When something goes wrong: hacked accounts, lost phones and money sent

A written plan for the day something goes wrong: money sent, a password or number given out, a hacked account, a lost phone, and where to report.

1. The first hour, whatever happened Understand

This chapter is a plan for five situations: money sent, information given out, a computer or phone let in, an account taken over, and a phone lost or stolen. Each has its own section. Read the one that fits and do its first step. Scams can happen to anyone. The person at fault is the scammer, not the person who was lied to. The FTC's advice for families says so in those terms (FTC, If someone you care about paid a scammer), and Social Security's scam page says that criminal behavior is not your fault (Social Security, Protect Yourself from Social Security Scams).

Stop contact and pay nothing more

The FBI's September 2026 warning about people who impersonate police and government officials gives the first step for anyone who was targeted: stop all contact with the scammers and tell your bank (FBI, Scammers Impersonating Law Enforcement and Government Officials). The same warning says scammers keep people on the phone for the whole scam and tell them not to talk to family, the bank or the police. Ending the call breaks that hold.

1. Hang up the call, close the chat or the pop-up window, and stop replying to texts or email from them.
2. Do not call back a number they gave you, and do not open a link they sent. To reach a company or agency, use a number you already have: the back of your card, a statement, or a site you typed in yourself (Recognizing scams).
3. Do not send any more money, even if they say a second payment will release the first or "protect" what is left.
4. Keep everything they sent you. Do not delete texts, email, call history or receipts. The FBI asks people to keep financial records and communications for the report.
5. Call someone you trust if you want help with the next calls. A second person can read the steps while you dial.

The order: money, then accounts, then reports

Do the steps in this order: money, then passwords and devices, then reports. Our convention The reason for putting money first is timing. The FBI's Internet Crime Complaint Center (IC3) runs a Recovery Asset Team that asks banks to freeze money that has just been moved. In 2025 the team worked 3,900 incidents and froze about $679 million of $1.164 billion, a success rate the report gives as 58 percent. Its advice for anyone who finds a fraudulent transfer is that "time is of the essence": contact your bank right away and ask for a recall of the funds, then file at ic3.gov whatever the amount (FBI IC3, 2025 Annual Report, PDF). Those figures describe cases reported to IC3 in time. They do not say what share of any one person's money comes back.

Passwords come second because a thief who still has your email can reset your other passwords while you are making calls (FTC, How To Recover Your Hacked Email or Social Media Account). Reports come last because they do not stop a payment by themselves. They help investigators, and an IC3 report can help the Recovery Asset Team when it is filed quickly.

Write it down as you go

An incident log is a dated list of what happened, what you did and who you spoke to. Banks, agencies and help lines each ask for the same details, and a log means you tell the story once and read it back after that. This manual's log is the incident log sheet; its columns are the date, what happened, what you did, who you called, the reference number and a follow-up date.

The FBI's IC3 asks complaints to include the scammer's phone numbers, email addresses and other contact details; the date, type and amount of each payment; the name of the bank that received it; any cryptocurrency addresses; and how the contact started and what you were told to do (FBI, Scammers Impersonating the IC3). Write those details on the log. Write the last four digits of an account, not the whole number, and write where a password is kept, never the password itself. Our convention

Every time you call, write the name the person gives, the time and any reference or case number. A reference number is the number a bank, agency or company gives a report or claim so that it can be found again. Ask for one at the end of every call.

2. Money sent

If money left your account, the first call is to the bank or card company, at the number on the back of your card, on your statement or in the bank's own app. The FTC's step list for people who were scammed starts here for every kind of bank and card payment (FTC, What To Do if You Were Scammed). Tell them what happened and ask them to stop or reverse the payment. For a bank transfer, ask them to request a recall, which is a request from your bank to the receiving bank to send the money back. IC3 names a recall as the step to ask for.

1. Find the number on the back of the card, on a statement, or in the bank's app that you open yourself. Do not use a number from a text, an email, a pop-up or the caller.
2. Call and say it was a scam. Say "I was scammed" and the date, amount and way you paid.
3. Ask them to stop, reverse or recall the payment.
4. Ask what else they need from you, such as a written claim form, and by when.
5. Write the reference number and the name of the person on the incident log.

Two kinds of loss, and why the difference matters

Banks treat a payment someone else made differently from a payment you made yourself. The difference decides which rules apply.

