, card receipts — whatever the payment rail was.
• A written timeline: first contact, first deposit, every amount, every date. Write it tonight. In two weeks you will get details wrong, and details are what make a complaint actionable.

Screenshots die with dead platforms. Export the originals while you can.

Call your bank. Then the exchange.

If you wired money, call your bank's fraud line — the number on the back of your card, never one the scammer gave you — and demand an immediate wire recall, then file at ic3.gov within the same hour. The FBI's Financial Fraud Kill Chain exists for exactly this, and intervention works best within 24 to 72 hours, before the funds hop to the next account. That window is why the clock starts now, not after you have slept on it.

Paid by credit card? Dispute the charges as fraudulent; chargeback mechanics are slow but real. Debit cards carry fraud protections too, and your liability grows the longer you wait — report immediately. Either way, freeze the card the scammer touched and assume anything you typed into their site is compromised.

If you sent crypto from a regulated exchange — Coinbase, Kraken, Gemini — open a fraud ticket with the transaction hash and destination address. Compliance teams can flag the receiving wallet, and if the funds land at another exchange that verifies its customers, a freeze is genuinely possible; that is how the small number of real recoveries happens. Self-custody wallet to a stranger's address, with no exchange in the path, is the hardest case there is. Investigators hear it every day.

Then lock down your own house. New passwords everywhere the scam touched, email first — it is the master key to everything else. Turn on two-factor authentication. Revoke any “trading bot” API keys. Check login histories for devices you do not recognize.

Where do you report a crypto scam?

Whatever else you read about what to do if you get scammed, these three reports are the non-negotiable core. File them in this order, within 24 hours:

1. The FBI's IC3 at ic3.gov. Paste in the wallet addresses, transaction hashes, URLs, and your timeline. You will receive a complaint ID — every agency you contact next will ask for it.
2. The FTC at reportfraud.ftc.gov. Ten minutes, plain language. Your report enters the Consumer Sentinel database shared with law enforcement — the FTC logged $12.5 billion in reported fraud losses for 2024, investment scams the largest category at $5.7 billion.
3. In the UK, Action Fraud at actionfraud.police.uk or 0300 123 2040 — in Scotland, call Police Scotland on 101. You will receive a crime reference number.

Large loss? Call your local FBI field office and file with your state attorney general. ID documents compromised? Open a file at identitytheft.gov. And file even if the case feels small: in 2024 the IC3 took in more than 859,000 complaints totaling $16.6 billion, including nearly 150,000 crypto-related complaints worth $9.3 billion. Those numbers are not just statistics. They are fuel.

In January 2024 the FBI launched Operation Level Up, which uses IC3 complaint data to find people being scammed in real time and calls them — mid-con, mid-romance — to say so. In its first year it notified 4,323 victims of cryptocurrency investment fraud; three out of four had no idea. The estimated savings came to $285.6 million, and 42 victims were referred to suicide intervention, which tells you how deep these hooks go. For thousands, an agent's phone call was how they learned the person they loved did not exist. Your complaint is how the next one gets found.

Should you pay a “recovery agent”?

This is the part nobody warns you about, so we will.

Within days — within hours, if you have posted about the scam anywhere public — the messages start. An “ethical hacker” who can reverse the blockchain. A “forensics firm” that has already located your coins. A lawyer who “handles exactly this kind of case.” Sometimes a fellow victim in a support forum who happens to know a guy.

Every one of them is the second wave. Scam operations sell victim lists, and a freshly burned target who has already proven they will pay is the hottest lead in the industry; the pitch is engineered for the state you are in right now — ashamed, and in a hurry to undo the story.

The tells never vary. They contact you first. They guarantee results, or quote suspiciously precise odds. They want money up front — a retainer, a tool fee, a tax on the recovered amount — and when you pay there will be another fee, and then another, until you stop. No legitimate specialist works this way: real ones work through court orders served on identified exchanges, take cases with substantial sums, and do not live in your DMs.

The FBI has watched this long enough to start warning about it. In July 2026, IC3 described criminals impersonating IC3 itself — AI-generated videos of a senior FBI official, spoofed complaint portals, fake agents on Facebook Messenger offering to “update” your report. The Bureau's position could not be plainer: “IC3 will never ask for payment to recover lost funds, nor will IC3 refer someone to a company requesting payment for recovering funds.”

We investigated this ecosystem in Recovery Scams: The Second Fraud — read it before you answer any message. If one stranger on the internet possesses a tool that reverses irreversible transactions, ask yourself why they need your $500 to switch it on.

Your first 48 hours, hour by hour

These are the crypto scam recovery steps that actually move money — the rest is noise:

Hours 0–1. Stop replying. Start the evidence folder — addresses, txids, URLs, chats, receipts, timeline.

Hours 1–4. Call your bank or card issuer: wire recall, chargeback, or card freeze. Open the exchange fraud ticket.

Hours 4–8. File at ic3.gov and reportfraud.ftc.gov — Action Fraud in the UK. Note the reference numbers. ID compromised? identitytheft.gov.

Hours 8–24. Change passwords, email first. Turn on two-factor authentication. Check login histories. Freeze the compromised card. Tell one person you trust — secrecy is how the second wave gets you alone.

Hours 24–48. File with your state AG; call the FBI field office for large losses. Screenshot everything still online. Ignore every unsolicited recovery offer — read our breakdown of recovery scammers so you recognize the script.

It will arrive.

Then stop refreshing the block explorer and breathe. The mechanics are done. What remains is patience — and not paying anyone who promises to shortcut it.

