When Things Go Wrong: The First Hour, Day and Week

You clicked. You typed. You said yes on the phone. Now you have that cold feeling in your stomach. First, you are in good company. In 2025 the FBI's Internet Crime Complaint Center (IC3) logged 1,008,597 complaints and $20.877 billion in reported losses. People age 60 and older filed 201,266 of those complaints and reported $7.748 billion lost, an average of about $38,500 each (IC3 2025 report, as of October 2026). The Federal Trade Commission (FTC) counted 3 million fraud reports and $15.9 billion in reported losses for 2025 (FTC, March 2026). Those are only the people who reported.

Doctors, retired teachers, bankers and engineers are in those numbers. Scammers are professionals. They work in teams, rehearse scripts and study fear. Being fooled by a professional is not a character flaw.

The first hour

The order matters. Do the first item on your list, then the next. Do not try to fix everything at once.

What happened	Do this first	Then
Clicked a link or opened an attachment, typed nothing	Close the page or file. Do not click anything else on it.	Run a virus scan (steps below). Delete the message.
Typed a password on a fake page	From a different device, change that password. Change it anywhere you reused it.	Turn on two-step sign-in. Sign out of all devices.
Read out a text code or tapped Approve	Go to that account's security page and sign out all other devices.	Change the password. Check the recovery phone and email.
Let someone control your computer	Turn off Wi-Fi or unplug the network cable.	Scan, remove the remote program, change passwords from another device.
Sent money	Call your bank or the company you paid, on a number you trust.	Report to the FTC and IC3. Keep every receipt.
Gave your Social Security number	Go to IdentityTheft.gov and report it.	Place a credit freeze at all three bureaus.
Email or social account taken over	Use the provider's recovery page to get back in.	Change password, sign out everywhere, check forwarding rules, warn contacts.
Phone lost or stolen	Use Find My or Find Hub to lock it. Call your carrier.	Change your Apple or Google password. Tell your bank.
Files locked, ransom note on screen	Unplug the network cable or turn off Wi-Fi. Do not pay.	Report to IC3. Restore from a clean backup.

Cut the connection

If anyone might still be inside your computer, remove their road in. On Windows 11, click the Wi-Fi icon at the bottom right and turn Wi-Fi off, or pull the cable out of the back of the computer. On a Mac, click the Wi-Fi icon at the top of the screen and turn it off. On an iPhone, swipe down from the top right corner and tap the airplane icon. On Android, swipe down from the top and tap Airplane mode. Menu names move between versions, but the airplane icon is nearly universal.

Powering off is a second choice. CISA's ransomware guide says to isolate affected systems from the network first, and says powering down is for when you cannot disconnect, because shutting off can erase useful evidence held in memory (CISA).

Use a clean device

A "clean" device is one the scammer never touched: a family member's phone, a library computer, or your phone if only the laptop was involved. Change passwords there. If the scammer has software on your laptop, a new password typed on that laptop goes straight to them.

Who to call, in what order

1. Your bank or card company. Use the number on the back of your card or on your statement, never a number from a message. Ask them to stop or reverse the payment, freeze the card and watch the account.
2. Yourself, from a clean device. Change passwords: email first, then banks, then everything else.
3. The company or app you paid through, if it was Zelle, Venmo, Cash App, PayPal, Western Union, MoneyGram, a gift card brand or a crypto exchange.
4. The FTC at ReportFraud.ftc.gov. If your identity was used, also IdentityTheft.gov.
5. The FBI's IC3 at ic3.gov. The IC3 report says to file "regardless of the amount lost."
6. A person you trust. A spouse, a grown child, a friend. Not for permission. For company.

Money: how long you have

How you paid decides what is possible. This table follows the FTC's guidance (FTC, as of October 2026).

