Recognizing and Responding to a Scam: A Practical Guide

Summary. What to do right now, what to do this week, and how to help someone who does not believe you.

If money moved in the last few hours

Stop and make one call before you finish this sentence: the fraud department of the institution the money left.

Not the branch. Not the app's chat. The fraud line, on the back of the card or on the institution's website.

Say this: "I am reporting fraud. Funds left my account at approximately [time] to [recipient]. I am requesting an immediate recall and a freeze on any further transfers from this account."

• A wire: use the word recall.
• An ACH: ask about a return.
• A card: ask for a chargeback and a new card number.
• Do not hang up without a case number.

Then call the receiving institution if you know it. They can freeze funds that have not been released.

For a real estate or business wire, file with the FBI's IC3 immediately and use the phrase "business email compromise." There is a rapid-response process, and it works best within 72 hours. It has recovered a meaningful share of reported losses.

Everything else in this guide can wait an hour. That call cannot.

Part one: the four questions

Nearly every scam in progress can be identified by four questions. They work because they test the structure rather than the story, and the structure is what the fraudster cannot change.

1. Did they contact me, or did I contact them?

Unsolicited contact — a call, an email, a text, a pop-up, a message on a platform, even a support number found in a search result — is the single largest risk factor. If you did not initiate it, treat everything that follows as unverified.

2. Is there urgency?

A window measured in hours. A warrant. A frozen account. A closing today. An offer that expires. Urgency exists to prevent you from pausing, and pausing is the only defense that always works.

3. Have I been told not to tell anyone?

"The investigation is confidential." "Your bank may be involved." "Don't tell your family, they'll worry." "This is a private opportunity."

This is the load-bearing element of every scam, because a second person almost always breaks the spell. Any instruction to keep a financial matter secret should end the conversation.

4. How am I being asked to pay?

Gift cards. Wire transfer. Cryptocurrency. A payment app to a person. Cash by courier or mail.

No legitimate organization asks for gift cards. Not once. Not ever. For any reason. Not the IRS, not Social Security, not your utility, not a court, not a bail bondsman, not Microsoft, not your bank.

If any two of these four are present, stop and verify independently. If three are present, it is a scam.

Part two: two rules that require no judgment

The problem with knowing about scams is that the whole design is to make the ordinary rules feel inapplicable to this situation. So the defenses that work are the ones that do not require you to assess anything in the moment.

Rule one: hang up and call back

Not the number they gave you. Not the number in the email. The number you already have — on your card, on your statement, in your contacts, on the website you navigate to yourself.

Applied without exception, this defeats nearly every telephone- and email-based scam that exists, including the ones you have never heard of.

Say: "I'm going to hang up and call you back at the number on my card." A legitimate caller says "of course." A fraudster produces a reason why you cannot.

Rule two: the person you always call first

Name one person, in advance, by agreement. "Before I move any money over $1,000, I call my daughter."

That is it. That single arrangement defeats the isolation step, which is the step that makes everything else work.

And the corollary: be that person for someone else, and make it easy — no judgment, no lecture, no "how could you fall for that."

Part three: the structural defenses

These are the things to set up now, while nothing is wrong.

A family code word. Agreed in advance, never shared, never on social media, used to verify identity in any emergency call. Voice cloning has made this necessary. Tell every grandchild.

A trusted contact at every bank and brokerage. They cannot transact; the institution can call them if it suspects exploitation or cannot reach you. Free, five minutes.

Ask your bank what protections they can put on the account: a hold on transfers above a threshold, a call-back requirement, dual authorization, a waiting period on new payees. Many will do this on request and almost nobody asks.

Credit freezes at all three bureaus. Free, and reversible in minutes.

Multi-factor authentication on email first, then banking, then everything. Email is the recovery channel for every other account.

Do not answer unknown numbers. Legitimate callers leave messages.

Opt out of data broker sites, which is where targeting lists come from.

Talk about it at family gatherings, including the ones that nearly worked on you. A household where fraud is discussed without shame is a household where someone speaks up before the second payment.

Part four: what you can actually get back

This is the question nobody answers honestly. Recovery depends almost entirely on how you paid.

The dispute that triggers obligations

For unauthorized electronic transfers from a consumer account, error resolution rules apply and they are time-sensitive.

