What To Do After a Scam: 7 Steps for the First 24 Hours

No one ever expects to become the victim of a digital scam, until it happens. It often starts with something seemingly harmless: a fake invoice from “your bank,” a job offer that sounds too good to be true, or a friend’s hacked WhatsApp asking for a quick loan. And just like that, your personal data, financial details, or even your identity may already be in the wrong hands.

The rise of digital scams in Indonesia and globally has made it clear: anyone can be a target. From students and jobseekers to small business owners and corporate executives, online criminals prey on trust and speed. Phishing, fake online shops, and impersonation scams are among the most common forms of attack, many of which leave victims unsure of what to do next (Bitfender, 2024)(Kominfo, 2023).

We often focus on prevention, on tips and red flags to avoid falling for scams. But what happens after the scam succeeds? What if the worst-case scenario already happened?

This article focuses on that: The moment after the attack, when you realize you’ve been scammed and need to act fast, with clear, actionable steps. Because how you respond in the first few hours can make the difference between a contained incident and a larger disaster.

1. Secure Your Accounts and Devices Immediately

The moment you suspect that you’ve been scammed, your first priority is containment. Don’t wait. Scammers often move fast, trying to access linked accounts, reset passwords, or continue draining your funds.

In most digital scams, the attackers are after more than just a one-time transfer of money, they’re also targeting your data, your digital identity, and access to your devices and online platforms.

For example, a single compromised email address can be used to reset passwords for other services. If malware was installed through a phishing link or fake app, the attacker may already be monitoring your activity in the background. That’s why your response needs to be swift and thorough.

Here’s what you should do ASAP:

• Change Your Passwords

Start with your most sensitive accounts: email, online banking, and social media. These are often the entry points scammers use to escalate the attack. Use strong, unique passwords (avoid reusing old ones), and if possible, use a trusted password manager to store them securely.

Also read: Stop Making These Common Password Mistakes

• Enable Two-Factor Authentication (2FA)

Wherever available, activate 2FA (Two-Factor Authentication) or even better MFA (Multi-Factor Authentication) to add an extra layer of protection. Even if someone has your password, they won’t be able to access your account without the verification code sent to your phone or authentication app. This is especially important for email, e-wallets, and financial apps.

Also read: Protect Your Accounts with 2FA – It's Easier Than You Think! 

• Run a Full Security Scan on All Devices

If you clicked a suspicious link, downloaded a file, or installed an unfamiliar app, your device could be infected with malware or spyware. Run a full antivirus scan on your phone, laptop, or any other device that might have been exposed. If malware is found, follow the security software’s instructions to quarantine or remove it.

• Log Out of All Active Sessions

Most platforms (like Google, Facebook, and Instagram) allow you to view and log out of active sessions remotely. This ensures that if someone is still logged into your account from another device, they’ll be kicked out immediately. Don’t skip this step, especially if your password was exposed.

• Monitor Your Activity Closely

Over the next few days, keep an eye on your accounts for unusual activity, such as password reset attempts, new device logins, or unfamiliar transactions. Set up email or SMS alerts for suspicious activity from your bank or digital wallet provider.

Most importantly, monitor your financial activity. Check your bank, e-wallet, or credit card statements for suspicious transactions. If banking data was involved or exposed, contact your bank immediately. For example, as advised by BCA in their scam prevention guide, use their official contact channels like Halo BCA (1500888) or the haloBCA app, and never respond to numbers that start with unofficial codes like +62 or 021.

Taking these steps as early as possible can prevent a bad situation from getting worse. Scammers often act quickly after gaining access, so your response time matters. The more doors you close, the fewer opportunities they have to move further into your digital life.

2. Pause to Regain Focus

Once the immediate danger is under control, take a moment to breathe. Don’t rush into panic-driven action, instead, take a pause to clear your head.

Psychiatrist Dr. Lim Boon Leng described how scam victims are often the first to judge themselves and often face an overwhelming emotional toll. Guilt, shame, and disbelief are common reactions. In fact, many victims replay the moment over and over, wondering how they could’ve missed the signs (Channel News Asia, 2023).

This emotional response is completely normal, but it can also cloud your judgment.

Some victims keep their experience quiet out of embarrassment or fear of ridicule, especially when scams involve personal relationships or significant losses. Others feel isolated and ashamed, which only delays recovery. According to Dr. Lim, the psychological aftermath can last months or even years without proper support.

That’s why it's important to pause, not to blame yourself, but to create mental space. To refocus. Because in the hours immediately after a scam, your ability to think clearly will help contain the damage and guide the recovery process.

You're not foolish for being targeted. These scams are designed to trick people by playing on emotion, urgency, and trust. What matters most is what you do next.

3. Identify the Type of Scam You Encountered

Then, you need to start really understanding what exactly happened. Different scams require different follow-up actions, and the sooner you can pinpoint the type, the better equipped you’ll be to take the right steps.