You paid with	Who to contact	What the FTC says, and the catch
Credit card	The number on the card, or the app	Report right away and ask for a refund. For an unauthorized charge your limit is $50 at most, and often $0 if reported before it is used.
Debit card	The number on the card, or your bank's app	The cap is $50 if you report within 2 business days, up to $500 after that, and potentially all of it after 60 calendar days from the statement date.
Zelle or bank transfer	Your bank, immediately	Ask them to reverse it. Banks do not always agree if you sent the money yourself.
Wire (Western Union, MoneyGram)	The wire company, immediately	Tell them a scammer tricked you and ask for a refund.
Payment app (Venmo, Cash App, PayPal)	The app, immediately	Ask for a reversal and refund.
Gift card	The issuer, on the card's back	Keep the card and receipt. Tell them a scammer got the number and PIN.
Cryptocurrency	The exchange or ATM operator	Say it was fraud and ask them to reverse it. Crypto lacks the legal protections of cards, so recovery is hard.
Cash by mail	Postal Inspection Service, 1-877-876-2455	For a domestic package not yet delivered, they may be able to intercept it, for a fee. For FedEx or UPS, call the carrier.

Two facts from that table are worth repeating. Card payments have the strongest legal protection. Anything where you pushed the money yourself, such as a wire, gift cards or crypto, is the hardest to get back.

The FBI has a team that tries to freeze stolen money before it leaves the banking system. In 2025 its Recovery Asset Team handled 3,900 incidents with $1.164 billion in attempted theft and froze $679 million of it, about 58 cents on the dollar. For victims 60 and older it was 642 incidents with $65.4 million reported lost and $32.9 million frozen (IC3 2025 report, pages 17 to 18). The catch is speed: this works when the money is still moving, which is why you call the bank and report to ic3.gov on the same day.

If a stranger had remote access

The FTC's steps are short: update your security software, run a scan and remove what it finds, then change your passwords and turn on two-factor authentication (FTC). Here is how to do that.

Windows 11

1. Click Start, then Settings, then Windows Update, and install any updates.
2. Go to Settings, Privacy and security, Windows Security, Virus and threat protection, then Scan options. Choose Microsoft Defender Antivirus (offline scan) and click Scan now. The computer restarts and takes about 15 minutes.
3. Go to Settings, Apps, Installed apps. Look for remote-control programs you do not remember installing, such as AnyDesk, TeamViewer or any "support" tool. Click the three dots beside it and choose Uninstall. Windows also has a built-in tool called Quick Assist, which scammers have used. If you did not start a Quick Assist session on purpose, there is nothing to uninstall, but the session should be closed.

Mac

1. Apple menu, System Settings, General, Software Update.
2. Open Finder, then Applications. Drag any remote-control program you do not recognize to the Trash.
3. Go to System Settings, General, Login Items and Extensions, and turn off anything unfamiliar.

iPhone and Android

True takeover of an iPhone by a phone-call scammer is rare. The usual trick is to get you to install an app or read out a code. On an iPhone, go to Settings, General, VPN and Device Management, and remove any profile you did not set up. On Android, open Settings, Apps and remove anything unfamiliar. Then open the Play Store, tap your profile picture, tap Play Protect and tap Scan. If a scammer asked you to turn on a special setting, such as Accessibility access for an app, turn it off in Settings, Accessibility. If the phone still acts strange, a factory reset after a backup is a fine last step, and the phone maker's support line can walk you through it.

If your email or social account was taken over

Email is the master key to everything else, so this one is urgent. The FTC lists the recovery pages for Google, Microsoft, Yahoo, Facebook, Instagram, WhatsApp and others at consumer.ftc.gov. After you get back in:

• Change the password to a long one you have never used elsewhere.
• Sign out of all devices from the account's security page.
• Turn on two-step sign-in, ideally with an authenticator app or a passkey.
• Check the recovery email and recovery phone number. Make sure they are yours.
• Look for forwarding rules you did not create, and delete them. A forward quietly copies your mail to a stranger.
• Look through the Sent and Deleted folders for messages you did not write.
• Tell your contacts. A quick note works: "My email was hacked. Do not click links from me this week, and ignore any request for money."

If your phone is lost or stolen

1. From a computer or another phone, find your device. On iPhone, sign in at icloud.com/find, pick your phone and choose Mark as Lost. On Android, go to android.com/find, pick the phone and choose Secure device. Google has been renaming this service, so look for Find Hub or Find My Device.
2. Call your wireless carrier and ask them to suspend the line, or at least block the SIM. This stops texts with login codes from reaching a thief.
3. Change your Apple Account or Google account password. That signs the phone out of your accounts.
4. Tell your bank if any banking app was on the phone. Watch your accounts for a few weeks.
5. Do not erase the phone remotely until you are sure you will never get it back. Erasing also removes the ability to track it.

