Paid a scammer with a debit card (US): what to do and by when

1. Stop dealing with the scammer

Do not send more money, share codes or install anything they ask for, even if they promise a refund or say you owe a fee. Save their messages and numbers first, then stop replying and block them. Time limit: Now. The FTC warns that people who have paid a scammer are often targeted again with offers to get the money back for an upfront fee. Keeping the messages gives your bank and the police the evidence they ask for.

2. Call your bank and report the debit card payment

Call the number on the back of the card. Say you were tricked into paying a scammer or that the card was used without permission, ask for a refund and ask for a new card. Follow up in writing. Contact: Your bank or credit union. Use the number on the back of your card or on your statement, or the bank's app. Time limit: Today. Federal law limits what you lose on a debit card, but the limit depends on how fast you report.

3. Report lost or stolen card details or codes within 2 business days

If a scammer got your card, PIN, login or one-time code, report it to the bank within 2 business days of finding out. Contact: Your bank or credit union. Use the number on the back of your card or on your statement, or the bank's app. Time limit: 2 business days after you learn of it (counted here from the payment date). Under Regulation E, reporting within 2 business days caps your loss at $50. After that it can be up to $500, and more if you miss the 60-day statement limit.

4. Report every unauthorised transfer on your statement within 60 days

Check each statement and report any transfer you did not make, in writing as well as by phone. Contact: Your bank or credit union. Use the number on the back of your card or on your statement, or the bank's app. Time limit: 60 days after the statement is sent; the date shown counts from the payment, so it is never later than the real limit. If you miss the 60-day limit you can lose protection for later transfers. The bank then has 10 business days to investigate, or up to 45 or 90 days in some cases.

5. Report it to the FTC

Report the scam at ReportFraud.ftc.gov. Include how you paid, the amount and the scammer's details. Contact: Federal Trade Commission (reportfraud.ftc.gov). Time limit: Within a few days. The FTC uses reports to build cases and warn others.

6. Report it to the FBI's IC3

If the scam happened online or by phone, file a complaint at ic3.gov. Contact: FBI Internet Crime Complaint Center (IC3) (ic3.gov). Time limit: Within a few days. IC3 is the FBI's main intake for cyber-enabled fraud and scams.

7. If the bank or app will not help, complain to the CFPB

Submit a complaint online or call (855) 411-2372. Contact: Consumer Financial Protection Bureau ((855) 411-2372, consumerfinance.gov/complaint). Time limit: If the bank refuses. A complaint puts your dispute on record with the federal regulator.

Time limits that apply

Counted from the day you paid. Where the real limit runs from a later date, such as your statement, the tool counts from the payment date, so the date it shows is never later than the real one.

Keep this evidence

Screenshots of every message, email, advert and website, including the sender's number or address. Statements or app screens showing each payment, with the date, amount and recipient. Transaction or confirmation numbers, and for crypto the wallet address and transaction ID. Gift cards and store receipts. A timeline in your own words: when contact started, what you were told and when you paid. Your FTC report number and any IC3 complaint ID, and notes of every call with your bank.

Protect yourself now

Change the password on your email first, then banking, then any account that shares a password. Remove any remote access app the scammer asked you to install and run a security scan. Turn on two-factor authentication. Warn family and friends if the scammer had access to your contacts or social media. Check your statements and free credit reports for accounts you do not recognise. Only call your bank on the number on your card or statement.

Watch out for recovery scams

Scammers buy lists of people who have already been scammed, then call, text or write offering to recover the money for an upfront fee. The FTC calls these refund and recovery scams. Government agencies and legitimate organisations will never ask for money to help you get a refund, and will not guarantee you get your money back. Anyone who asks for an upfront fee, your account numbers, or payment by gift card, crypto, wire or payment app to recover a loss is a scammer.

Guides and definitions

• How to file a CFPB complaint, what happens next and does it work (Guide)
• Zelle scams: how they work, what they look like and how to spot them (Guide)
• Regulation E (Regulation E is the US federal rule that limits your liability for unauthorized debit card and electronic transfers to $50 or $500 if you report them in time.)

Get your own plan with real dates

If you paid another way

• Bank transfer or wire (US)
• Credit card (US)
• Zelle, Venmo, Cash App or PayPal (US)
• Cryptocurrency (US)
• Gift cards (US)
• Cash, check or other (US)
• Gave bank details, passwords or a one-time code (US)

The same in the UK · All scam recovery guides · Get your own plan with real dates

Common questions