Someone already has your money, a password, or remote access to a computer. Can you still get any of it back? You might still get money back if you notify the right place before the clocks run out, and if the payment rail treats the transfer as unauthorized.
Unauthorized transfers and scam payments you approved are different problems.
This is for U.S. consumers. It isn't a courtroom brief, and it isn't legal advice. Bank procedures can still add their own paperwork on top of the federal baseline.
Stop more damage before you argue about a refund
Phone your bank or credit union right away if a debit card, ATM card, or online banking login was involved, and tell them to freeze the card. Change that password from a device you trust.
Unplug from the network if a stranger had remote access.
Don't keep banking on that machine. Save emails, screenshots, wallet addresses, phone numbers, and confirmation codes before the details fade. A messy folder still helps next week.
Work in this order:
- Freeze or cancel the compromised debit card or login.
- Call the bank or credit union and report unauthorized activity or a scam payment.
- If gift cards were involved, contact the issuer with the remaining codes.
- If crypto moved, contact the exchange you used and give the destination wallet.
- Write a one-page timeline while the details are still sharp.
- After those calls, file an IC3 complaint and use the FTC recovery steps.
Don't wait on a police callback to notify the bank. Electronic-transfer deadlines can run from a statement date.
The rail you paid on decides what recovery even means
The FTC page on what to do if you were scammed is blunt: if you already paid, the money might be gone. Report it anyway.
Speed is what freezes a leftover gift-card balance or a debit card that isn't empty yet.
Thing is, a stolen debit charge and a romance-scam wire are not the same problem. One may be an unauthorized electronic fund transfer. The other is often a payment you approved, even though the story was fake.
| How you paid | Contact first | What official sources actually say |
|---|---|---|
| Stolen or cloned debit card, or a missing EFT | Your bank or credit union, immediately | Federal liability limits can apply if you notify on time |
| You were tricked into a debit payment | Your bank or credit union, immediately | The FTC still tells you to report it; a refund is not guaranteed |
| Gift card numbers and PINs | The gift card issuer | Contact them at once; unused value is the part that might still be stoppable |
| Cryptocurrency | The exchange you used | Contact them; completed transfers are hard to unwind |
| Money you sent on purpose after a story | Bank, app, or wire provider | Report it, but don't assume a debit-style error claim |
Use that as a map. It isn't a refund guarantee.
Unauthorized debit activity and the notice clocks
CFPB's Regulation E liability rule is the federal baseline when an access device is lost or stolen and someone runs unauthorized transfers. The notice clock is short.
Notify the institution within two business days after you learn of that loss or theft. Your liability generally cannot exceed the lesser of $50 or the unauthorized transfers that occurred before notice. Miss the two-business-day window and the same rule can raise what you're on the hook for. It can reach $500 in the situations the rule describes.
Saturday counts as a business day. Sunday does not. People treat Saturday like a dead day, wait until Monday evening to call, and then they miss a window that CFPB actually counts as a business day, which is a rotten surprise when the clock started Saturday and they thought they still had time.
A period that starts Saturday can run through 11:59 p.m. on the second business day.
There's a second clock too. CFPB's explainer on money missing from an account says you must notify the bank within 60 days after it sends the statement that first showed the unauthorized transfer. Wait longer and you could have to cover later unauthorized transfers that happened after that 60-day window and before you finally called.
If they ask for a written follow-up and you skip it for ten business days, they are not required to post a temporary credit during the investigation. They still have to resolve the dispute.
CFPB describes a 45-day resolution track in that explainer.
Tell them it was unauthorized if the card or login was used without your permission. Ask whether they opened an error-resolution claim, and get the reference number.
These caps cover unauthorized electronic fund transfers, not every payment you typed because a romance or tech-support caller talked you into it.
Gift cards they rushed you to buy
FTC gift-card guidance treats a demand for Apple, Google Play, or Amazon card numbers as the scam, whether the story is a tax office, a software company, or a jailed grandkid. Call the issuer with those numbers while you still have them, keep the plastic and the receipt, and to be honest the unused balance is the only piece that still might freeze, because drained codes are often gone.
Crypto sent to a wallet you don't control
Contact the exchange you used after a crypto send, which is what the FTC recovery page tells you to do. Scammers push crypto because a finished send does not reverse like some debit disputes.
Give them the destination address and the timestamp. Skip the "recovery specialist" who found you in DMs. That's a second bite.
A lot of these transfers never come back. File anyway so the exchange can try a freeze and so the report exists.
How phishing, romance, and fake tech support usually show up
A lookalike bank, delivery, or payroll message that wants a click or a password is phishing. If you already typed credentials, that password is burned. Change it, then call the real institution on a number from the card or the official app.
Hang up on the pop-up or cold call that wants remote access and a gift-card payment. Don't let fake tech support reconnect. Urgency plus gift cards plus a story you can't verify on a published phone number is enough reason to stop. The money ask is the clean filter.
Don't send more if a dating-app match who spent weeks building a bond now needs crypto or a wire for an emergency. They will often ask for just a little more to unlock the first pile, which is how people get in deeper than they meant to. Stop sending, tell the app, and don't fund a "rescue" of the earlier payment.
The FBI has warned about text and voice campaigns that impersonate senior U.S. officials. Don't follow those instructions, and report them through IC3 like other internet-enabled fraud; the FBI's alert on official impersonation is the public write-up of that campaign.
File reports after the phone calls, not instead of them
IC3 is how the FBI takes internet crime complaints. You can file if you believe you were hit by a cyber-enabled crime, including when the other person is abroad. Analysts review what you submit and pass it to law enforcement when it fits.
They don't investigate your case as a service desk.
IC3's FAQ says they cannot give you the status of a complaint you already filed. The form is still worth the time. Turns out some banks ask whether you filed. The complaint also feeds pattern matching you will never see.
Follow the FTC recovery steps for debit, gift cards, and crypto in parallel.
Leave IC3 out of your refund timeline. If a debit card or bank login was involved, make today's call the bank call. Then file IC3 with the timeline and screenshots you already gathered.