If this happened to you, you are not alone and it is not your fault. Scammers are professionals who fool kind, careful people every day. Go one step at a time. You don't have to do everything today.
Read-aloud isn't available in this browser. You can use your device's built-in screen reader instead.
Answer a few questions. Nothing you click leaves this page.
📰 Real cases
City of Dallas, 2023
The city's report says ransomware attackers got in on April 7, 2023 and began encrypting servers on May 3. Personal information of 30,253 people was potentially exposed.
The Justice Department announced charges over forced-labor scam compounds and a forfeiture action against about 127,271 bitcoin. Charges are allegations.
This site is run for free as a public service. Donations are appreciated, but never required. Donations are not tax-deductible (we are not a registered charity). Help is never conditioned on payment.
Hi, I'm Veronica, a cybersecurity professional with hands-on experience fighting fraud. Cybersecurity and protecting others is my passion. I built this site for free because no one should face a scam alone, and education is key for protection.
If something happened to you, an attack, a fraud, or a scam, take a breath. You are not alone, and it is not your fault. Scammers are professionals who work hard to fool kind, careful people. This page walks you through calm, numbered steps, one at a time. You don't have to do everything today.
For people in the United States, with extra Texas resources. Every link and phone number on this page was checked on the official site on 2026-10-26. This page is information, not legal advice.
Stop all contact with the scammer. Hang up. Don't reply.
If a computer may be infected, disconnect it from the internet: unplug the network cable or turn off its Wi-Fi. If you cannot disconnect it, CISA's checklist says to power the device down to stop the spread, and notes this loses some evidence, so do it only if you can't disconnect another way. (CISA – I've been hit by ransomware!)
If money or card details were involved, call your bank or card company using the number on the back of your card. Ask them to stop or reverse the payment.
Take screenshots of everything before deleting anything.
Watch your bank and card statements for anything unfamiliar.
Be very careful of anyone who offers to "recover" your money for a fee. That is a second scam; see the pig butchering section.
Be gentle with yourself. If you feel overwhelmed, call or text 988.
Money sent, or bank or card fraud
Call your bank or card issuer right away, using the number on the back of your card or in your bank's app. Tell them it was fraud and ask them to reverse the payment.
Bank impersonation texts often look like a security alert asking you to confirm a large purchase. If you reply, a fake "fraud department" may call you. The FDIC says to call your bank directly using a number you know. (FDIC – Bank impersonation scams and fake banks (June 2025))
Device-pairing and code-sharing scams, and "turn it off"
This is one of the most important sections on this page. These scams don't need to "break" your phone. They trick you into letting them in, by scanning a QR code, typing in a code, or approving a pairing or sign-in.
How it works, step by step
Linked-device QR codes. Apps like Signal and WhatsApp let you use your account on more than one device by scanning a QR code. Google found attackers disguising "link a new device" QR codes as group invites, security alerts, or pairing instructions. If you scan one, your messages can be delivered to the attacker in real time. (Google Threat Intelligence – Russia-aligned actors targeting Signal “linked devices” (Feb. 2025))
Device-code phishing. Microsoft reported a campaign where people got a fake meeting invitation and were asked to type a code into a real sign-in page. The code had been created by the attacker, so typing it in gave the attacker access to the account. (Microsoft Threat Intelligence – Storm-2372 device code phishing (Feb. 13, 2025))
Code and approval requests. Someone asks you to read back a code that was just sent to you, or to tap "approve" on a sign-in you didn't start. A bank representative will never call you and ask for your authentication code. (OCC HelpWithMyBank – Multifactor authentication and scams)
Red flags
Anyone asking for a code that was sent to you.
A QR code that is supposed to be a group invite, an alert, or "security" instructions.
A sign-in or pairing request you did not start.
What to do now
Never share a code, and never approve a pairing, sign-in, or code you didn't start.
Open the app's settings, look at its linked devices list, and remove any device you don't recognize.
