If you have been scammed online, act within the first hour. Call your bank first, then report the scam, then lock down your accounts. Speed matters because a bank can sometimes stop or reverse a payment before it clears. This checklist puts every step in the right order, with the UK reporting routes and refund rules explained in plain terms.

Step 1: Stop Contact and Call Your Bank

Do not reply to the scammer. Do not click any more links. If you gave them remote access to your device, disconnect from the internet and end the session straight away.

Call your bank immediately. Use the phone number printed on the back of your bank card. If you cannot find it, call 159. This is Stop Scams UK, a service that connects you safely to your bank’s fraud team. Criminals fake bank phone numbers, so never trust a number from a text message, an email or a search ad.

Tell the bank exactly what happened. Share the amount, the time of the payment and any account details the scammer gave you. Ask them to try to recall or freeze the payment. Write down the case reference number they give you.

If you paid with a credit or debit card, the card provider may also be able to block the transaction or start a dispute. Mention every payment you made, even small ones.

Step 2: Report the Scam

Reporting helps the police track scammers and protects other people. In England, Wales and Northern Ireland, report online fraud to Report Fraud, the national reporting centre. Use the website at reportfraud.police.uk or call 0300 123 2040. In Scotland, report to Police Scotland on 101.

Forward the scam text message to 7726 free of charge. Forward scam emails to report@phishing.gov.uk. If the scam pretended to be from HMRC, forward texts to 60599 and emails to phishing@hmrc.gov.uk. HMRC never sends texts about tax refunds, so a refund text from HMRC is always fake.

Keep your evidence. Save screenshots of messages, emails, adverts and payment confirmations. Do not delete the conversation thread. Investigators may need the exact wording and the sender details.

Step 3: Lock Down Your Accounts

Start with your email account. Email is the reset hub for almost everything else. Change its password to a long, unique one and then turn on two factor authentication on your email before anything else.

Next, secure your bank and payment accounts with new passwords. Then move through social media, shopping and cloud accounts one by one. Never reuse the same password across accounts. A leaked password from one service can unlock many others.

Check for signs the scammer is still inside your accounts. Look at the sent folder for messages you did not write. Check email rules and filters, because scammers sometimes add forwarding rules to hide their activity. Review connected apps and active sessions, and sign out of devices you do not recognise.

If you think your identity details were stolen, apply for CIFAS protective registration. This places a warning flag on your credit file and costs £30 for two years. It makes lenders run extra checks before granting credit in your name.

Step 4: Get Your Money Back

Whether you get a refund depends on how you paid. Know the rules before you complain, because banks sometimes reject claims they should pay.

Bank transfer scams (APP scams): since 7 October 2024, UK banks must reimburse victims of authorised push payment scams up to £85,000 per claim, and must pay within five business days in most cases. The sending and receiving banks split the cost equally. You do not need to prove the bank was at fault. Claims above £85,000 may still be paid voluntarily by your bank.

Credit card payments: Section 75 of the Consumer Credit Act 1974 makes your card provider jointly liable for purchases between £100 and £30,000. If the goods never arrived or the seller was a fraudster, write a Section 75 claim to your card provider.

Debit card payments: ask your bank for a chargeback through the card scheme. You usually have around 120 days from the payment date. Chargeback is a scheme rule rather than a law, but banks handle these claims every day.

Gather your evidence before you complain: the bank’s case reference, screenshots, the scammer’s details, and a short written timeline. If the bank rejects a fair claim, escalate to the Financial Ombudsman Service. It is free and its decisions are binding on the bank.

Step 5: Watch for Recovery Scams

Scammers keep lists of past victims. A common follow-up is the recovery scam: someone contacts you, claims they can get your money back, and asks for an upfront fee. Real organisations never charge you to return stolen money. Ignore these approaches and report them too.

Expect more phishing attempts in the weeks after a scam. Criminals use stolen details to send targeted messages that reference your real situation. Stay sceptical of unexpected calls, texts and emails, even ones that seem to know your name.

Check your credit report with the free services from ClearScore, Credit Karma and Experian. Look for accounts or searches you did not make. If anything looks wrong, dispute it and consider the CIFAS flag mentioned above.

Frequently Asked Questions

Will my bank refund me if I was scammed?

Often, yes. For bank transfer scams, UK rules require reimbursement up to £85,000 per claim within five business days in most cases. For credit card purchases between £100 and £30,000, Section 75 makes your card provider jointly liable. Debit card payments can usually be disputed through chargeback within about 120 days.

What is the first thing I should do after an online scam?

Call your bank straight away using the number on your card or 159. A fast report gives the bank the best chance of stopping the payment. Then stop all contact with the scammer and do not click any more of their links.

Where do I report an online scam in the UK?

Report to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Forward scam texts to 7726 and scam emails to report@phishing.gov.uk. HMRC scams go to 60599 for texts and phishing@hmrc.gov.uk for emails.

How do I secure my accounts after a scam?

Change your email password first, then your banking passwords. Turn on two factor authentication everywhere, starting with email. Check sent folders, email forwarding rules and connected apps for anything the scammer added.

What are recovery scams?

Recovery scams target people who have already lost money. A stranger offers to recover your funds for an upfront fee, then disappears with the fee. No genuine police force, bank or government agency will ask you to pay to get your money back.

How can I check if my email was in a data breach?

Use a free breach checker to see whether your address appears in known leaks. A breach often leads to targeted phishing, so it is worth checking if your email was in a data breach and then changing any reused passwords.

Conclusion

Being scammed online is not a sign of stupidity. These schemes are designed by professionals and they catch millions of people. What matters is how fast you respond. Call your bank, report to Report Fraud, lock down your accounts and pursue every refund route available. Work through this checklist in order, keep your evidence, and do not let shame stop you from reporting. Every report makes the next scam harder to run.