The hours immediately after you realise what has happened are the ones that matter most, and they are also the hours when it is hardest to think clearly. This is a short list of what to do straight away, before anything else.
1. Send nothing further
Whatever you are being told is standing between you and your money — a withdrawal tax, a compliance charge, an account unlock fee, a fine from a regulator, an insurance deposit — is not real. Every one of these is a standard line used to extract a further payment. Legitimate exchanges and regulators never require a customer to send money in order to release money. Stop paying, and do not announce that you have worked it out.
2. Cut off access
- Uninstall any remote-access tool you were asked to add, such as AnyDesk, TeamViewer or a similar screen-sharing app.
- Change the password on your email first, then on any genuine exchange or bank account, and reset two-factor authentication.
- Revoke token approvals given to the platform’s contracts — an old approval can still empty a wallet.
- Move any remaining crypto to a new wallet whose seed phrase has never been entered on a website.
3. Capture everything while it still exists
Fraudulent sites are taken offline quickly, and messaging accounts are deleted the moment they stop being useful. Export the full chat history rather than screenshotting the interesting parts. Photograph the platform’s dashboard showing your balance and any withdrawal request. Save every transaction hash and receiving address, note the domain name, and record any company name or registration number the platform claimed. Take copies of bank statements covering the payments.
4. Tell your bank the same day
If a card payment or bank transfer was involved at any point, speed changes the outcome more than anything else. Ask directly about a chargeback or a payment recall, and give the reference numbers. Banks work to tight windows, and a report on day one is treated differently from one on day thirty.
5. Report it, and keep the reference
File with your national fraud or police reporting service, and with the financial regulator in whichever country the platform claimed to operate from. Contact the exchange that handled your outgoing payment — on occasion funds have not yet been moved on and can be frozen, but only if the exchange hears in time. These reports rarely produce a quick refund, and they create the record everything later depends on.
6. Expect the second approach, and refuse it
Lists of people who have lost money are bought and sold. A recovery offer that arrives unprompted, asks for payment before doing any work, or promises a guaranteed result, is the same operation wearing a different name. Check any firm yourself against the register of the regulator it claims to be authorised by, using a search you run rather than a link you were sent.
7. Write the timeline down
While it is fresh, write a plain account of what happened in order: how you were approached, what you were told, what you paid and when. Every bank, regulator and investigator will ask for this, and the version written in the first week is always more accurate than the one written three months later.
