Summary. Fifteen sequences, ordered by urgency. If money moved today, do §1 before reading §2.

1. THE FIRST HOUR — if money just moved

  • Call the sending institution's FRAUD DEPARTMENT. Not the branch. The number on the card or the website.
  • Say: "I am reporting fraud. Funds left my account at [time] to [recipient]. I am requesting an immediate recall and a freeze on further transfers."
    • Wire → use the word RECALL
    • ACH → ask about a RETURN
    • Card → ask for a CHARGEBACK and a new card number
  • Do not hang up without a case number
  • Call the RECEIVING institution if you know it — they can freeze unreleased funds
  • File with IC3 — and for a real estate or business wire, use the phrase "business email compromise." The rapid-response process works best within 72 hours.
  • Tell one other person. This is a step, not a sentiment.

2. The four questions — is this a scam?

  • Did they contact me, or did I contact them? Unsolicited contact is the largest risk factor.
  • Is there urgency? Urgency exists to prevent the pause.
  • Have I been told not to tell anyone? This is the load-bearing element of every scam.
  • How am I being asked to pay? Gift cards · wire · crypto · payment app · cash courier.
  • Two of four → verify independently. Three of four → it is a scam.
  • NO legitimate organization ever asks for gift cards. Not once. For any reason.

3. Two rules that require no judgment

  • HANG UP AND CALL BACK — on the number you already have, not the one they gave you. Defeats nearly every phone and email scam that exists.
  • Name one person you always call before moving money. Defeats the isolation step.

4. Recovery by payment method

  • Credit card → best. Chargeback and fraud protections.
  • Debit card → good, short deadlines
  • ACH → moderate if within days
  • Wire → poor unless within hours. Ask for a recall; call the receiving bank too.
  • Payment app to a person → poor; "authorized" transfers frequently refused. Report and escalate anyway.
  • Gift cards → very poor. Call the card issuer's fraud line; keep the cards and receipts.
  • Cryptocurrency → very poor. Report to the exchange; preserve wallet addresses and transaction hashes.
  • Cash courier or mail → very poor. Police; Postal Inspection Service if mailed.

5. The error resolution clock

  • Report within 2 business days of learning of the loss → lowest liability tier
  • Delay raises liability substantially
  • An unauthorized transfer on a statement unreported for 60 days can eliminate protection for later transfers
  • Always confirm verbally-reported fraud IN WRITING, with proof of the date
  • Written notice generally triggers an obligation to investigate and frequently to provisionally credit the account
  • If denied on the ground that you "authorized" it: get the denial in writing with the reason, then escalate to the institution's executive complaints, the federal banking regulator, the CFPB, and the state attorney general

6. Reporting — do all of them

  • Sending institution's fraud department — case number
  • Receiving institution
  • IC3 (mark BEC for wire/email fraud)
  • Local police — you need the report number
  • FTC
  • State attorney general
  • Adult Protective Services, if a vulnerable adult
  • Postal Inspection Service, if mail was used
  • State securities regulator, for investment fraud
  • State insurance department, for insurance fraud
  • The platform — dating app, marketplace, exchange, social network
  • Keep a single log: agency · date · method · case number · what they said

7. Secure the accounts

  • EMAIL FIRST — new password · multi-factor authentication · check forwarding rules (attackers hide one) · check recovery email and phone · revoke connected apps and active sessions · check the sent folder
  • Then: banking · brokerage · retirement · anything with a stored card · phone carrier · password manager · social media
  • Change the password anywhere you reused it
  • Add a port-out PIN with your phone carrier — SIM swapping is a real follow-on attack
  • Credit freezes at all three bureaus plus specialty agencies
  • If remote access was granted: disconnect · uninstall · have the machine examined or reinstall the OS · assume every stored browser password was taken
  • If identity documents were shared: FTC identity theft report · IRS identity protection PIN · check the Social Security earnings record · watch for medical and unemployment claims in your name

8. Write it all down — today

  • Dates and times of every contact
  • Phone numbers, names used, titles claimed
  • Exact wording, quoted
  • Screenshots · emails with full headers · texts · website addresses
  • Wallet addresses and transaction hashes for crypto
  • Every account and routing number involved
  • Memory degrades fast and investigators need specifics

9. Helping someone who does not believe you

Does not work:

