What to do if
you've already been scammed

Two things, in this order. If the conversation with the scammer is still going, whether a call, a chat or a remote control session, cut it off: hang up, close the chat and, if they had you install a program to see your screen, disconnect that computer from the internet by pulling the cable and turning off the wifi. Then call your bank on the number printed on the back of your card or in its official app and say you've been the victim of fraud: ask them to block the card and to try to stop any transfer or payment you don't recognise. Everything else, changing passwords, reporting it, warning your contacts, matters but can wait a few minutes. The money can't: a transfer going out now may have left the receiving account shortly afterwards, and the window to stop it is measured in hours, not days. If you make only one call today, make it to the bank.

The one you already had before all this: the one printed on the back of your card, in the bank's official app you already used, or on its website, typing the address into the browser yourself. Never the number the person who scammed you gave you, the one in the text message or the one shown on screen for the call you received, because that number may be controlled by the scammer or spoofed to look like the bank's. It's a detail that gets forgotten in the panic, and some scams count on exactly that: they call you «from the security department» right after the first trick to finish the job. If, while you're talking to your bank, another call comes in claiming to be the bank, don't answer it. And if the branch is open and nearby, going in person also works, but a call is faster, and in these hours speed is what counts.

It depends on what that code was for, which is why you should read the whole text, not just the digits. Codes sent by banks usually confirm a specific transaction: a card payment, a transfer, registering a new phone in the app or changing a security detail. If you read it aloud to someone, they most likely used it to authorise exactly that, even if they told you it was to «cancel a charge» or «verify your identity». Tell the bank in those words when you call: that you gave out a code and at what time, so they can check what was authorised with it and whether any new device is linked to your account or card. If the code was for WhatsApp or another messaging app, they've probably registered your account on another phone, and that means recovering the account and warning your contacts as soon as possible.

Uninstalling it is necessary, but not enough. First disconnect the computer from the internet to cut the session; then uninstall the program from the system settings. The problem is that while the other person had control, they could have done things you can't see: viewed passwords saved in the browser, opened your online banking, downloaded documents or left another program installed that lets them back in later without asking. So that computer shouldn't be used for banking or email until someone has checked it, and passwords should be changed from another device that wasn't part of that session, such as your phone. If the computer held customer or company data, the check isn't optional. Sometimes a careful clean-up is enough and other times the prudent thing is to reinstall the system; that's decided by looking at the computer, not over the phone, and it's what we deal with in IT support.

It depends mainly on how the money left, and nobody can guarantee it in advance. Payment services rules distinguish between transactions you didn't authorise, such as a card charge made by someone else with the details you gave them, and transactions you made yourself believing they were legitimate, such as a transfer to the account on a fake invoice. In the first case the law provides, in principle, for the bank to refund the amount, although there are exceptions, for instance if the bank considers there was gross negligence, and you should report it without delay. In the second, since you ordered the payment, getting it back is much harder and depends on the bank managing to freeze the money in the receiving account. In both cases, what helps most is having reported it quickly, having filed a police report and keeping all the evidence. If the bank refuses a refund and you disagree, you can complain in writing and seek advice.

To the Policía Nacional or the Guardia Civil, depending on where you live, or the Mossos d'Esquadra if you're in Catalonia. The report won't get your money back on its own, but the bank usually asks for it to process the claim, and it creates an official record of what happened in case someone later uses your details for something else. Take everything you have, in order: screenshots of the messages or chat, the number that called or wrote to you and the time, the emails with their attachments, receipts for payments or transfers, and the account transactions you don't recognise. Also write down, while it's fresh, what they told you and what you did at each step. If you're not sure which steps apply to you, INCIBE's 017 helpline answers cybersecurity questions free of charge and in confidence, and can guide you on what to do depending on what you handed over.

Almost certainly it's a second scam, and it's very common straight after the first. Someone who has already been caught once is on the list of people who respond, is anxious and wants to recover what they lost, so they're the perfect target. The script barely changes: a supposed firm, a lawyer or even someone claiming to be from the police offers to trace the money and return it in exchange for an upfront payment, some «fees», or for you to install a program to «check your account». Neither the police nor the bank charge to recover money lost to fraud, and nobody serious can promise they'll manage it. If someone contacts you out of the blue and asks for money or access to your computer to return what was stolen, hang up. Recovery, if possible, goes through your bank and the police report, not through middlemen who find you.

Through another channel that's still yours, and as soon as possible, because the usual aim of taking over an account like that is to message your contacts pretending to be you and ask them for money, a code or to click a link. If you've lost WhatsApp, warn family and the people you talk to most by text, by phone or from another social network: «if I message you asking for money or a code, it isn't me». If it was your email, do the same with your regular customers and suppliers, especially if you discuss payments with them, because an invoice with a different bank account can be sent from your mailbox. Meanwhile, try to recover the account through each service's official process and, as soon as it's yours again, turn on two-step verification. There's no need to give everyone the details of the scam: it's enough for them to know that, for a few days, any odd request in your name isn't from you.