What not to do

Don't pay a “withdrawal tax.” There is no tax — there is only another payment.

Don't send crypto to “verify” your wallet, share your screen, or hand your ID to a “compliance officer” from the platform.

Don't confront the scammer while reports are pending, or post their wallets with a bounty attached — you will get scammed twice and spook the one channel law enforcement watches.

And don't carry this alone. These operations employ scripted psychology, A/B-tested platforms, and shifts of workers refining the approach on thousands of targets at once. You were not outsmarted by an individual; you were processed by an industry. If a recovery firm has already reached out, tell our team — we track these networks, and your message becomes evidence someone else can use.

Frequently asked questions

Can I get my money back after a crypto scam?

Sometimes, but rarely through the blockchain itself — crypto transactions are final by design. Real recoveries happen at the rails around it: wire recalls inside the 24–72-hour window, card chargebacks, and exchange freezes when funds land at a platform that verifies customers. In 2024 the FBI's Recovery Asset Team froze roughly $561.5 million in fraudulent transfers, succeeding about two times out of three. File at ic3.gov fast, with transaction hashes, and give those mechanisms something to work with.

Should I pay a company that promises to recover my funds?

No. Upfront-fee recovery is the second most reliable payday in the scam industry — after the original scam. The pattern never changes: unsolicited contact, guaranteed results, a retainer, then more fees until you stop paying. The FBI states flatly that IC3 will never ask for payment to recover lost funds, and warns that criminals now impersonate IC3 itself. Our investigation of recovery scams lays out the full playbook. Legitimate asset-recovery lawyers exist, but they work through courts, not DMs — and they guarantee nothing.

How quickly do I need to report a crypto scam?

For a wire transfer, treat 72 hours as the hard ceiling — the window in which the FBI's kill-chain process can realistically freeze funds. For everything else, the answer is simply now: platforms vanish, wallets rotate, and memory starts improvising details within days. A late report still aggregates with others and feeds operations like Level Up — but a fast one can actually move money back.

The scammer has my ID and address. Am I in danger?

Physical danger is rare — these operations want money, not confrontation, and most are based overseas. The real risk is identity misuse: your documents get sold or reused to open accounts. Start a recovery plan at identitytheft.gov, place a fraud alert or credit freeze with the credit bureaus, and watch your statements. If anyone threatens you, that is a separate crime — report it to police and include it in your IC3 complaint.

I feel stupid for falling for it. Is it my fault?

No — and that feeling is the last thing the scam is still doing to you. These are industrial operations: tested scripts, fake platforms engineered to show exactly the right numbers at exactly the right moment, professional closers brought in when you hesitate. The FTC logged $12.5 billion in reported losses for 2024; the IC3 counted $16.6 billion more. Doctors, engineers, and police officers appear in those spreadsheets. Smart people get scammed because the system was built to defeat smart people. Report it, warn someone else, and let the shame die where it belongs — with the criminals.

Frequently asked questions

Can I get my money back after a crypto scam?+

Sometimes, but rarely through the blockchain itself — crypto transactions are final by design. Real recoveries happen at the rails around it: wire recalls inside the 24–72-hour window, card chargebacks, and exchange freezes when funds land at a platform that verifies customers. In 2024 the FBI's Recovery Asset Team froze roughly $561.5 million in fraudulent transfers, succeeding about two times out of three. File at ic3.gov fast, with transaction hashes, and give those mechanisms something to work with.

Should I pay a company that promises to recover my funds?+

No. Upfront-fee recovery is the second most reliable payday in the scam industry — after the original scam. The pattern never changes: unsolicited contact, guaranteed results, a retainer, then more fees until you stop paying. The FBI states flatly that IC3 will never ask for payment to recover lost funds, and warns that criminals now impersonate IC3 itself. Our investigation of [recovery scams](/reviews/recovery-scams-second-fraud) lays out the full playbook. Legitimate asset-recovery lawyers exist, but they work through courts, not DMs — and they guarantee nothing.

How quickly do I need to report a crypto scam?+

For a wire transfer, treat 72 hours as the hard ceiling — the window in which the FBI's kill-chain process can realistically freeze funds. For everything else, the answer is simply now: platforms vanish, wallets rotate, and memory starts improvising details within days. A late report still aggregates with others and feeds operations like Level Up — but a fast one can actually move money back.

The scammer has my ID and address. Am I in danger?+

Physical danger is rare — these operations want money, not confrontation, and most are based overseas. The real risk is identity misuse: your documents get sold or reused to open accounts. Start a recovery plan at [identitytheft.gov](https://www.identitytheft.gov/), place a fraud alert or credit freeze with the credit bureaus, and watch your statements. If anyone threatens you, that is a separate crime — report it to police and include it in your IC3 complaint.

I feel stupid for falling for it. Is it my fault?+

No — and that feeling is the last thing the scam is still doing to you. These are industrial operations: tested scripts, fake platforms engineered to show exactly the right numbers at exactly the right moment, professional closers brought in when you hesitate. The FTC logged $12.5 billion in reported losses for 2024; the IC3 counted $16.6 billion more. Doctors, engineers, and police officers appear in those spreadsheets. Smart people get scammed because the system was built to defeat smart people.

About the investigator

Dana Whitfield

Technology journalist · narrative investigations

Dana Whitfield has covered the intersection of technology and fraud for twelve years, tracing pig-butchering compounds, fake exchange networks and the boiler rooms behind them across three continents.

All investigations by Dana →