These are some of the most common types of online scams today (Bitdefender, 2024):

• Phishing

This is one of the most widespread scams. It typically involves fake emails, messages, or websites designed to trick you into revealing sensitive information like your login credentials, credit card number, or OTP code. Some phishing attacks can be extremely convincing, mimicking official bank pages or even government portals.

Also read: Think Before You Click! How to Spot Phishing Scams and Protect Your Data 

• Online Shopping Scams

These occur when you make a purchase through a fake or scam website or seller, often for items that never arrive, or turn out to be counterfeit. These scams tend to spike around big sales seasons or during limited-time offers, when buyers are less cautious.

Also read: Avoiding Online Shopping Scams

• Investment Fraud

Here, scammers lure victims with promises of high returns and minimal risk, often using fake testimonials, flashy social media ads, or fake “financial advisors.” Once money is transferred, the scheme vanishes, along with your funds.

Also read: Financial Online Scams to Watch Out For This Year

• Impersonation Scams

These involve someone pretending to be a trusted figure (like a bank officer, a tech support agent, a recruiter, or even someone you know personally) via hacked accounts. The scammer may pressure you into transferring money or sharing personal data under the guise of urgency or authority.

Also read: Top Cyber Attacks in 2024 and How To Prevent Them in 2025

Understanding which category your experience falls into helps determine what kind of evidence to gather, who to report to, and how to prevent further damage. For example, phishing scams might require you to secure your email and bank accounts immediately, while an online shopping scam may require contacting the platform or filing a dispute with your bank.

Scams may differ in format, but they all rely on one thing: your trust. Recognizing the pattern is the first step to taking back control.

4. Collect and Preserve All Evidence

Even if it’s difficult to revisit, preserving evidence is essential. Document everything: screenshots of messages, emails, transaction history, fake profiles, and website URLs.

These materials will serve as proof if you report the scam to the police, dispute charges with your bank, or seek legal support. The more thorough your documentation, the higher your chances of recovering losses or preventing further attacks.

5. Report the Incident to Official Authorities and Platforms

Reporting matters, not just for your case, but to prevent others from becoming victims. If you’re based in Indonesia, here’s where to start:

• CekRekening.id — Report fraudulent bank accounts or e-wallets (Ministry of Communication & Informatics).
• AduanNomor.id — For phone numbers used in scam calls or SMS.
• AduanKonten.id — Report phishing websites, social media scams, or fake accounts.
• LAPOR.go.id — Government-run platform for public complaints.
• Nearest police station (Polsek/Polres) — File a formal report with full documentation.
• The platform or service involved — Instagram, Shopee, GoPay, etc.

Online scams in Indonesia fall under Pasal 378 KUHP and the Electronic Information and Transaction Law (UU ITE), which give victims the legal right to report and pursue justice (Hukum Online, 2025).

6. Explore Financial and Legal Recovery Options

Not all scams result in permanent loss. If you act quickly, you may be able to dispute the transaction or recover your funds. Here’s what you can try:

• File a dispute with your bank or e-wallet provider
  Request a reversal or investigation.
• Check platform buyer protections
  Sites like Tokopedia, Shopee, and OVO have refund processes for verified scams.
• Contact OJK or BPKN
  For investment scams or consumer protection issues.
• Seek legal advice
  For significant losses, especially involving property or fake job offers.

7. Strengthen Your Digital Defenses

Once everything is taken care of, the most important thing you can do is learn from the experience. Moving forward:

• Use 2FA/MFA on all sensitive accounts
• Install a trusted password manager
• Stay informed about emerging scams
• Educate your family, friend, and team at work

Also read: 5 Simple Steps to Enhance Your Online Privacy 

Summary

Being scammed can feel like everything spiraled out of control. It can leave you shaken, frustrated, and unsure of what to do next. But here’s what matters most: you still have power over what happens after.

How you respond in the first 24 hours can significantly influence the outcome. Whether it’s limiting financial loss, securing your accounts, or starting the recovery process, quick and informed action makes all the difference.

And while the experience may feel isolating, you are not alone. Digital scams are a growing problem, affecting individuals and organizations across the world. But with the right knowledge, tools, and support, they can be navigated, even mitigated.

At Cisometric, we believe that cybersecurity is something everyone should have access to. That’s why we consistently publish updates on emerging cyber threats, case studies, and practical tips for digital protection, designed for both individuals and businesses.

Follow our social media for more updates:

LinkedIn: Cisometric

Instagram: @cisometric

Youtube: @Cisometric 

Reference:

What to Do If You’ve Been Scammed Online: 5 Steps to Take ASAP 

Beware of Online Scams! Here is How to Report it

How to Get Your Money Back After Falling Victim to Fraud in Indonesia

Cara Melaporkan Penipuan Online

Commentary: Scam victims are the first to judge themselves