Start with these steps
- End the unexpected contact. Stop replying, do not share another code or document, and do not follow a link the person sends to “fix” the situation.
- Write down what was shared. In a private place, note whether it was a password, verification code, card number, bank information, Social Security number, health information, ID image, or device access.
- Contact the affected organization independently. Use its official app, statement, card, or website. Explain what was exposed and follow its current security instructions.
- Change exposed or reused passwords. Start with email and financial accounts. Use unique passwords and enable stronger sign-in protection when the official service offers it.
- Use the federal identity-theft plan when appropriate. IdentityTheft.gov provides a personalized recovery plan based on the type of identity information involved.
Match the response to what was shared
Password or verification code
Change the affected password through the real service, review active sessions and recent activity, and update any other account that reused the password. Never approve a sign-in you did not start.
Card or bank information
Contact the financial institution through the official app or the number on the card or statement. Ask what account-protection steps are available and how to monitor activity.
Social Security number, government ID, or identity documents
Use IdentityTheft.gov for current federal guidance and a recovery plan. Do not upload identity documents to Scrammer.
Remote access to a phone or computer
Use a different trusted device to change important passwords. Follow the device or security provider’s official instructions and read Scrammer’s tech-support and device-access guide.
Keep useful records without spreading private information
Save dates, names used, account alerts, and screenshots in a secure place. Redact full account numbers, identity numbers, addresses, and verification codes before sharing information with anyone who does not need them. Public posts can unintentionally create more exposure.
If money was also sent, follow the after-sending-money guide and contact the payment provider promptly through a trusted route.
Official sources
- FTC: What To Do if You Were ScammedResponse steps for passwords, identity information, and account access. Last reviewed September 19, 2026.
- IdentityTheft.govOfficial federal site for reporting identity theft and creating a recovery plan.
- FTC ReportFraudOfficial consumer fraud reporting portal. A report does not guarantee an individual investigation.