What to do in the first hour if you have been scammed

If you think you have just been caught by a scam, start here. Work down the list in order. It should take about twenty minutes.

Before anything else: this happens to careful, intelligent people every day. Being caught says nothing about you. What causes real damage is the delay while somebody sits alone feeling foolish, so please do not do that part.

If money has moved

Ring your bank immediately. Use the number on the back of your card, not any number from the message. Most Australian banks have a 24-hour fraud line and you do not need to wait for business hours.

Tell them plainly: “I think I have been scammed and money has left my account.” They deal with this constantly and they will not lecture you. They can sometimes stop or recall a transfer if you are quick, which is the entire reason speed matters.

Then report it to the police via ReportCyber, the national online reporting system at cyber.gov.au. You will get a reference number, which your bank and insurer may ask for.

If you gave someone remote access to your computer

This is when someone talked you through installing something so they could “fix” your machine.

Disconnect it from the internet first. Unplug the network cable, or turn off the Wi-Fi, or simply switch off your router. This stops them doing anything further right now, which buys you time.

Then leave the computer alone and ring someone who knows what they are doing. Do not keep using it, and in particular do not log into your bank on it.

The machine has to be properly checked before it can be trusted again, because whatever they installed is still there. Sometimes the honest answer is that it needs wiping and setting up fresh.

If you gave away a password

Change it immediately, from a different device if the computer might be compromised. Your phone is fine.

Change it everywhere you used the same password. This is the part people skip and it is the part that causes the most damage. If that password was also on your email, your shopping accounts and your council login, all of those are now exposed.

Do your email account first, before anything else. Email is the master key: whoever controls it can reset the password on nearly every other account you own. If you only have time to secure one thing, secure your email.

Then turn on two-factor authentication, which stops a stolen password being enough on its own.

If you gave away card details

Ring your bank and cancel the card. Do not wait to see whether anything happens. A replacement card is a minor inconvenience and takes a few days.

Check your recent transactions while you are on the phone. Scammers often test a stolen card with a very small purchase first, so a charge of one or two dollars that you do not recognise is a warning sign, not a rounding error.

If you clicked a link but did nothing else

You are very probably fine.

Clicking alone rarely does damage. The risk comes from what you did next: entering a password, entering card details, or installing something. If you clicked, saw a page that asked for information, and closed it without typing anything, that is usually the end of it.

Change the password for whatever the page was imitating anyway. It costs two minutes and removes the worry.

Afterwards

Tell somebody. A family member, a friend, anybody. Not because you need help with the technical part, but because scammers frequently come back to people who paid once, sometimes posing as a recovery service offering to get the money back for a fee. Having one other person who knows what happened makes that far harder to pull off.

Watch your accounts for a few weeks. Check your bank statement properly rather than glancing at the balance.

Do not accept help from anyone who contacts you about it. Anyone who rings offering to recover your money is running the second half of the same scam.

Where to report it

• Your bank, first and fastest, if money moved
• ReportCyber at cyber.gov.au for the police report
• Scamwatch at scamwatch.gov.au, which helps warn other people
• IDCARE on 1800 595 160, a free Australian service for identity theft, and genuinely worth ringing if personal documents were involved

One last thing

The shame is the most damaging part of this, and it is entirely misplaced.

These operations employ people full time. They test their scripts on enormous numbers of targets and keep the versions that work. Being caught by an industrial process designed by professionals is not a character flaw.

If you would rather have someone sit with you and go through it properly, that is something I do regularly, and there is no judgement in it whatsoever.