Time-critical · start now

FREENo account. No card. No payment.

Your Recovery Pack

Start with the phone call. A transfer recall or crypto freeze can become harder by the hour; the paperwork comes second.

Start the first hour

No false promise. Most victims do not get their money back; published studies put near-full recovery at around 6%. This pack helps you file quickly, completely and in language banks, exchanges and investigators can act on.

1 · The first hour 2 · The bank call, word for word 3 · When they push back 4 · The evidence package 5 · Where to file it 6 · Crypto tracing 7 · The recovery scam 8 · The next 72 hours

The first hour

In this order. Not in the order that feels most comfortable.

Call the bank. Do not write, do not use secure message, do not wait for Monday.

Use the number on the back of your card or on the bank’s own site — never a number from the conversation. Ask for the fraud department, not general customer service. General service cannot issue a recall.

Say these words, in this order

“I have been the victim of fraud. I authorised a payment under false pretences. I am requesting an urgent recall and a fraud claim. Please give me a crime reference or case number before we end the call.”

Do not accept “you authorised it, so there is nothing we can do”

Authorised push payment fraud is exactly the case where the bank moved the money on your instruction. Ask them to log it as APP fraud and to open a recall request to the receiving bank regardless. Then ask for the name of the person you spoke to and the time.

Freeze the account you paid from

Not just the card. If they have your login details, or if you screen-shared at any point, assume the account is compromised and have it frozen while you are still on the phone.

Stop the conversation. Do not announce it.

Do not tell them you have called the bank, and do not ask for a refund. Telling them converts a silent recall into a person who knows they are about to be caught, and the money moves within minutes. Simply stop replying.

Screenshot everything, now, before anything disappears

Profiles, numbers, photos, every link, every wallet address, every payment confirmation. Accounts get deleted quickly once a scammer suspects a report. Screenshots with visible timestamps are worth more than a written summary.

The bank call, word for word

Read this aloud. Do not paraphrase, do not soften it, and do not let the call become a conversation about how this happened.

Open the read-aloud scriptSeven lines, in order

“I am reporting fraud on my account and I need the fraud department now. This is time-critical.”

“I sent [amount] to [recipient name] on [date] at [time], via [bank transfer / card / crypto exchange]. The receiving details were [sort code and account number / card last four / exchange and wallet address].”

“I was manipulated into authorising that payment by someone I believed to be [a romantic partner / an investment manager / a bank officer / a government official]. It was not a purchase and it was not a gift. I am requesting an urgent recall of the funds.”

“Please open a fraud claim and submit a recall request to the receiving institution today. I understand the window closes quickly and I do not want to lose it to an internal queue.”

“Please give me the case number, your name, and the direct reference for the recall request before we finish.”

“I also want a note on my file that I reported this within [X hours] of the payment. That timestamp matters for the claim.”

“I am freezing this account. Please tell me what else you need from me to complete the claim.”

Immediately after the callFour follow-up actions

Write down the case number immediately, and the name and time of the call.
Ask for the claim in writing by email so there is a record that it was opened.
If the payment was by card, ask separately for a chargeback. A chargeback and a fraud recall are different processes with different deadlines, and banks frequently open only one. Card chargeback windows are typically 120 days, but start it now.
If the bank refuses, ask for the refusal in writing and for their formal complaints procedure. You will need that document for the ombudsman or regulator stage.

When they push back

The six responses that end calls early, and what to say instead. Keep the call on the recall; do not let it become a discussion about how this happened.

“You authorised the payment yourself, so it isn’t fraud.”

It is authorised push payment fraud — that is the specific category for a payment I authorised because I was deceived. Please open the claim as APP fraud and submit the recall anyway. If you are declining, I want the refusal in writing with the reason and the policy reference.

“There’s nothing we can do, the money has already left.”

The recall request goes to the receiving bank, not to you. They can still freeze the receiving account. Please submit the recall and give me the reference. I am also filing a police report today, and I will send you the reference number.

“We’ll investigate and get back to you in 30 days.”

An investigation and a recall are two different things. The recall is urgent and the investigation is not. Please submit the recall request today and run the investigation separately. What is the recall reference?

“Crypto payments can’t be reversed.”

A blockchain transaction cannot be reversed, but the receiving exchange can freeze the address before the funds are withdrawn or mixed. I want a report filed with the exchange and with law enforcement today, while the funds may still be sitting in a custodial wallet. Please give me whatever your institution can issue for that report.

“You were warned at the time and you continued.”

A warning is not the same as protection, and it does not remove your obligation to process a fraud claim. Please open the claim. If you are refusing on that basis I want the refusal in writing and your formal complaints procedure.