Report within two business days of learning of the loss to cap liability at the lowest tier. Delay raises it substantially. And an unauthorized transfer appearing on a statement that goes unreported for 60 days can eliminate protection for transfers that follow.

Always confirm a verbal report in writing, with proof of the date. A written notice generally triggers an obligation to investigate and, in many cases, to provisionally credit the account during the investigation.

Write it this way:

"I am reporting unauthorized electronic fund transfers from account ending [____]. The transfers are: [date, amount, payee] for each. I did not authorize these transfers. I first learned of them on [date]. I am requesting investigation, provisional credit, and written notice of your determination. Enclosed: [police report number, IC3 confirmation]."

If the institution denies the claim on the ground that you authorized the transfer — the standard response to fraud-induced payments — ask for the denial in writing with the reason, then escalate: the institution's executive complaint office, the federal banking regulator for that institution, the CFPB, and the state attorney general. Institutional positions in this area have been shifting, and a documented escalation sometimes produces a different answer than the first call.

Part five: the reporting sequence

Do all of these. Reports aggregate, and aggregated reports produce seizures, prosecutions, and occasional distributions.

Immediately:

• The sending institution's fraud department — get a case number
• The receiving institution, if known
• IC3 (the FBI's Internet Crime Complaint Center) — for wire and email fraud, mark it business email compromise

Within 24 hours:

• Local police — you need the report number for institutions and insurers
• Credit freezes at all three bureaus
• Change email password first, then everything else
• Remove any remote access software and have the device examined

Within a week:

• The FTC
• The state attorney general
• Adult Protective Services, if a vulnerable adult is involved
• The Postal Inspection Service, if mail was used
• The state securities regulator, for investment fraud
• The state insurance department, for insurance fraud
• Written confirmation of every verbal report

And write down everything — dates, times, phone numbers, names used, exact wording, screenshots, emails with full headers. Memory degrades fast and the details matter to investigators.

Part six: helping someone who does not believe you

The hardest problem in this field, and the one where good intentions do the most damage.

Why they do not believe you: believing you means accepting a devastating loss — of money, of a relationship, of their own judgment. Doubt is cheaper than that. This is not stupidity; it is how anyone would respond.

What makes it worse:

• Saying "you're being scammed," repeatedly, in those words
• Anger, ridicule, "how could you"
• Ultimatums that end the conversation
• Seizing control of accounts, which drives it underground
• Any framing that requires them to admit they were foolish

What sometimes works:

• Ask questions instead of asserting conclusions. "What would happen if you asked him to video call right now?" "What's the plan if the money never comes?"
• Talk about the mechanism, not the person. Show how the script works, on other people, in the third person.
• Bring in a neutral third party — a banker, an officer, a financial advisor, an APS worker. Someone outside the family.
• Slow the money down without confrontation — a hold at the bank, a waiting period, a second signature.
• Report to APS if the person is a vulnerable adult. That is a referral, not a betrayal.
• Stay in the relationship. The strongest predictor of eventual disengagement is having someone still willing to talk.
• Prepare for the grief. When it breaks, the loss is not primarily financial.

And if it is cognitive decline rather than a bad decision, that is a different problem — evaluation, powers of attorney, supported decision-making, and in some cases guardianship.

Part seven: when a family member is the problem

A large share of financial harm to older adults comes from relatives and caregivers, and it usually looks like caregiving.

The signs

Isolation from other family · a new "friend" or caregiver controlling all contact · unpaid bills despite adequate income · unexplained withdrawals or transfers · sudden changes to a will, deed, beneficiary, or power of attorney · a new joint account holder · reluctance or inability to speak privately · a caregiver who answers for them.

What to do

1. Try to speak with them alone. This is frequently the hardest step and the most revealing. If it is prevented, that is information.

2. Request an accounting from the agent. A principal, and in most states an interested party, can compel an agent under a power of attorney to account. Self-dealing is a breach of fiduciary duty, and the burden of justifying transactions falls on the agent, not on you.

3. Contact the financial institution. A majority of states permit — and some require — banks and brokerages to place a temporary hold on a disbursement when exploitation is suspected, with immunity for good-faith action. Ask for this specifically.