Change your password from a trusted device and turn on multifactor authentication. (CISA – Turn on MFA)
Turn it off
Turn off Bluetooth when you're not using it.
Don't leave your device in Bluetooth discovery ("discoverable") mode when you don't need it.
Don't accept pairing attempts you didn't start.
Check now and then which devices are connected or paired, and remove any you don't know.
Turn off Wi-Fi auto-connect (auto-join).
When you're done with a public Wi-Fi network, log out of it and "Forget" it. Delete Wi-Fi networks you no longer use.
Ransomware and computer attacks (the "README" ransom note)
What is a "README" ransom note? Ransomware locks or scrambles your files, then leaves a message, often a text file with a name like README, saying who did it and how to pay. In the 2023 Dallas attack, the city's report includes the content of the attackers' "README.txt" message. (City of Dallas – After-Action Report, May 2023 ransomware incident (PDF))
If you see a ransom note
Don't open any links in it, and don't contact the attackers.
Take a photo or screenshot of the note.
Disconnect the device from the internet: unplug the network cable or remove it from Wi-Fi. If you cannot disconnect it, power it down. CISA notes that powering down loses some evidence, so only do it if you can't disconnect another way. (CISA – I've been hit by ransomware!)
A scary call, text, email or computer pop-up says your computer or accounts have been hacked. The caller ID or message may look real.
You are passed to a fake "fraud department" at your bank, then to a fake government agent (for example, someone claiming to be from the Federal Reserve or another agency). They may even send a letter on fake official letterhead. (FBI IC3 PSA – “Phantom Hacker” scams target senior citizens (Sept. 29, 2023))
Some scammers send scary messages saying they "tracked your IP address", "hacked your network", or "recorded you", and demand money, often in Bitcoin, within a short deadline. These threats are meant to make you afraid and rush you. A government guide on these scams says such a message "does not in itself prove that your device or email account has been hacked", and the same message is usually sent to huge numbers of people. (Traficom (Finnish Transport and Communications Agency) – Sextortion scams: don't believe the scammers' claims) The FBI lists red flags: your old password quoted to scare you, claims of spyware or a recorded video, a short window to pay (typically 48 hours), and payment in Bitcoin. (FBI IC3 PSA – Online extortion scams (Apr. 20, 2020))
If you shared any money or information, contact your bank right away, using the number on the back of your card.
If you truly think a device or your home network is compromised, turn off your router and modem (unplug them) to cut the connection. Before you reconnect, get help to reset the router, change the Wi-Fi password and the router's admin password, and update its software (firmware). (NSFR safety advice; the "disconnect" step follows CISA's guidance: CISA – I've been hit by ransomware!)
"Pig butchering" is the name for scams where someone builds a friendship or romance with you, then leads you into a fake cryptocurrency investment. The U.S. Treasury's FinCEN described it in a 2023 alert. (FinCEN Alert FIN-2023-Alert005 on “pig butchering” (PDF))
The second scam. Afterwards, people may contact you offering to recover your lost money for a fee. Never pay anyone who promises to get your money back. (NSFR safety advice.)
Red flags
A stranger who "texted the wrong number" and wants to keep chatting.
An online friend or love interest who talks about crypto profits.
An app or website showing huge, steady gains.
Any fee or tax you must pay before you can withdraw.
What to do now
Stop sending money, including any "fees" or "taxes".
Contact the crypto exchange or ATM operator and your bank; tell them it was fraud.
Take screenshots of the chats, the website address, wallet addresses and transactions.
Recent case: on Oct. 14, 2025, the Justice Department announced an indictment of the chairman of Cambodia-based Prince Group for directing forced-labor scam compounds that ran "pig butchering" scams, and filed a civil forfeiture complaint against approximately 127,271 bitcoin, then worth approximately $15 billion, described as the largest forfeiture action in DOJ history. An indictment is an allegation; the defendant is presumed innocent. (U.S. Department of Justice – Prince Group indictment and forfeiture (Oct. 14, 2025)) The IC3's 2024 report describes "pig butchering" as a confidence-based scam in which "victims are coached to invest more and more money … only to be unable to withdraw their funds." (FBI IC3 2024 Internet Crime Report (PDF))
Financial scams on social sites
These are financial scams that start with a friendly message, an ad, or a post. If one happened to you, please remember: it happened because someone set out to deceive you, not because you did something foolish.