If you were hit by ransomware

Ransomware locks your files and shows a message demanding payment. The FBI says plainly: it "does not support paying a ransom," because payment does not guarantee you get your data back and it encourages more attacks (FBI). IC3 recorded 3,611 ransomware complaints in 2025 with more than $32 million in reported losses, a small slice of the total but a painful one for each victim.

1. Disconnect the computer from Wi-Fi and unplug any backup drive. If a backup drive stays plugged in, the ransomware can scramble it too.
2. Take a photo of the ransom note with your phone.
3. Report it at ic3.gov or to your local FBI field office.
4. Do not use the same computer to look up fixes. Use a phone.
5. If you have a clean backup (lesson 11 explains how), you wipe the computer and restore. If you do not, a trusted repair shop or the maker's support line may be able to help, and some ransomware has free decryption tools that law enforcement knows about.

If you gave out your Social Security number

Go to IdentityTheft.gov, the FTC's site. You answer questions and get a free recovery plan: step-by-step actions, pre-filled letters and forms for credit bureaus, businesses and debt collectors, and advice for more than 30 types of identity theft (FTC). If you are unsure whether the number was used, the FTC points you to IdentityTheft.gov/databreach.

Then protect your credit. A fraud alert is free, lasts one year and is placed by contacting one bureau, which tells the other two. A credit freeze is also free and is placed at each bureau: Equifax, Experian and TransUnion. The FTC says there is no cost to place or lift a freeze (FTC). A freeze is stronger. It stops most new accounts opened in your name until you lift it. Idaho also has a Credit Report Protection Act (Idaho Code 28-52-101 to 109) covering security freezes. Lesson 08 walks through freezing step by step.

Keep evidence

Evidence helps your bank, the FTC, the FBI and, if the case goes anywhere, the people who investigate it. Start a simple log on paper or in a note on your phone. Write down:

• Dates, times and how long each call lasted
• Phone numbers, email addresses, website addresses and names the person used
• What they said, in plain words, as best you remember
• Amounts, payment method, receipts, gift card numbers and transaction numbers
• Screenshots of messages, pop-ups and account activity, with the date visible

Do not delete the messages. Do not wipe your computer yet if you are still reporting, unless it is ransomware or the machine is clearly unsafe. Take photos of anything you cannot save. If the scammer used text messages, forward the text to 7726 (SPAM) and keep a copy.

Who to report to

Agency	Report what	How
FTC	Any scam or fraud	ReportFraud.ftc.gov
FTC	Identity theft and your recovery plan	IdentityTheft.gov
FBI IC3	Internet crime of any size, ransomware, wire fraud	ic3.gov
National Elder Fraud Hotline (age 60 and up)	Any fraud. A case manager helps with federal, state and local reporting.	1-833-372-8311 (1-833-FRAUD-11), weekdays 10 a.m. to 6 p.m. Eastern
AARP Fraud Watch Network Helpline	Talk it through, get guidance and emotional support	1-877-908-3360, weekdays 8 a.m. to 8 p.m. Eastern. Anyone may call.
Social Security OIG	Social Security scams	oig.ssa.gov/report
Senior Medicare Patrol	Medicare fraud, billing errors, fake Medicare calls	1-877-808-2468
Idaho Attorney General, Consumer Protection Division	Complaints about businesses and scams affecting Idahoans	Online complaint form at ag.idaho.gov, 208-334-2424 or 1-800-432-3545
Idaho Commission on Aging and your Area Agency on Aging	Suspected abuse or financial exploitation of an older person	208-334-3833 or 1-877-471-2777. Regional lines: Central 1-800-574-8656, East 1-800-632-4813, North 1-800-786-5536, Southwest 1-844-850-2883. In immediate danger, call 911.
Local police	A police report is useful for banks and identity theft, and required for some forms	Non-emergency line

One warning from the Elder Fraud Hotline itself: scammers have impersonated hotline staff and threatened lawsuits to get information or money. The real hotline will not ask for your Social Security number or money. If someone calls you claiming to be from it, hang up and dial 1-833-372-8311 yourself.