An unauthorized transfer is an electronic payment started by someone else without your permission. The federal rule for electronic transfers, called Regulation E, gives you rights when that happens. The Consumer Financial Protection Bureau (CFPB) says that when a scammer tricks you into sharing your login, a texted code or your debit card number and then uses it to move money, the transfer is unauthorized under Regulation E. Its examples include a caller posing as your bank who gets your code, and a remote session that watches you sign in (CFPB, Electronic Fund Transfers FAQs). Ask your bank

A payment you sent yourself, because someone lied to you, is treated differently. The FTC's alert about calls from fake bank fraud departments says bank accounts have fewer protections than credit cards, and that if you are tricked into moving money yourself you won't be protected and probably won't get the money back (FTC, Got a call about fraud activity on your bank account?, July 8, 2024). The CFPB says payment apps generally have no recall or retrieval feature (CFPB, Helpful tips for using mobile payment services, archived 2018 post).

Ask anyway. The FTC still tells people to report a Zelle, bank transfer or payment app payment right away and ask for a reversal. A quick call is also what gives a recall its chance. Do not decide for yourself which kind of loss you have: tell the bank exactly what happened, including any code or login you gave out, and let the bank say how it is treating the claim.

What to do by how you paid

Each way of paying has its own company to call and its own request. The table follows the FTC's step list, with the FBI's advice for cryptocurrency kiosks and cash couriers. Use the number on your own card, receipt or the company's own site.

The FBI's September 2026 warning puts it plainly: law enforcement and government officials "will never request payment via prepaid cards, cryptocurrency, or courier." The FTC's gift card page says the same of gift cards for any real business or agency. If anyone asks you to pay that way again, that request is the scam (Recognizing scams).

3. A password, a number or a computer given away

Three situations sit together here because they lead to the same risk: someone else can sign in as you. The steps work from a device you trust, which means a phone, tablet or computer the scammer has not touched. If the only device you have is the one a scammer connected to, read the remote access section first.

You gave out a password, a code or your Social Security number

A password. The FTC says to change it to a new, strong password, change it on any other account where you used it, and turn on two-step sign-in (FTC, What To Do if You Were Scammed). The UK's National Cyber Security Centre gives the same order, and adds why: criminals try a stolen password on other accounts because people reuse passwords (NCSC, Recovering a hacked account). Start with your main email, because whoever controls it can reset the rest.

1. Use a device you trust.
2. Change the password you gave out to a new one made the way Passwords shows: 15 or more characters, or four or more random words, used nowhere else.
3. Change every other account that used the same password. The password check in your password manager lists them (Passwords).
4. Turn on two-step sign-in for the email and any money account (Two-step sign-in and passkeys).
5. Write each change on the incident log, with the date.

A code. A sign-in code read to a caller lets that person sign in as you, or approve a payment, while you are still on the phone. The FTC says no caller, including a bank's fraud department, will ask for your verification code, and that a caller who asks is "always a scam." If the code came from your bank, call the bank now at the number on your card: a transfer made with a code you were tricked into sharing is unauthorized under Regulation E, as the money section explains. If the code came from your email, Apple, Google or Microsoft account, treat the account as taken over and go to the account section.

Your Social Security number. The FTC says that if someone has used it, go to IdentityTheft.gov for a recovery plan; if it has not been used, or you are not sure, use the site's page for lost or stolen information (FTC, What To Do if You Were Scammed). IdentityTheft.gov, run by the FTC, asks what happened, builds a recovery plan step by step and, with an optional account, keeps track of your progress and fills in letters and forms for you. Freezing your credit at the three bureaus, which is free, blocks new credit in your name (Money and identity).

A card or account number. Call the bank or card company at the number on the card and ask them to block it. The CFPB's deadlines for a lost or stolen card, PIN or code start when you find out, so call the same day (see the Go deeper timelines above).

You let someone into your computer or phone

Remote access means letting another person see and control your computer or phone over the internet, through an app they ask you to install or a code they ask you to read out. Tech support scammers ask for it and then run fake scans to show problems that are not there (FTC, How To Spot, Avoid, and Report Tech Support Scams). The FTC says real security pop-ups never ask you to call a phone number, and its malware page says the same: never call a number that appears in a pop-up window (FTC, Malware: How To Protect Against, Detect, and Remove It).

