After an Impersonation Scam: Contact Providers and Track the Response

Key Takeaways:

Stop further contact and payments to the suspected scammer.
Contact the institution used for the payment promptly through a verified channel.
Record what money, information or account access was exposed.
Reporting and recovery requests do not guarantee reimbursement; beware of a second recovery scam.

Someone posing as a relative, bank employee, government official or another trusted person may ask for money or account access. If you have already acted, focus on limiting further exposure and making clear reports. You do not need to finish a perfect evidence folder before contacting the relevant provider.

Start with the payment or account provider

The FTC advises contacting the company used to send money immediately and asking whether it can reverse the transaction or refund the payment. For a card or bank account, use the number on the card, your known account app or independently verified contact information.

Explain accurately what happened, including whether you made the payment yourself or someone accessed the account without permission. Do not describe an authorized payment as unauthorized simply to fit a claim category. Ask which process applies, what evidence is needed and whether there is a submission deadline.

Different payment methods have different procedures and protections. Use the FTC’s payment-method guidance to identify the relevant company, such as a gift-card issuer or transfer service. Ask what is still possible without assuming a completed transfer can be recovered.

List the exposure in three parts

For your private notes, separate money sent, personal information disclosed and access granted. A failed payment does not mean a shared password is safe, and a changed password does not resolve money already sent.

Money: amount, date, payment method and transaction reference.
Information: documents or identifying details shared.
Access: accounts, verification codes or remote-device access involved.

Use only the detail necessary in a working checklist, and store sensitive evidence securely. If an institution requests documents, verify its secure submission route before uploading them.

Address credentials and identity concerns

The FTC recommends changing compromised passwords and enabling two-factor authentication. If account access is lost, use the provider’s genuine recovery process. For a device that may be compromised, obtain help through a trusted manufacturer or support provider before relying on it for sensitive activity.

Use IdentityTheft.gov for the FTC’s identity-theft recovery guidance when identifying information has been misused. Keep account recovery, identity-theft reporting and the payment claim as separate tasks so none is mistaken for completion of the others.

Keep a response log

Save relevant messages, receipts, website addresses and transaction details. For each provider contact, record the date, case reference, answer and next action. Preserve originals where possible; make a separate explanation rather than editing a receipt or message to highlight your interpretation.

Fictional log entry: a card issuer opens a case and requests a receipt. The next action is to send that receipt through the verified channel by the stated date. An open case is recorded as pending, not as a promised refund.

Report the scam through ReportFraud.ftc.gov and use the institution’s reporting route as well. An FTC report is separate from a refund request to the payment provider.

Do not pay a new recovery pitch

The FTC warns that people already scammed can be targeted by callers promising recovery in return for an upfront payment or sensitive information. Independently verify unexpected contacts, even if they know details of the first loss. Do not send another payment to unlock a supposed refund.

Next step: contact the affected provider now, then work through exposed accounts and a dated follow-up list. Seek practical support from someone you trust without surrendering control of your accounts.