“We can’t discuss it with you until you complete this form.”

Then take my report now and send me the form, because the recall window closes before a form can be returned. I am asking you to log the report and start the recall today, with the paperwork to follow.

The evidence package

A bank fraud team and a police report need the same eight facts. Produce them once, in this order, and send the same document to both. An incomplete file is the most common reason a claim stalls.

Open the eight-item evidence checklistWhat to include and why each item matters

Include	Why it matters
Your full name and contact details	Must match the account the money left from.
Every payment: date, time, amount, currency, method	Include failed attempts — they establish the pattern and the pressure.
Receiving details for each payment	Account name, sort code/routing and account number, card last four, or exchange plus wallet address. This is what a recall is actually issued against.
Where you first met them	Platform, handle, profile URL, date. 60% of these start on social media rather than a dating app.
Every identifier they used	Phone numbers, email addresses, usernames, photo filenames, company names, website URLs, and any “registration” or licence numbers they quoted.
The conversation, in full, with timestamps	Export or screenshot. Do not summarise and do not edit out the parts that are embarrassing — an obviously edited transcript invites doubt about the rest of it.
What you were told the money was for	Quote their words. The gap between the stated purpose and the actual destination is the core of the claim.
Every report reference you already have	Bank case number, police or IC3 reference, platform report ID. Cross-referencing them is what moves a file up a queue.

Copy the fill-in timelineA structured chronology for the bank and police

Keep the headings. A claim reviewer who can find a date in two seconds treats the file differently from one who has to hunt for it.

FIRST CONTACT
  Date / platform / handle / profile URL:
  How the conversation started (their opening message, verbatim):

ESCALATION
  Date the relationship or investment framing began:
  Date money was first mentioned:
  Date you were told not to involve anyone else:
  Any deadline, urgency or "opportunity closes" language (quote it):

PAYMENTS
  1.  Date / time / amount / method / receiving details / stated purpose
  2.
  3.
  Total sent:
  Failed or declined attempts (these matter):

AFTER
  When you stopped being able to reach them:
  When you realised, and what made you realise:
  Anyone who has contacted you since offering to help recover the money:

REPORTS FILED
  Bank / card issuer  — name, date, case number:
  Police / national fraud centre — date, reference:
  Platform (site or app) — date, report ID:
  Crypto exchange — date, reference:

Where to file it

For Anywhere else. File with all of them, on the same day, and give each one the reference numbers from the others — cross-referenced reports move faster than isolated ones.

Your national fraud or cybercrime reporting centre Search "report fraud" plus your country name — nearly every country now operates one, and most allow online filing. Your bank Always the first call. Recovery windows close in hours, not days.

Also report the profile to the platform where the conversation started, and the receiving bank if you can identify it. Both hold records that law enforcement can request, and neither will act unless a report exists.

If you paid in crypto

Blockchain transactions are irreversible. That is not the end of it. Most fraud proceeds pass through a custodial exchange at some point, because the criminal eventually needs fiat currency, and a custodial exchange can freeze an address and a balance. Freezes happen — the FBI’s Operation Level Up notified 5,831 victims and prevented roughly $359m from being withdrawn. The variable is speed, not possibility.

Identify every receiving address and the chain it is on

Copy the full address from your transfer history, not from the chat. Note the network (Bitcoin, Ethereum, TRON, and so on) — a mistake here sends your report to the wrong place.

Report it to the receiving exchange if you can identify one

Paste the address into a block explorer and look at the destination of the next hop. If it lands on a known exchange deposit address, use that exchange’s fraud or law-enforcement reporting channel the same day. Every major exchange has one.

Report it to the exchange or broker you bought the crypto from

They can flag your account, may be able to stop further purchases, and they hold records that law enforcement can subpoena. Ask them to preserve the records in writing.

File with law enforcement and include the transaction hashes

A txid is what makes a crypto report actionable. Without hashes there is nothing for an investigator to follow. Include sending address, receiving address, amount, timestamp and chain for every transfer.

Keep every address in one document and never delete anything

Victims routinely lose their transfer history when an account is closed. Export it now, while you still can.

Do not pay anyone who claims they can “trace” or “reverse” your crypto for an upfront fee. That is a recovery scam, and it is the most common second loss. Legitimate tracing is done by law enforcement and by the exchanges themselves, and neither asks you for a fee in crypto first.

Open the exchange report templateFill in the brackets; transaction hashes make it actionable

SUBJECT: Urgent — fraud proceeds traceable to your platform, freeze request

To: [exchange] fraud / law-enforcement response team
Date filed: [today]

I am a victim of investment fraud. Funds taken from me are traceable to
addresses on your platform. I am requesting that you preserve records and
freeze any balance associated with the addresses below, and that you respond
to law enforcement requests for this case.

