Not every situation requires professional analysis. Below are the steps you can take on your own, at no cost, to protect yourself and begin the reporting process after falling victim to online fraud.
Time matters. The sooner you act after discovering fraud, the better your chances of limiting the damage and preserving evidence that may be useful later.
Change the passwords on every account that may have been compromised — email, banking, social media, and any platform where you used the same credentials. Enable two-factor authentication wherever it is available. If you granted remote access to your device, revoke all active sessions and run a full malware scan. Consider the scammer had access to everything visible on your screen during the session, including saved passwords, autofill data, and open browser tabs.
Before reporting, gather and preserve all evidence related to the fraud. Take screenshots of conversations, transaction confirmations, emails, website pages, social media profiles, and any phone numbers or wallet addresses involved. Save PDF copies of bank and exchange statements showing the relevant transactions. Record dates, times, and amounts. Organise these in a single folder — this material will be needed by law enforcement, your bank, and any professional you engage later. Do not delete any communications, even if they feel embarrassing.
File a report with your local police and obtain a crime reference number — many banks and insurers require one. In the United Kingdom, report online fraud to Action Fraud (actionfraud.police.uk). In the United States, file with the FBI's Internet Crime Complaint Center (ic3.gov). For cross-border fraud, the relevant national cybercrime unit or financial regulator should also be notified. Reporting creates an official record and contributes to broader intelligence databases used to track organised fraud networks.
Notify your bank, credit card company, or payment provider immediately. If you sent funds via bank transfer, request a recall through the Faster Payments system or equivalent. For credit card payments, initiate a chargeback dispute. If cryptocurrency was involved, contact the exchange where the transaction originated — some exchanges can freeze receiving accounts if notified quickly enough. Keep a record of every conversation, including the name of the representative and any case or reference numbers provided.
Report the scammer's profiles, listings, and websites to the platforms where contact occurred. This includes social media networks, dating apps, messaging services, job boards, and cryptocurrency exchanges. Most platforms have dedicated fraud reporting mechanisms. If a fraudulent website is involved, report it to the domain registrar and to Google Safe Browsing (safebrowsing.google.com) so it can be flagged for other users. The faster a fraudulent presence is reported, the fewer additional victims it can reach.
If personal information was shared with the scammer — your full name, date of birth, address, national insurance or social security number, copies of identification documents — you should assume it may be used for identity fraud. Place a fraud alert or credit freeze with the major credit bureaus (Equifax, Experian, TransUnion). Sign up for credit monitoring services and review your credit report for unfamiliar accounts or inquiries. Continue monitoring for at least twelve months, as identity data may be sold and exploited long after the initial incident.
Beware of Secondary Scams
Victims of fraud are frequently targeted a second time by scammers posing as recovery agents, lawyers, or government officials who claim they can retrieve lost funds — for a fee. No legitimate organisation will cold-contact you offering to recover money, and no service can guarantee the return of stolen funds. If someone contacts you unsolicited about your case, treat it as a scam. Report it through the same channels listed above.
If the fraud involved cryptocurrency, complex payment chains, or sophisticated technical infrastructure, a professional intelligence report can uncover evidence that self-directed steps cannot reach.