If someone has been in your device, do these in order:

1. Disconnect the device from the internet. Turn off Wi-Fi, or unplug the network cable. That ends a connection that is still open. Our convention
2. Stop signing in to accounts on that device until it has been scanned. The FTC's malware page gives this as the first step.
3. Scan it with its security software, and remove what the scan flags. The FTC tells people who gave a scammer access to update the security software and run a scan. The built-in protection on Windows and Mac is security software (Your computer and home Wi-Fi); the steps by device are below.
4. From a different device, change your passwords, starting with email and money accounts, and turn on two-step sign-in.
5. If you signed in to a bank while they were connected, or they asked you to, call the bank at the number on your card. The CFPB's examples of unauthorized transfers include remote access that watched you sign in.
6. Get help if you are unsure. The FTC suggests the device's maker, a tech company you trust or a friend who knows computers. Choose that help yourself; do not call anyone the scammer named.

Windows: a full scan with Windows Security. Windows Security comes with Windows 10 and Windows 11. Microsoft says a full scan checks every file and program on the computer, so it takes longer than a quick scan (Microsoft, Virus and threat protection in the Windows Security app).

1. Select Start.
2. Type Windows Security, then open the Windows Security app.
3. Select Virus & threat protection.
4. Under Current threats, select Scan options.
5. Select Full scan.
6. Start the scan, and leave the computer on until it finishes.
7. Remove anything the scan lists as a threat.

In short: Start > Windows Security > Virus & threat protection > Scan options > Full scan. Product-specific

The same Scan options list has a Microsoft Defender Antivirus (offline scan). Microsoft suggests it when you are concerned the computer was exposed to malware. It restarts the computer and scans before Windows loads, so save open files first. Its results are under Protection history in Windows Security.

Someone took over an account

The signs the FTC, Apple and AOL list overlap: you cannot sign in, you get notices of a password change or a sign-in you did not make, you get a two-step code you did not ask for, friends get messages or requests for money that you did not send, or settings have changed (FTC, How To Recover Your Hacked Email; Apple, If you think your Apple Account has been compromised; AOL, Recognize a hacked AOL Mail account). AOL adds two more: no incoming mail, and an inbox full of "MAILER-DAEMON" notices for messages you did not send.

Account recovery is the provider's own process for proving an account is yours when you cannot sign in. Use only the provider's own recovery page, and type its address yourself. Google says you cannot call Google for help to sign in, and that Google works with no service that claims to provide account or password support (Google, How to recover your Google Account or Gmail). Microsoft says its support agents are not allowed to send password reset links or change account details. A search ad or a phone number that offers to recover your account is a way to lose the account a second time.

AOL's help pages also mention a paid support phone line. Recovery through the Sign-in Helper is free, and we do not list paid lines.

Once you are back in

Getting back in is half the job. A thief can leave a way back: a forwarding rule, a new recovery phone, a device still signed in. A forwarding rule is an email setting that sends a copy of your incoming mail to another address; the NCSC says criminals set them up so that they receive your password reset messages. The FTC's and the NCSC's lists agree on what to check:

1. Set a new password used nowhere else, and change any other account that shared the old one.
2. Sign out of every other device.
3. Turn on two-step sign-in (Two-step sign-in and passkeys).
4. Check that the recovery phone and recovery email are yours (Getting back in).
5. Delete forwarding rules and filters you did not set up.
6. Look in the sent and deleted folders for messages you did not send or delete.
7. Tell your contacts not to click links or send money in reply to messages that came from the account.
8. Call your bank if card or bank details were saved in the account. Google gives this step for Google Accounts with payment details (Google, Secure a hacked or compromised Google Account).

The provider-by-provider steps follow. Use the one for your main email and the account your devices sign in with.

Google Account (Gmail, Android, Chromebook). From Google's page on a hacked account:

1. Go to myaccount.google.com and sign in.
2. Select Security & sign-in.
3. In the Recent security events panel, select Review security events.
4. For anything you did not do, select No, it wasn't me, and follow the steps on the screen.
5. Go back to your Google Account and select Your devices.
6. Select Manage devices.
7. For a device you do not recognize, select Don't recognize a device? and follow the steps.
8. In Gmail's settings, remove filters and forwarding you did not set up.

In short: Google Account > Security & sign-in > Recent security events, then Google Account > Your devices > Manage devices. Product-specific

Apple Account (iCloud Mail, iPhone, iPad, Mac). From Apple's page on a compromised account:

1. On a computer or another device, go to account.apple.com and sign in. If you cannot, start account recovery at iforgot.apple.com.
2. Change the password, if someone else has not already changed it.
3. Correct any personal or security information you do not recognize.
4. Select Devices, and remove any device you do not recognize.
5. Ask your phone company to check that text-message forwarding has not been set up on your number. Apple names this check.
6. On each Apple device, open Settings, tap your name, and check that the email address shown is yours.