4. Report to Adult Protective Services. Every state has one. Reports may be anonymous. They investigate.

5. Report to law enforcement and the state attorney general's elder unit.

6. Consult a lawyer about:

• Undue influence — a confidential relationship, plus susceptibility, plus opportunity, plus an unnatural result, frequently shifts the burden of proof
• Capacity — decision-specific, and a transaction by a person who lacked it is voidable
• Breach of fiduciary duty by an agent, trustee, guardian, or conservator
• The state elder financial exploitation statute, which frequently provides multiplied damages and attorney's fees
• A petition for accounting, removal of the agent, and return of property

7. If the person is in a facility, contact the long-term care ombudsman.

Part eight: after

Expect the recovery scam. Victims are re-targeted, frequently by the same organization, with an offer to trace and recover the funds for a fee. Never pay anyone to recover money you lost to fraud. Government agencies do not charge. Anyone who contacts you unsolicited claiming to have traced your funds is running the second half of the operation.

Ask about restitution. If there is a prosecution, register as a victim — that is how you appear in the restitution order. Check for a receivership or class action, which large frauds frequently produce, and note the claims deadline.

Deal with the taxes. If a retirement account was drained, there may be a reported distribution generating a tax bill on money that is gone. Talk to a tax professional. This is a real second injury and it catches people entirely unprepared.

Protect what remains. New account numbers, credit freezes, a new email address if the old one was compromised, and a review of every account the scammer could see or that shared a password.

Take the emotional harm seriously. Shame, isolation, and depression are ordinary consequences here. Free victim support programs exist, including through AARP and state victim assistance offices. This is a harm worth treating as one.

Part nine: the scripts, and what to say instead

Recognizing a scam in progress is easier when you know what the next sentence will be. Here are the ones that recur, and the response that ends each conversation.

"Do not hang up or tell anyone"

What it sounds like: "This call is being monitored as part of an active investigation. Discussing it with anyone, including bank employees, could make you a party to the offense."

Say: "Then I'll speak to my attorney and call you back through the agency's main number." Then hang up.

"Your account has been compromised — we need to move your funds to a secure account"

What it sounds like: the bank's name on caller ID, the last four digits of your account, a calm and helpful person.

Say: "I'm going to hang up and call the number on the back of my card."

A bank will never ask you to move money to protect it. There is no "safe account." There is no "protected account with the Federal Reserve."

"Read me the code we just texted you"

Say: nothing, and hang up. The code is the attack. The text itself usually says not to share it. No legitimate institution asks for it.

"You'll need to buy gift cards"

Say: nothing further, and hang up. There is no follow-up question worth asking. This is the single most reliable indicator that exists.

"There's a warrant for your arrest"

Say: "Send it to me in writing." Then hang up. Nobody is arrested by telephone, and no agency accepts payment to cancel a warrant.

"Your grandson is in jail and asked me not to tell his parents"

Say: "What's the code word?" Then hang up and call your grandson at the number you already have. Voice cloning is good now; the voice is not evidence.

"We've updated our wire instructions"

Say: nothing by email. Call the escrow officer, the lawyer, or the vendor at a number you obtained independently — from a signed engagement letter, a prior invoice, or the company's published main line — and read back every digit of the account and routing numbers.

"I need you to help me access my funds"

The romance version. The response is not a confrontation. It is: "Would you be willing to video call right now?" and then noticing the reason why not.

"We can recover the money you lost"

Say: nothing, and report the call. Never pay to recover money.

"I'm from Medicare and we need to verify your number for your new card"

Say: "Medicare doesn't call to verify numbers." Then hang up. Your Medicare number is worth money to a fraudulent biller, and giving it away can produce claims in your name for equipment you never received.

Part ten: the ten-minute setup

If you do nothing else after reading this, do this. It takes ten minutes and it is worth more than every warning in this guide.

1. Pick a family code word. Text it to the people who would call you in an emergency. Not on social media, not in a group chat that includes people you do not know.

2. Name a trusted contact at your bank and your brokerage. Call them or do it in the app. It takes three minutes and permits no transactions.

3. Ask your bank one question: "What holds or verification steps can you put on my account for large or unusual transfers?" Then have them put one on.

4. Freeze your credit at all three bureaus. Free, online, reversible in minutes.

5. Turn on multi-factor authentication on your email. Email first, because it is the recovery channel for everything else.

