I Gave a Scammer My Information — What Should I Do?

Warning signs to look for

• Password-reset emails arriving for accounts you did not touch
• Small unfamiliar charges, often a dollar or two, on a card
• Login alerts from cities or devices you do not recognise
• Mail, statements, or verification texts that stop arriving
• A new account, loan, or credit inquiry you did not apply for
• Friends or family receiving messages that appear to come from you

If you gave away a password

Change it now, from a device you trust. Do your email account first — it is the master key that resets everything else. Then change the account that was targeted and every other account where you reused that password or a close variation. While you are in each account's security settings, check for devices you do not recognise, unexpected mail-forwarding rules, and recovery phone numbers or addresses that are not yours; attackers add these so they can return later. Turn on two-factor authentication everywhere it is offered, and prefer an authenticator app over text messages where you have the choice.

If you gave away card or bank details

Call your bank or card issuer using the number printed on the card, not a number from any message. Ask them to block the card, review recent activity, and issue a replacement. Look through your own transactions too, including tiny test charges. In the United States, federal rules limit your liability for unauthorised card charges when you report promptly, and debit-card protections are strongest in the first two business days — so speed genuinely matters. Set up transaction alerts before you hang up.

If you gave away your Social Security number

Place a credit freeze with all three major bureaus — Equifax, Experian, and TransUnion. A freeze is free, can be lifted temporarily whenever you need credit, and is the single most effective step against new accounts being opened in your name. Then go to IdentityTheft.gov, which generates a personalised recovery plan and the letters and affidavits you may need. Consider requesting an Identity Protection PIN from the IRS to stop fraudulent tax filings.

If you gave away a one-time verification code

Someone was almost certainly signing in as you at that moment. Change that account's password, then use the security settings to sign out of all other sessions and revoke connected apps. Check for changes to recovery details and forwarding rules. If it was a mobile carrier code, call your provider and ask about a port-out PIN, because SIM-swap attacks are used to take over bank and crypto accounts.

If you sent copies of ID documents

Photos of a driver's licence, passport, or utility bill are used to open accounts and pass identity checks. Freeze your credit, report to the agency that issued the document, and keep a record of what you sent and when. For a driver's licence, contact your state motor-vehicle agency; for a passport, contact the issuing authority. Keep the original scam messages as evidence.

Tell someone and write it down

Keep a simple log: what you shared, when, with whom, and every call you make about it. Institutions will ask for this repeatedly, and it makes disputes far easier. Tell a family member or trusted friend too — not because you did anything foolish, but because a second person notices follow-up attempts you may miss while you are stressed. Scammers rely on embarrassment to keep people silent.

Then close the door on repeat attempts

You are now on a list. Expect more contact, often more convincing than the first attempt, and often claiming to be from your bank's fraud team. Nobody legitimate will ask you to move money to a 'safe account'. If a new message arrives that you cannot immediately dismiss, forward it to check@spamcheck.com and get a plain-English answer before you act on it.

Frequently asked questions

Is a credit freeze the same as a fraud alert?

No. A fraud alert asks lenders to take extra verification steps and lasts a year. A freeze blocks new credit checks entirely until you lift it. Both are free, and a freeze offers stronger protection.

How long should I keep watching for problems?

Stolen data is often used months later, sometimes years. Check your credit reports periodically at annualcreditreport.com, keep transaction alerts switched on, and stay alert to unexpected account notices.

Can I undo the damage myself, or do I need to pay a service?

Every essential step — freezes, fraud alerts, disputes, IRS PINs, and recovery plans — is free through official channels. IdentityTheft.gov walks you through them. Paid recovery services that contact you first are frequently scams themselves.

I only gave my name and email address. Do I need to do all this?

No. That combination is low risk on its own. Block the sender, report the message, and expect a period of increased phishing attempts aimed at your address.

Sources

• FTC — IdentityTheft.gov recovery plans
• FTC — Credit freeze and fraud alerts
• FTC — Report Fraud

Related guides

• I Clicked a Phishing Link — What Should I Do?

  Clicking a phishing link is usually recoverable — especially if you did not type anything on the page that opened. Work through these steps in order.

• I Sent Money to a Scammer: What Should I Do?

  Recovery depends almost entirely on how you paid and how fast you move. Follow the steps for your payment method below.

• I Replied to a Scam Email — What Should I Do?

  Replying to a scam email is not a disaster, but it does mark you as a live target. Here is how to shut the conversation down and protect what matters.

• Is This Bank Email Real or Fake?

  Bank alerts are the most imitated emails there are. Here is how to separate a real notice from a convincing fake in a couple of minutes.

• How to Protect Your Parents From Online Scams

  You can't watch their inbox for them. But one afternoon of setup and one ongoing habit can close most of the risk.

• I Downloaded an Attachment From a Suspicious Email

  Downloaded — or opened — an attachment you shouldn't have? Work through these steps in order. Most people are fine, but the next hour matters.