  Victim:                     [full name, email, phone]
  Law enforcement reference:  [IC3 / police / national centre number]
  Total loss:                 [amount and currency]
  Date range of transfers:    [first] to [last]

  Chain          Receiving address                              Txid(s)
  ------------   -------------------------------------------    ------------------
  [Bitcoin]      [full address]                                 [txid]
  [TRON]         [full address]                                 [txid]

  Where the funds came from:  [your bank / card / exchange account]
  What I was told they were for (their words): "[quote]"

I understand transactions are irreversible. I am asking for preservation and
freezing, not reversal. I can provide the full conversation transcript and
screenshots on request.

The recovery scam

Victim lists are sold. Once you have been defrauded you are on one, and you will be contacted again — often within days, often by the same people using a different name. They now know exactly how much you lost and how much you are willing to pay to get it back, which makes you a better target the second time than the first.

It looks like this

They contact you first. You did not find them.
They claim to be the FBI, Interpol, Europol, a government agency, a bank’s fraud unit, or a regulated “recovery firm”.
They ask for an upfront fee, a “tax”, a “release charge”, or a deposit before releasing your funds.
They ask to be paid in crypto, gift cards, or by a different method than the one you lost money through.
They show you a dashboard, a screenshot or a document proving your money has been “recovered” and is waiting.
They know details only the original scammer would know — your amounts, your dates, what you were told.
They guarantee a result, or quote a success rate.
They create urgency: the funds will be released today only, or the window closes.
They ask you to keep it confidential, or not to tell your bank or family.

What is never true

No law-enforcement agency anywhere contacts a victim to offer paid recovery. They do not charge, and they do not ask for crypto.
No legitimate recovery firm asks for payment before work, in crypto, or by gift card.
Nobody can “reverse” a blockchain transaction. Anyone who says they can is lying about the mechanism.
A recovered-funds dashboard you are shown by the person asking for the fee is not evidence. It is theatre.

What to do

Do not reply. Do not negotiate. Do not ask them to prove it — that keeps you in the conversation.
Report the approach to the same places you reported the original fraud, and say explicitly that this is a follow-up recovery attempt. That pattern is what gets a case escalated.
Block the number and the address, then check whether they have already reached you on a second channel.
Tell one person you trust that you are being targeted again. Recovery scams work on isolation, exactly like the first one.
If you have already paid them, treat it as a new incident: call your bank again, today, and open a second claim. Do not let embarrassment cost you the second window.

The next 72 hours, in order

Work down this list. If you only do three things, do the first three.

Open the complete 72-hour sequence9 stages, ordered by urgency

Hour 0–1

Bank or card issuer by phone. Fraud department. Request the recall and get a case number. Freeze the account you paid from.

Hour 1–3

Screenshot and export everything while the accounts still exist. Start the evidence timeline above. Do not contact the scammer.

Hour 3–12

File with law enforcement (IC3 in the US, Action Fraud in the UK, your national fraud centre elsewhere). Include every identifier and, for crypto, every txid.

Day 1

Report the profile to the platform where it started. Report the receiving bank if you can identify it. Ask your bank for the refusal or acceptance in writing.

Day 1–2

Change passwords everywhere you reused one, and turn on two-factor authentication that is not SMS if you can. Freeze your credit if any identity detail was shared.

Day 2

Send the completed evidence package to your bank claim, the police reference, and the platform report — cross-referenced, so each file points at the others.

Day 2–3

Expect the recovery approach. It usually arrives in this window. Read that section again before you reply to anyone, and do not reply.

Week 2

Chase the claim in writing with the case number. If refused, start the formal complaints process — that document is what the ombudsman or regulator stage needs.

Ongoing

Keep a single dated log of every call, name, time and reference. Disputes are won on documentation, not on memory or on how wronged you feel.

You did not do something stupid.

Fraud at this scale is run by organised groups working scripted playbooks, in shifts, against thousands of people at once, increasingly with generated photos and cloned voices. In 2025 the FBI recorded $929.3m in romance and confidence fraud losses in the United States alone, up 38% on the year before. The people who run this are professionals at it and you were not. The only decision left that matters is what you do in the next hour.

Analyse the conversation

This is general information about how fraud claims and reports work, written to be actionable in a hurry. It is not legal advice and it is not specific to your bank, your jurisdiction or your case. Where a deadline or an amount is large, a lawyer who handles financial fraud is worth the money — and unlike a “recovery firm”, a licensed lawyer is regulated and cannot ask you for payment in crypto.