6. Agree with one person that you will call them before moving money. Say it out loud to them. Ask them to do the same with you.

That is the whole list. It costs nothing, requires no vigilance in the moment, and defeats the mechanism rather than the story — which is the only defense that keeps working after the scripts change.

Part eleven: three responses, worked through

The wire that was 60% recovered

Fitzgerald Nakamura-Delacroix wired $84,000 to what he believed was his title company, three days before a closing. The email had the right name, the right file number, the right closing date, and the right signature block — because the title company's email had been compromised weeks earlier and the scammer had been reading the thread.

What he did in the first hour, in this order:

1. Called his bank's fraud department — not the branch — and used the word recall. Got a case number.
2. Called the receiving bank directly and asked them to freeze the account.
3. Filed with IC3, marking it business email compromise, within ninety minutes.
4. Notified the title company, his lender, and his real estate agent.
5. Filed a police report the same afternoon.

Roughly 60% was frozen and returned over four months. The receiving account had not been fully drained, and the report was inside the window where the rapid-response process works.

The rule that would have prevented it: never act on wire instructions received by email. Call the escrow officer at a number from the signed engagement letter and read back every digit.

The account that was frozen in time

Rosalind Achterberg-Iyer, 81, went into her credit union to wire $18,000 to an "investigator" who had told her that her Social Security number had been used in a drug trafficking case and that her funds needed to be moved to a protected federal account until the matter cleared.

The teller did three things right.

She asked what the transfer was for — and listened to the answer rather than processing it.

She said, "Let me have a manager look at this with you," which slowed it down without confrontation.

The manager invoked the credit union's authority under state law to place a temporary hold on a disbursement where financial exploitation of a vulnerable adult is suspected, and called the trusted contact Rosalind had named two years earlier — her son.

The money never left.

Two lessons. The trusted contact designation, which takes three minutes and costs nothing, is what made the call possible. And in a majority of states, financial institutions now have express authority — with good-faith immunity — to pause a suspicious disbursement. Ask your bank whether they use it.

The accounting that recovered a house

Cassius Beauvais-Vasquez, 83, had given a power of attorney to the daughter who lived nearby. Over three years she added herself to his accounts, moved the house into joint tenancy, and transferred $190,000 into her own name — while telling her two siblings that their father did not want to see them.

What the siblings did:

1. Insisted on a private conversation with their father. It was resisted, which was itself information.
2. Demanded an accounting from the agent. A power of attorney is a fiduciary office; self-dealing is a breach, and the burden of justifying transactions falls on the agent.
3. Contacted the bank, which placed a hold under its exploitation authority.
4. Reported to Adult Protective Services.
5. Filed a petition to compel accounting, remove the agent, and set aside the transfers, pleading undue influence — confidential relationship, susceptibility, opportunity, unnatural result — and the state's elder financial exploitation statute, which provided double damages and attorney's fees.

The house was restored to his sole name. About $140,000 came back. The agent was removed.

The lesson. A power of attorney is an enormous grant with almost no built-in supervision. Ask for accountings routinely, name a co-agent or require dual signatures above a threshold, and put a second family member on the notice list at every institution — before anything is wrong.

Part twelve: a calendar for the week after

Hour 1

• Sending institution's fraud line — recall/return/chargeback, get a case number
• Receiving institution, if known
• IC3 if a wire or email fraud was involved

Day 1

• Police report
• Credit freezes at all three bureaus
• Change email password first, then financial accounts
• Remove remote access software; have the device examined
• Write down everything you remember: times, numbers, names, exact wording

Day 2–3

• Written confirmation of every verbal report, with proof of the date
• Written dispute to the institution requesting investigation and provisional credit
• FTC report
• State attorney general
• Adult Protective Services, if a vulnerable adult

Week 1

• Postal Inspection Service if mail was used
• State securities regulator for investment fraud
• Review every account the scammer could see or that shared a password
• New account numbers where appropriate
• Tell someone. This is a step.

