The First Things I Do the Moment I Suspect a Scam

A friend of mine transferred money to what she thought was her landlord's account last year, and the first thing she did was panic and stare at her phone for twenty minutes before telling anyone. By the time she called her bank, the money had already moved on. I think about that timeline a lot, because most advice about scams focuses entirely on spotting them before they happen. Nobody talks much about what to actually do in the first ten minutes after you realise something's wrong, and that gap in advice is exactly where people lose the most time they can't get back.

Why the First Ten Minutes Matter More Than the Rest

Fraud response works on a clock that most people don't know is running. Banks can sometimes recall a transfer if it's caught early enough, before the receiving account has been emptied out, but that window closes fast, often within hours rather than days. The natural instinct is to sit with the shock for a while, replaying the message or call and trying to work out exactly how you got caught out. That instinct is understandable, but it's also the most expensive thing you can do. I've trained myself to treat the moment of realisation as the start of a checklist, not the start of a post-mortem. The reflecting can happen later, once the practical steps are actually moving. What follows is the order I actually work through, not because it's the only order that works, but because having a fixed sequence means I don't waste time deciding what to do next while I'm still rattled.

Calling My Bank Before I Do Anything Else

If money has moved or a card's been used, my bank comes before anything else, including before I've fully worked out what happened. Every UK bank has a dedicated fraud line that's faster than the general customer service number, and I keep that number saved in my phone rather than searching for it under pressure. Calling early does two things: it can sometimes stop or reverse a transfer that hasn't fully settled yet, and it flags the account for closer monitoring immediately, which matters if the scammer got more than just the one payment. I'd rather make this call and find out it wasn't necessary than lose the twenty minutes my friend lost weighing it up. Most fraud teams will also ask you to freeze the card there and then, which takes seconds through the banking app and stops any further use while the rest of the conversation is still happening.

Changing Passwords Starting With Email, Not the Compromised Account

Once the money side is moving, I go straight to passwords, and I always start with email rather than whatever account the scam actually targeted. Email is the reset point for almost everything else I own, so if a scammer has any foothold there, changing my banking password alone won't keep them out for long. I use NordPass to generate a new, unique password on the spot rather than a variation of the old one, since scammers who've seen one password often try close variations first. Only once email is secured do I move on to the account that was actually compromised.

Checking What Else That Password Was Protecting

This is the step I used to skip, and it's the one that's bitten people I know the hardest. If a password was reused anywhere, and most people reuse at least a few, that same combination is now a key to every other account it unlocks, not just the one that got scammed. I go through my password manager's list and change anything sharing that password, even accounts that feel low-stakes, because a scammer with patience will work through them one by one looking for something valuable. It's tedious, but it takes twenty minutes once and closes a door that would otherwise stay open indefinitely.

Freezing My Credit Before I Even Know If I Need To

I don't wait to find out whether personal details were actually taken before I consider a credit freeze, because by the time I know for certain, it's often too late to matter. A credit freeze stops new accounts being opened in your name without unlocking it first, and in the UK you can apply one through each of the three main credit reference agencies without it costing anything. It sounds like an overreaction for a scam that might have only cost a password, but identity-based fraud frequently shows up weeks or months after the original incident, once the initial panic has faded and nobody's watching as closely. Lifting the freeze later, when I actually need a new credit account myself, takes a couple of minutes online, so the ongoing inconvenience is nowhere near as large as it sounds up front.

Reporting It Somewhere, Even If I Feel Embarrassed

The embarrassment is real, and I think it's the single biggest reason people delay reporting or skip it entirely. I report anyway, because the report does something beyond satisfying a box-ticking instinct: it feeds into the pattern that lets Action Fraud and banks flag repeat scammers faster for the next person. I've written before about what actually happens once you report an incident like that, and it's more useful than most people expect. Reporting isn't an admission that you were careless, it's the action that turns a bad afternoon into data that protects someone else's afternoon too. Between this checklist and the periodic check-in I run on my own accounts every few months, I've found the two together do more than any amount of after-the-fact regret ever could, and my free Safety Toolkit has a version of both you can start from today.