fraud

Red flags

The FTC's four signs: impersonation (caller ID can be faked); a fake problem or prize; pressure to act now (arrest or lawsuit threats, "stay on the line"; real agencies don't); unusual payment demands (gift cards, wire, payment apps, crypto, cash, deposit-a-check-and-send-money-back). Not part of the four: secrecy ("don't tell the bank or your family"), unsolicited contact, guaranteed returns, private chat, remote-access software, "safe account" transfers.

Voice clones and deepfakes

A familiar voice or video proves nothing, including a bail, hospital, or accident money demand: hang up and call back on a number you already have, or via another relative. Set a family code word now, for real emergencies only, never posted or texted.

About to pay

Don't help execute the payment, and don't argue or shame. Name two or three matched flags and suggest a 24-hour pause, a small test withdrawal with no "fee" (a legitimate service won't refuse), a call to the bank's fraud team, and telling one trusted person. Asked to receive and forward funds: possible money mule; stop and report.

Sextortion

The victim is the person targeted, often a teenager; say so. Don't pay: the FBI says payment doesn't ensure privacy. Block but keep the profile and messages; record usernames, URLs, and demands as text; never screenshot, copy, or forward intimate images, especially of a minor. Report to the platform, NCMEC (Take It Down for minors, CyberTipline), StopNCII for adults, and ic3.gov; elsewhere the national equivalent. Anyone charging to remove images is a second scam. Run the crisis check.

Crisis check

On any sign of self-harm or hopelessness ("I lost everything"), stop the checklist: respond warmly and directly, ask plainly if needed, give the local crisis line (US 988; elsewhere findahelpline.com or the local emergency number, via websearch), encourage telling one trusted person tonight, and route to coach:wellbeing. Resume recovery only after that.

First hour by payment method

• Card: issuer (number on the card); report fraud, reverse the charge, replace the card.
• Bank transfer, wire, Zelle: bank fraud line now; say you were tricked, ask for a recall. US: also ic3.gov fast, with full transaction details (verify current Recovery Asset Team criteria); the FBI may ask banks to freeze funds, never a guarantee.
• Payment apps (Cash App, Venmo, PayPal) and money-transfer companies: report the scam, ask to reverse or refund.
• Gift cards: the issuer; a scammer has the number and PIN; keep card and receipt.
• Crypto: exchange or ATM operator; recovery is often hard, so say so.
• Cash by mail: US Postal Inspection Service at once; they may intercept the package, for a fee (websearch current steps). By courier: the carrier.
• Code or card details given: remove the card from digital wallets; review added devices and payees.
• Then accounts, credit, reports. Pay nothing more.

Account takeover and device cleanup

Recover the account first, then check whether money or identity data was reached. Use the provider's official recovery page, typed in or from the official app, on a clean device: change the password, sign out all sessions, enable an authenticator app or passkey, check recovery contacts and mail-forwarding rules, warn contacts; secure email and banking first. Remote-access scam: disconnect and uninstall; if banking was open during the session, treat it as an account takeover and get professional help. SIM swap: call the carrier from another phone, set a port-out PIN. If a partner or ex may have access, use a safe device and point to a domestic-violence hotline (websearch local) before changing credentials.

Acting for a relative

Report to the parent's bank (ask for its fraud or elder-financial-exploitation unit; it can listen but not disclose) and adult protective services; sit with the parent for any call needing their consent. Capacity and power of attorney go to family:eldercare.

Identity theft (US anchor; adapt by country)

• Credit freeze at all three bureaus: free, lasts until lifted. Fraud alert: free; one year, seven with an identity-theft report. IdentityTheft.gov gives an official report and recovery plan.
• IRS Identity Protection PIN: six digits, valid one calendar year, new each year, from the IRS online account; if they can't verify online, Form 15227 or a Taxpayer Assistance Center visit (websearch current eligibility). The IRS never asks for it by phone, email, or text. If a return is rejected as already filed, websearch the IRS identity-theft steps.

Data brokers and privacy rights

California residents: DROP (CalPrivacy, consumer.drop.privacy.ca.gov) sends one deletion request to registered data brokers after residency verification; brokers must process requests at least every 45 days from August 1, 2026. Public records and other exempt data aren't covered and it doesn't guarantee less spam; verify current status first. Elsewhere, websearch the user's deletion rights, draft each opt-out request, log send dates and replies, chase non-responses.

Reporting directory (ask the country; verify at runtime)

• US: reportfraud.ftc.gov; IdentityTheft.gov; ic3.gov; phishing email to [email protected], texts to 7726.
• UK: Report Fraud (City of London Police) at reportfraud.police.uk; websearch the Scotland route.
• Canada: Report Cybercrime and Fraud (RCMP NC3 with the Canadian Anti-Fraud Centre) at reportcyberandfraud.canada.ca, plus local police, Equifax Canada, TransUnion Canada.
• Australia: ReportCyber (cyber.gov.au) for police reports; Scamwatch (National Anti-Scam Centre) for scam disruption, a separate channel; IDCARE for identity support.
• EU and others: Europol is not a public reporting channel; websearch the national police or cybercrime portal and consumer authority.