Week 2–4

• Escalate any denial in writing — executive complaints, the federal banking regulator, the CFPB
• Ask about restitution registration if there is a prosecution
• Search for a receivership or class action, and note the claims deadline
• Talk to a tax professional if a retirement account was involved

Ongoing

• Expect and refuse the recovery scam
• Set up the ten-minute structural defenses if you have not
• Consider a victim support program — this is a real harm

Part thirteen: the versions aimed at you

The structure is always the same. The pretext is tailored, and knowing your version makes it visible.

Older adults. Grandparent emergencies · government impersonation · tech support · Medicare number "verification" · romance · home repair at the door · and, most costly of all, exploitation by a family member or caregiver.

Students and young adults. Fake job offers that send you a check to deposit and forward — the check bounces days later and the forwarded money is yours. Scholarship fees. Sublet scams. Fake internships. No legitimate employer sends you money to forward.

Job seekers. Advance fees for training, equipment, or background checks. Reshipping and money-mule roles, which create criminal exposure as well as loss. Interviews conducted entirely by chat app. Legitimate employers do not charge you.

Small businesses. Vendor invoice fraud with changed bank details. Fake directory and domain renewal invoices. Overpayment schemes. Business email compromise aimed at whoever authorizes payments. Verify any change of payment details by phone, at a number you already had.

Immigrants. Deportation threats from "immigration officers." Unauthorized practice by "notarios," a term that means lawyer in much of Latin America and does not here. Fake application fees. No immigration agency takes payment by phone.

Veterans. Benefit "unlocking" services. Pension poaching — asset restructuring for a fee, frequently to the veteran's detriment. Charity fraud in veterans' organizations' names. VA benefits help is free from a VA office or an accredited veterans service organization.

Recently bereaved families. Obituaries are public and are read by people looking for targets. Fake debts of the decedent. Fake funeral-related charges. The estate pays estate debts, and no legitimate creditor demands payment before probate.

Disaster survivors. Cash-deposit contractors. Fake FEMA representatives charging fees — federal disaster assistance is free. Fake charities. Unlicensed "adjusters."

Cryptocurrency holders. Fake exchanges and wallets. Giveaway scams. Support impersonation. Recovery services. No legitimate support agent asks for a seed phrase — the seed phrase is the money.

Landlords and homebuyers. Rental listings for units the "landlord" does not own. Deposit demands before a showing. And the highest-value version of all: closing wire fraud, which takes the entire down payment.

Part fourteen: a note on shame

The most useful thing in this guide is not a rule. It is a fact: almost nobody who is defrauded was careless.

Physicians, lawyers, accountants, engineers, and — with real regularity — people who work in banking are defrauded every day. People who have read guides like this one are defrauded. The reason is not that the warnings are inadequate. It is that fraud does not operate on your knowledge. It operates on your situation: a call at 11:40 at night, a grandchild's voice, a closing in three days, a person you have talked to every morning for eleven months.

Shame is not a side effect of fraud. It is a component of the design. The instruction not to tell anyone works because shame does the enforcement for free. Every hour a victim spends deciding whether to admit what happened is an hour the money gets further away and the second payment gets closer.

So the practical instruction, stated as plainly as it can be:

Tell someone immediately. Then call the bank.

Not in that order if money just moved — call the bank first. But do both within the hour, and do not spend any of that hour deciding whether you were foolish. You were targeted by people who do this all day, professionally, with scripts refined against thousands of other people, and the only thing that distinguishes the ones who lose everything from the ones who lose some of it is how fast they told someone.

Part fifteen: securing what is left

After a fraud, the money is one problem and the access is another. The scammer frequently obtained more than a payment — a password, a remote session, an identity document, a Social Security number, or a view of your accounts. Close all of it.

Email first, and email properly.

• Change the password to something new and unique
• Turn on multi-factor authentication
• Check the forwarding rules — a compromised account frequently has a hidden rule forwarding your mail to the attacker, and changing the password does not remove it
• Check the recovery email and phone number on the account; attackers change these so they can lock you out later
• Check connected apps and active sessions and revoke everything you do not recognize
• Check the sent folder for messages you did not send

Then, in order of what they can reach: banking · brokerage · retirement accounts · anything with a stored card · the phone carrier account · the password manager · social media.

Anywhere you reused that password, change it. This is the reason password reuse matters.

The phone carrier. Add a port-out PIN or account passcode. SIM swapping — where an attacker moves your number to their device and receives your verification codes — is a real follow-on attack, and the carrier PIN is the defense.