Do not pay to get your money back

After a scam, your name sits on lists. Within days a call or email may arrive from a "recovery company," a "government agent" or even a "lawyer" who says they found your money and need a fee, a tax payment or your bank login to release it. That is a second scam. Real agencies do not charge victims. Reporting to the FTC, IC3, your bank and the Elder Fraud Hotline costs nothing. Hang up. If you have any doubt, call the AARP helpline at 1-877-908-3360 and describe what was said.

The emotional side

Shame is the scammer's best friend. It keeps people quiet, and quiet gives the scammer time and gives the next victim no warning. Many people feel angry at themselves, lose sleep, or stop answering the phone. Those feelings are normal and they pass faster when someone knows. The AARP helpline says it offers "emotional support," and the Elder Fraud Hotline assigns a case manager who stays with you. Tell one person tonight.

Getting help from family

If you are the grown child, be careful about the first words you say. "How could you fall for that?" ends the conversation. Try "I'm glad you told me. Let's fix this together." Sit beside your parent while they make the bank call. Offer to be the person who handles phone calls for a few weeks. Do not take over the accounts or the phone without being asked. Lesson 11 covers how to help an aging parent without taking over, and how to set up a family code word before anything happens.

Questions and answers

How fast do I really have to act?

Minutes matter most when money is moving, because banks can sometimes stop a transfer before it finishes. For card fraud, the debit card rule gives you the best terms in the first 2 business days. For everything else, report as soon as you realize it. A late report is still worth making.

Should I change all my passwords?

Change email first, then bank and card accounts, then anything that holds money or personal details. If you reused the password the scammer saw, change every account that used it. A password manager makes this far less of a chore. Lesson 03 covers that.

What if I am afraid to tell my bank?

Bankers hear this every week. They want to know early because early gives them options. You will not be judged by the person on the phone, and the call is private.

Do I have to report to the police?

You are not required to, but a police report helps with identity theft forms and some bank claims. You can file online or at the non-emergency line in many places. Report to the FTC and IC3 either way.

Is it safe to keep using the computer after a scam?

If you ran a scan, removed remote tools, updated everything and changed passwords from another device, yes. If you still see odd windows, slow behavior or programs you did not install, have the maker's support, a trusted repair shop or a knowledgeable family member look at it, or reset it after a backup.

Will the scammer come back?

Often, yes, with a new story. Scam lists get sold. Put your numbers on the Do Not Call Registry, let unknown calls go to voicemail for a while, and treat any "refund" call as the same scam wearing a new coat.

What if the scammer has my phone number and email?

They have it already, and so do thousands of others. Your numbers are not secret. What matters is the codes and passwords, which you can change. Turn on a PIN or lock for your phone account with your carrier.

Should I close my bank account?

Usually not. A new account number is a good step if the number was shared. Your bank can open a new account and move your automatic payments. Ask them what is best for your case.

My grandchild's voice called for money. How do I check?

Hang up and call that grandchild, or their parent, on the number you already have. If you do not have a family code word, make one this week. Lesson 07 covers this scam in detail.

Hard questions

What if I already sent a lot and the bank says no?

That can happen when you sent the money yourself, by wire, gift card or crypto. Banks are only required to reverse certain unauthorized transactions. Keep reporting. File with the FTC, IC3 and your state, tell the Elder Fraud Hotline, and ask your bank in writing for its decision. Write down the name of everyone you speak to. Even when money does not come back, your report can help freeze money in other victims' cases.

Is paying a ransom ever the right call?

The FBI does not support it. Payment does not guarantee a working key, it marks you as someone who pays, and it funds the next attack. For a home computer with family photos, the honest hard truth is that photos with no backup may be lost. That is the reason lesson 11 is about backups before trouble comes.

I was embarrassed and waited two weeks. Is it too late?

No. You lose some options on money, and some chances to freeze funds are gone. You still can freeze your credit, change passwords, file reports and stop the next loss. Do it today.

Should I stop using the internet or my phone?

No. Pulling away from banking apps, family video calls and email costs you more than the scammers took. The goal is a few habits and a plan. The remaining lessons build both.

What if a family member was the one who took my money?

Financial abuse by someone close is more common than most people think. You can call the Idaho Commission on Aging at 1-877-471-2777 or your Area Agency on Aging, and the National Elder Fraud Hotline. Adult Protective Services handles reports of abuse and exploitation of vulnerable adults. If you are in danger, call 911.