We are so sorry for your loss. Some scammers copy the details of someone who has died to make fake funeral pages. In a case reported by the Better Business Bureau in Jan. 2024, a fake Facebook account using a deceased person's identity said it had the "official live stream" of the funeral, and the link required a paid membership. A funeral director quoted in the report said a funeral home will not charge a fee just to watch a service. (WGEM News – BBB warns of fake funeral livestream pages (Jan. 2024)) What to do: ask the funeral home directly for the real link; don't enter card details; report the post to the social site, to BBB Scam Tracker, and to the funeral home. Be careful, too, of anyone who suddenly contacts a grieving family to collect a "debt" or settle an "estate": verify with the company or the court using contact details you find yourself.
See the "we have your IP address" section. Don't pay, don't reply, take screenshots, and report. If you're a young person or a parent, please talk to someone you trust; you're not in trouble for asking for help.
How: a call or text saying a grandchild or relative is in trouble and needs money now, and to keep it secret. What to do: hang up, then call your relative or another family member on a number you already know.
Verified figures from the FBI's 2024 Internet Crime Report (FBI IC3 2024 Internet Crime Report (PDF)): reported losses of $16.6 billion in 2024; people over 60 filed 147,127 complaints with $4.8 billion in losses; investment fraud losses of $6,570,639,864; confidence/romance losses of $672,009,052; and 10,956 complaints with $246.7 million in losses involving cryptocurrency ATMs/kiosks.
Understanding the attack: man-in-the-middle and session hijacking
Man-in-the-middle means someone secretly sits between your device and the website you're using, so they can see or change what you send. Session hijacking means they grab your signed-in session and use it to log in as you. On unsecured public Wi-Fi, other users "can see what you see and what you send. They could hijack your session and log in as you." (FTC – Wise Up about Wi-Fi (PDF, govinfo.gov))
Evil-twin hotspots and "stripped" secure connections
No padlock or "https" in the address bar on a site that normally has one. If you think you're on an encrypted site but find yourself on an unencrypted page, log out right away. (FTC – Wise Up about Wi-Fi (PDF, govinfo.gov))
A browser security or certificate warning on a site you use every day.
Never click past a certificate or security warning. Close the page. (NSFR safety advice.)
Forget public networks and turn off auto-join (see "Turn it off" above).
From a trusted device and connection: change your passwords, sign out of all sessions and devices, and turn on multifactor authentication. (CISA – Turn on MFA)
Protecting vulnerable adults
Older adults and adults with disabilities can be targeted by strangers, and sometimes, painfully, by people they trust: family members, caregivers, or someone holding a power of attorney. If you're worried about someone, you don't need proof to ask for help.
Warning signs to watch for
Sudden or unusual withdrawals, transfers, or new cards.
A new "friend", romantic interest, or helper who takes a strong interest in their money.
Bills going unpaid when there should be enough money.
Sudden changes to a will, power of attorney, or bank account names.
Being isolated from family and friends, or new secrecy about money.
Buying gift cards, going to a crypto ATM, or receiving "couriers" at home.
CISA's four core steps for everyone: avoid and report phishing; use strong passwords; use multifactor authentication and a password manager; update software. (CISA – Secure Our World (4 core steps))
Facts below come only from the cited official documents.