If remote access was granted to your computer:

• Disconnect from the internet
• Uninstall the remote software — but do not assume that is sufficient
• Have the machine examined by someone competent, or back up your files and reinstall the operating system
• Assume every password stored in the browser was taken
• Assume every session already logged in was accessible

If identity documents were shared — a driver's license, a passport, a Social Security card:

• Credit freezes at all three bureaus, plus the specialty reporting agencies
• An identity theft report at the FTC's site, which produces a recovery plan and a document institutions accept
• Consider an IRS identity protection PIN, which prevents a fraudulent return filed in your name
• Check your Social Security earnings record for employment you did not perform
• Watch for medical claims and unemployment claims filed in your name

And check the accounts nobody thinks of: the state's unclaimed property database, any account with a stored payment method, any subscription that renews automatically, and any account where the scammer might have changed the beneficiary or the address of record.

Part sixteen: where to report, with what to say

Every one of these is free. Reports aggregate, and aggregated reports produce seizures and prosecutions that individual reports do not.

The sending financial institution — fraud department. "I am reporting fraud. Funds left my account at [time] on [date] to [recipient]. I am requesting an immediate recall/return and a freeze on further transfers. Please give me a case number."

The receiving institution. "Funds fraudulently obtained from me were transferred to account [number] at your institution on [date] in the amount of $______. I am requesting that the funds be frozen. A police report and an IC3 complaint have been filed."

IC3 — the FBI's Internet Crime Complaint Center. Online. Have ready: the amount, the dates, the sending and receiving account and routing numbers, the recipient name, the emails with full headers, and every phone number and website used. For a real estate or business wire, use the phrase "business email compromise" in the narrative — it routes to a rapid-response process.

Local police. "I am reporting a fraud. I need a report number for my bank and my insurer." Expect limited investigation on an offshore scam; the report number is the point.

The FTC. Online. This generates an identity theft report and recovery plan where identity information was taken.

The state attorney general — consumer protection division. Frequently the most responsive body on domestic operators.

Adult Protective Services, if a vulnerable adult is involved. Reports may be anonymous.

The Postal Inspection Service, if anything was mailed. Packages are occasionally intercepted, and they have real investigative authority.

The state securities regulator, for investment fraud, and the federal broker-check systems to see whether the seller was ever registered.

The state insurance department, for insurance-related fraud.

The platform — the dating app, the social network, the marketplace, the exchange. Not for recovery, but reports produce account takedowns that protect others.

The federal banking regulator and the CFPB, if an institution denies a claim and you believe the denial is wrong. Get the denial in writing with its reason first.

And keep a single log of every report: agency, date, method, case or reference number, and what they said. Six months from now, when a receiver's claims process opens or a prosecutor's victim coordinator calls, that log is the difference between a claim and a story.

Frequently asked questions

How fast do I have to act? For a wire, hours. For a debit card, days. For a credit card, weeks. Call now and sort the rest out after.

Will I get it back? Depends on the payment method. See Part Four. Report regardless.

Should I be embarrassed? No — and embarrassment serves the scam. Isolation is engineered into every one of these. Tell someone.

They say they can get my money back for a fee. Second scam. Never pay.

My parent won't listen. Questions, not verdicts. A neutral third party. Slow the money down. Report to APS. Stay in the relationship.

Can a bank refuse to send a transfer? Increasingly yes — many states authorize a temporary hold on suspected exploitation. Ask.

What is a trusted contact? Someone your institution can call if it suspects a problem. They cannot transact. Free, and one of the best five minutes you will spend.

Do I need a lawyer? For elder exploitation by a family member, usually yes. For a stranger scam, usually no — the work is reporting and disputing, and it is free.

Related documents

• Scams, Fraud, and Elder Financial Exploitation
• Fraud Response and Elder Exploitation Checklist
• Fraud Response Toolkit
• Recovering from Identity Theft and Fixing a Credit Report
• Elder Law Toolkit
• Getting Out of a Timeshare
• Asserting Victims' Rights and Getting Compensated

Educational only, not legal advice. Elder exploitation statutes, financial institution hold authority, and error resolution rights vary. If money moved in the last few hours, make the call in the opening section first.