You gave a scammer a password, card number or remote access: triage it

A scam incident can involve several independent losses: account credentials, a payment method and access to a computer. Changing a password alone does not reverse a transfer; cancelling a card does not remove a remote-control tool. A short incident checklist helps you cover each route without trusting someone who claims they can recover everything for a fee.

Before you start​

Write down what you actually shared, installed or paid and when. Use a trusted device for account recovery if the affected computer may still be remotely controlled.

Do it step by step​

1. If a remote session is active, disconnect it and turn off network access on that device. Uninstall the tool using trusted instructions and seek qualified local help if you cannot assess the device.
2. Change exposed passwords from a clean device, revoke active sessions where available and update recovery email, phone and second-factor settings.
3. Contact the bank, card issuer or payment company immediately for any money sent or card information exposed. Ask about stopping, recalling or disputing the exact transaction.
4. Preserve receipts, chat logs, phone numbers and case references. Report the scam to the appropriate platform and consumer authority.
5. Monitor accounts for further activity and tell affected contacts if the attacker used your identity to approach them.

Check the result​

Each exposed route should have a recorded response: device cleaned or isolated, accounts secured, payment provider contacted and reports filed.

If something goes wrong​

A refund or reversal is not guaranteed. Do not pay an unsolicited 'recovery specialist' or provide further account access while investigating.

Know the limit​

Resetting a password does not remove malware, and a device scan may miss some persistence. When sensitive systems were controlled by a stranger, a rebuild or professional inspection may be needed. FTC what-to-do-after-a-scam guide