City of Dallas ransomware, May 2023
According to the city's after-action report, the Royal group got in on April 7, 2023, using a service account, spent weeks inside, took an estimated 1.169 TB of data, and began encrypting servers early on May 3, 2023. The city reported that personal information of 26,212 Texas residents and 30,253 individuals in total was potentially exposed. Lesson: attackers may be inside long before the ransom note appears; protect logins and keep offline backups. (City of Dallas – After-Action Report, May 2023 ransomware incident (PDF))
A joint CISA/FBI advisory describes a group that posed as IT help-desk staff, talked people into sharing one-time codes, used repeated MFA prompts ("MFA fatigue"), and used SIM swaps. Lesson: never share a code or approve a prompt you didn't start. (CISA/FBI advisory AA23-320A – Scattered Spider)
CERT/CC reported an email with the subject "ILOVEYOU" and an attachment named "LOVE-LETTER-FOR-YOU.TXT.VBS". When opened, it mailed itself to everyone in the victim's Outlook address books and overwrote many files. By May 8, 2000, CERT/CC had reports from more than 650 sites indicating more than 500,000 systems affected. People who received it "will most likely recognize the sender". Lesson: don't open unexpected attachments, even from people you know. (CERT Advisory CA-2000-04 Love Letter Worm (Internet Archive copy))
Nimda worm ("readme.exe"), September 2001
CERT/CC reported a worm spreading by email with an attachment named "readme.exe", through shared folders (copies named README.EML), through infected websites, and by attacking unpatched web servers. On vulnerable systems, just opening or previewing the email could run it. Lesson: keep systems updated, and don't open unexpected attachments. (CERT Advisory CA-2001-26 Nimda Worm (archived copy))
Financial scams on social sites
These are financial scams that start with a friendly message, an ad, or a post. If one happened to you, please remember: it happened because someone set out to deceive you, not because you did something foolish.
Romance scams
How: a stranger builds a loving relationship online, then asks for money or an "investment". Red flags: they can never meet or video chat, and there's always an emergency. What to do: stop sending money, take screenshots, call your bank, and report to ReportFraud.ftc.gov (Federal Trade Commission) and FBI Internet Crime Complaint Center (IC3).
Funeral, obituary and grief scams
We are so sorry for your loss. Some scammers copy the details of someone who has died to make fake funeral pages. In a case reported by the Better Business Bureau in Jan. 2024, a fake Facebook account using a deceased person's identity said it had the "official live stream" of the funeral, and the link required a paid membership. A funeral director quoted in the report said a funeral home will not charge a fee just to watch a service. (WGEM News – BBB warns of fake funeral livestream pages (Jan. 2024)) What to do: ask the funeral home directly for the real link; don't enter card details; report the post to the social site, to BBB Scam Tracker, and to the funeral home. Be careful, too, of anyone who suddenly contacts a grieving family to collect a "debt" or settle an "estate": verify with the company or the court using contact details you find yourself.
Fake investment and crypto ("pig butchering")
See the pig butchering section.
Fake jobs and "tasks"
How: a job that pays you for simple online tasks, then asks you to deposit your own money to "unlock" earnings. What to do: stop paying; report to ReportFraud.ftc.gov (Federal Trade Commission) and FBI Internet Crime Complaint Center (IC3).
Government and tech-support impersonation
See the "FBI is calling" section.
Sextortion and threats
See the "we have your IP address" section. Don't pay, don't reply, take screenshots, and report. If you're a young person or a parent, please talk to someone you trust; you're not in trouble for asking for help.
Marketplace scams
How: items advertised on social media that never arrive. What to do: contact your card company or payment app, and report to ReportFraud.ftc.gov (Federal Trade Commission).
Grandparent and family emergency scams
How: a call or text saying a grandchild or relative is in trouble and needs money now, and to keep it secret. What to do: hang up, then call your relative or another family member on a number you already know.
Verified figures from the FBI's 2024 Internet Crime Report (FBI IC3 2024 Internet Crime Report (PDF)): reported losses of $16.6 billion in 2024; people over 60 filed 147,127 complaints with $4.8 billion in losses; investment fraud losses of $6,570,639,864; confidence/romance losses of $672,009,052; and 10,956 complaints with $246.7 million in losses involving cryptocurrency ATMs/kiosks.