Scammed? What to do now
The first hour matters most. Here's what to do step by step, depending on how you paid, and where to report it in Germany, Austria, Switzerland and Belgium.
If you've just realised you've been scammed, every hour counts. The steps below are in an order that makes sure you do first what can't be done later.
The first 30 minutes
- Don't pay anything more. Not for supposed taxes, fees or a release of funds. That demand is almost always part of the scam.
- Call your bank. The number is on your card and in your banking app. The sooner your bank knows, the better the chance of stopping a payment.
- Cut off contact. Stop replying. If someone accessed your computer through remote access software, such as AnyDesk or TeamViewer, disconnect the device from the internet.
- Save everything you have. Screenshots of the platform, chat logs, emails, bank statements, names, phone numbers and, for crypto, the wallet address you paid to.
- Change your passwords if you gave away login details. Start with your email account and online banking, and use a different device from the affected one.
How did you pay?
What you can get back depends almost entirely on how you paid. Tap your case.
By bank transfer
right away, ideally within hours
A bank transfer can't simply be reversed. Your bank can try to recall it from the recipient, though. That only works while the money is still in the recipient's account, and scammers usually move it on quickly.
An example: Mark transfers 2,000 euros to a supposed trading platform at 10 a.m. At 11 a.m. he gets suspicious. If he calls now, the bank still has a chance. If he waits until the next morning, the money is almost always gone.
With an instant transfer the money arrives within seconds. Ask anyway, straight away.
By direct debit
8 weeks, 13 months without a mandate
This is where you're best placed. You can have a direct debit refunded within eight weeks without giving a reason. If you never authorised the debit at all, you have 13 months. It usually takes a few taps in your banking app or one phone call.
By credit or debit card
block the card now, chargeback often up to about 120 days
Block the card first. Then ask your bank for a chargeback. The card companies set the deadlines, often around 120 days.
If you didn't make the payment yourself, report it as soon as possible and within 13 months at the latest. If you confirmed the payment yourself, for example in your app, it gets harder. Try anyway, every report counts.
Through PayPal
180 days
Report the case in PayPal's Resolution Center. You have 180 days. For investments, buyer protection often doesn't apply. The report is still worth it, because it lets PayPal check and freeze the recipient's account.
In crypto
almost impossible to recover, save the traces now
A crypto payment can't be reversed. What you can do: write down the recipient's address and the transaction ID (called the hash). If you sent the money through a trading platform, report the case there as well.
The path of the money is publicly visible on the blockchain. If it later lands on a regulated platform, that platform can freeze the account when the police ask. That's why your report with the exact addresses matters so much.
With gift cards or voucher codes
right away
Anyone who asks to be paid in gift cards or voucher codes is scamming you. No legitimate company and no authority wants to be paid that way. Report the code to the card issuer immediately. If it hasn't been redeemed yet, it can sometimes be blocked.
Did you share personal details?
Many scams are after your identity as well as your money. With a copy of your ID and a selfie, someone can open accounts and sign contracts in your name.
- ID, selfie or address: Mention this explicitly in your police report. That way you can prove later that someone else used your details.
- Online banking login: Have your bank block the access and set it up again.
- Remote access to your computer: Have the device checked or reinstall it before you do any banking on it again.
Where to report it
Always file a police report. Without one, banks and insurers often can't help you. Which other offices you contact depends on your country.
Germany
- Police report, also online through the online police station of your state
- Block your card through the emergency number 116 116
- Report the provider to BaFin, the financial supervisor
- Advice from the consumer advice centre (Verbraucherzentrale)
Austria
- Police report at any police station. The cybercrime reporting office of the Federal Criminal Police also takes tips on online fraud.
- Block your card through your bank's blocking number
- Report the provider to the Financial Market Authority (FMA)
- Current scams and warnings at Watchlist Internet
Switzerland
- Police report with your cantonal police
- Report the incident to the Federal Office for Cyber Security (NCSC)
- Check whether the provider is on FINMA's warning list
Belgium
- Police report with your local police
- Block your card through Card Stop, 078 170 170
- Report the provider to the FSMA, Belgium's financial supervisor
- Report fraud to the Ministry of Economy's contact point
- Forward suspicious messages to suspicious@safeonweb.be, more at Safeonweb
Watch out for the second call
A few weeks after the scam, supposed lawyers, authorities or companies often get in touch and offer to recover your money. They know a surprising amount about your case. That's because they're the same people, or they bought the data. As soon as anyone asks for money upfront to recover your money, it's the same scam a second time. More in If the money's already gone.
One more thing: this happens to smart, careful people. Scammers work with time pressure, trust and a lot of practice. There's nothing to be ashamed of. Act quickly, that's the best thing you can do right now.
The deadlines above come from European payment law. The Payment Services Directive (PSD2) applies across the EU. It doesn't apply in Switzerland, where bank contracts and card terms set the details.
For an unauthorised payment, the bank generally has to refund the amount by the end of the next business day, provided you report it without undue delay and at the latest within 13 months of the debit (Articles 71 and 73 PSD2). Exceptions apply if you acted intentionally or with gross negligence, for example by passing a TAN to a stranger. Whether that was gross negligence is decided case by case if there's a dispute.
For a SEPA Core direct debit you have an unconditional refund right for eight weeks (Articles 76 and 77 PSD2). Without a valid mandate the payment counts as unauthorised, and the 13 months apply.
A transfer you approved yourself counts as authorised, even if you were deceived. That's why there's no right to a refund, only the attempt at a recall. Since October 2025, banks in the euro area check before a transfer whether the recipient's name matches the IBAN. Always take a warning at that point seriously.
A card chargeback isn't a legal right. It's a procedure the card schemes set themselves. Deadlines depend on the reason for the dispute and usually run from the booking date or the agreed delivery date.
With crypto transfers there's nobody who can reverse a payment. Investigators can trace transactions, though. Many fraud cases only end months later with seized funds, when the trail leads to a platform with identity checks.
Summary
- Pay nothing more and call your bank straight away.
- Direct debits and cards give you the best chances, transfers and crypto the worst.
- Always file a police report, and expect a second call from fake rescuers.
Did you get it?
Why should you call your bank immediately after a transfer?
A recall only works while the money is still in the recipient's account. Scammers usually move it on within hours.
How long can you have a direct debit refunded?
Eight weeks without giving a reason. Thirteen months if you never authorised it.
How do you recognise the recovery scam?
Someone offers to get your lost money back and asks for a payment upfront.
Sources and further reading
- Directive (EU) 2015/2366 on payment services (PSD2), Articles 71 to 77. View source ↗
- BaFin, information for consumers (German). View source ↗
- Watchlist Internet, current scams in Austria (German). View source ↗
- FINMA, warnings and warning list. View source ↗
- FSMA, Belgium's financial supervisor. View source ↗
Related
- If the money's already goneFraud Protection
- Checking a providerFraud Protection
- Gurus and signal groupsFraud Protection