  • Saying "you're being scammed," repeatedly
  • Anger, ridicule, "how could you"
  • Ultimatums
  • Seizing accounts by force — drives it underground
  • Any framing requiring them to admit they were foolish

Sometimes works:

  • Questions, not verdicts — "What happens if you ask him to video call right now?"
  • Talk about the mechanism, in the third person
  • A neutral third party — banker, officer, advisor, APS worker
  • Slow the money down without confrontation — a hold, a waiting period, a second signature
  • Report to APS if the person is a vulnerable adult
  • Stay in the relationship — the strongest predictor of eventual disengagement
  • Prepare for the grief; the loss is not primarily financial

10. Elder exploitation by a family member or caregiver — the signs

  • Isolation from other family and friends
  • A new "friend" or caregiver controlling all contact
  • Unpaid bills despite adequate income
  • Unexplained withdrawals or transfers
  • Sudden changes to a will, deed, beneficiary, or power of attorney
  • A new joint account holder
  • Reluctance or inability to speak privately
  • A caregiver who answers for them

11. Elder exploitation — what to do

  • Try to speak with them alone. If prevented, that is information.
  • Demand an accounting from the agent under the power of attorney — self-dealing is a breach of fiduciary duty, and the burden of justifying transactions falls on the agent
  • Contact the financial institution — most states now permit a temporary hold on a disbursement on suspected exploitation, with good-faith immunity. Ask for it specifically.
  • Report to Adult Protective Services — anonymous reports accepted
  • Report to law enforcement and the AG's elder unit
  • Long-term care ombudsman, if in a facility
  • Consult a lawyer about: undue influence (confidential relationship + susceptibility + opportunity + unnatural result, frequently shifting the burden) · capacity (decision-specific; transactions voidable) · breach of fiduciary duty · the state elder exploitation statute (frequently multiplied damages and attorney's fees)
  • Petition for accounting, removal of the agent, and return of property

12. The aftermath

  • EXPECT THE RECOVERY SCAM. Victims are re-targeted, frequently by the same organization. Never pay to recover money. Agencies do not charge.
  • Register as a victim if there is a prosecution — that is how you appear in the restitution order
  • Check for a receivership or class action and note the claims deadline
  • See a tax professional — a drained retirement account can generate a reported distribution and a tax bill on money that is gone
  • Consider a victim support program — AARP's network and state victim assistance offices are free

13. The ten-minute prevention setup

  • Family code word — texted to anyone who might call in an emergency. Not on social media.
  • Trusted contact named at every bank and brokerage. Cannot transact. Three minutes.
  • Ask your bank: "What holds or verification steps can you put on my account for large or unusual transfers?" — then have one put on
  • Credit freezes at all three bureaus
  • Multi-factor authentication on email first, then everything
  • Agree with one person that you call them before moving money. Say it out loud to them.

14. Additional hardening

  • Do not answer unknown numbers; legitimate callers leave messages
  • Port-out PIN with the phone carrier
  • Opt out of data broker sites — that is where targeting lists come from
  • Review beneficiary designations annually
  • For an aging parent: consider a co-agent or dual signature requirement above a threshold on any power of attorney, and put a second family member on the notice list at every institution
  • Talk about scams as a family, without shame — including the ones that nearly worked on you

15. The scripts that end the conversation

  • "Don't tell anyone" → "I'll speak to my attorney and call the agency's main number." Hang up.
  • "Move your funds to a secure account" → "I'll call the number on the back of my card." Hang up. There is no safe account.
  • "Read me the code we texted you" → Hang up. The code is the attack.
  • "Buy gift cards" → Hang up. No further questions needed.
  • "There's a warrant" → "Send it in writing." Hang up. Nobody is arrested by telephone.
  • "Your grandson is in jail — don't tell his parents" → "What's the code word?" Then call the grandson on the number you have.
  • "We've updated our wire instructions" → Call the escrow officer at a number from the signed engagement letter and read back every digit.
  • "We can recover your money for a fee" → Report the call. Never pay.
  • "This is Medicare, we need to verify your number" → Medicare does not call to verify numbers. Hang up.

Related documents

Educational only, not legal advice. Elder exploitation statutes, financial institution hold authority, and error resolution rights vary. If money moved today, do §1 now.