What to do in the first 72 hours after a scam

Speed matters more than anything else you will do. Stolen crypto is typically moved through mixers, bridges, or exchanges within hours to days. Once funds reach a compliant exchange, a freeze becomes possible — but only if someone asks in time.

Work through this in order.

Hour 0–1: stop the loss

1. Send nothing further. Not a fee, not a tax, not a verification deposit. Every additional payment is the same fraud continuing.
2. Do not warn the operator. Telling them you know often triggers account closure and deletion of the records you need. Simply stop responding.
3. If a wallet may be compromised, move remaining assets to a new wallet with a freshly generated seed phrase — created on a clean device. Do not reuse the old seed.
4. Revoke token approvals for any contract you interacted with, using a reputable revocation tool.
5. If bank payments or cards are involved, call your bank's fraud line immediately and ask explicitly for a payment recall or indemnity claim. Ask for a case reference.

Hour 1–4: preserve everything

Evidence degrades fast — accounts get closed, chats get deleted, sites go offline.

• Screenshot every conversation in full, including profile pages, usernames, and visible timestamps.
• Export chat histories where the app allows it (Telegram, WhatsApp, Discord all support export).
• Save every transaction hash, wallet address, and deposit instruction.
• Archive the platform's website — save the page, and submit the URL to a public web archive so a timestamped third-party copy exists.
• Record every email header in full, not just the message body.
• Write a dated timeline while your memory is fresh: first contact, each payment, each promise.

Detailed instructions are in How to preserve evidence for an investigation.

Hour 4–24: report to the authorities

Filing a report creates an official record, may connect your case to an existing investigation, and is often required before an exchange will act.

• United States — FBI IC3 (ic3.gov), the FTC (reportfraud.ftc.gov), and your state attorney general. CFTC or SEC where investment products are involved.
• United Kingdom — Action Fraud (actionfraud.police.uk) or Police Scotland on 101.
• Canada — the Canadian Anti-Fraud Centre.
• Australia — Scamwatch and ReportCyber.
• European Union — your national police cybercrime unit; Europol lists national reporting points.
• Elsewhere — your national police cybercrime unit and financial regulator.

Keep the reference number. You will need it repeatedly.

Hour 4–24: notify the exchanges

If you can identify the exchange that received the funds — a blockchain explorer will often show a labelled deposit address — contact its compliance team directly. Provide the transaction hashes, the destination address, the date, and your police report reference.

Exchanges cannot return funds to you on request, but a compliance team that receives a credible, timely report can freeze an account before withdrawal. This window is measured in hours or days.

Day 2–3: contain the wider exposure

• Change passwords on every account that shared a password with the compromised one, starting with email.
• Enable app-based or hardware two-factor authentication — not SMS, which is vulnerable to SIM swap.
• If you shared identity documents, consider a credit freeze and monitor for accounts opened in your name.
• If you gave remote access to a device, have it examined; assume anything stored on it is compromised.
• If you gave your seed phrase to anyone, treat every wallet derived from it as permanently compromised.

Then: get an assessment before you spend anything

Before paying anyone for recovery, understand what is realistically possible in your case. Tracing is meaningful when funds moved on a public blockchain and touched a regulated service. It is far weaker when funds went through a mixer, a privacy coin, or cash.

Anyone who guarantees recovery is lying. That guarantee is itself the most common second-stage fraud. Read Recovery scams: how not to be a victim twice before engaging any firm — including ours.

Look after yourself

Fraud of this kind is engineered by organised teams using well-tested psychological methods. Being deceived by it is not a failure of intelligence. Shame is the mechanism that keeps victims silent and stops them reporting in the window where action is still possible. Tell someone.