In short: account.apple.com > Devices, then Settings > [your name] on each device. Product-specific

Microsoft account (Outlook.com, Hotmail, Windows). Once you have reset the password through the sign-in page, check the ways the account can be recovered:

1. Go to account.microsoft.com/security and sign in.
2. Select Manage how I sign in.
3. Check each phone number and email address listed, and remove any that are not yours.

In short: account.microsoft.com/security > Manage how I sign in. Microsoft says changes to security info can take 30 days when two-step verification is on. Product-specific

AOL Mail. AOL's own list for a hacked account is change the password, delete app passwords you do not recognize, put back changed mail settings, make sure security software is installed and updated, check the recovery options, and consider two-step verification. Step by step:

1. Go to login.aol.com/myaccount/security and sign in. This is AOL's Account Security page.
2. Select Change password, and set a new one used nowhere else.
3. Delete any app passwords you do not recognize. AOL's hacked-account article links the steps.
4. Open AOL Mail's settings and put back anything that was changed: filters, display name, signature, blocked addresses and the away message.
5. Back on the Account Security page, scroll to the bottom and check the recovery phone number and email. To replace one, add the new one first, then remove the old one.
6. Next to 2-Step Verification, click Turn on, choose Phone number, and follow the prompts.
7. On the computer you use for AOL, check that its security software is on and up to date. On Windows that is Windows Security.

In short: AOL Account Security page > Change password, then Mail settings, then Account Security page > 2-Step Verification > Turn on. Product-specific

If recovery fails, the NCSC says you may have to open a new account, tell your contacts the old one is abandoned, and change the address on your bank, utility and shopping accounts. Google also offers creating a new account when recovery does not work. Before you give up on a Google Account, try again in a few days from a familiar device: Google says changes to recovery information can take up to 7 days to count.

4. A lost or stolen phone

A lost phone holds your email, your codes and often your bank app. The first step is the same for every phone: mark it as lost from another device, so that it locks. Apple's stolen-phone page puts that first and says to do it as quickly as possible (Apple, If your iPhone or iPad was stolen). Google's and Samsung's pages offer the same lock.

Lost Mode is Apple's name for marking a device as lost: it locks the device with its passcode, and Apple says it suspends the Apple Pay cards on it (Apple, How to find your lost iPhone or iPad). Google calls the same action Mark as lost.

iPhone or iPad

Apple says icloud.com/find needs no verification code, so it works even when the lost phone is the device that gets your codes.

1. On another phone, tablet or computer, open a web browser.
2. Type icloud.com/find in the address bar.
3. Sign in with your Apple Account. You do not need a verification code.
4. Under All Devices, select the iPhone or iPad.
5. Choose Mark as Lost.
6. Follow the steps on the screen. If the phone was stolen, leave the phone number and message blank.

In short: icloud.com/find > All Devices > [the device] > Mark as Lost. Product-specific

Apple's advice after that:

• Leave your contact details off the lock screen if the phone was stolen. A thief can use them for a scam call to you.
• Mark it as lost even with Stolen Device Protection on, because that protection's extra safeguards last only for a time.
• Do not remove the device from Find My, even after an erase. Removing it takes off Activation Lock and makes the phone easier to resell.
• Do not try to get the phone back yourself if it shows at a place you do not recognize. Tell the police, who may ask for the serial number.
• Call your phone company to report it, and ask them to suspend the account.
• If Find My was not on before the loss, the phone will not show at icloud.com/find, and you cannot mark it lost or erase it. Change your Apple Account password right away.
• Erase the phone remotely only after trying everything else, because an erase cannot be undone.
• From another Apple device or account.apple.com, review your devices and Sign-In & Security, and remove any device you do not recognize.

Apple says, on both its lost and stolen pages, that it will never contact you to say your iPhone or iPad has been found. So a text or call that says Apple found your phone, and asks you to sign in, is not from Apple.

Android phone or tablet

Google's Find Hub (it was called Find My Device) is on automatically when a Google Account is on the phone. It needs the phone to be on, connected, signed in and visible on Google Play (Google, Find, secure, or erase a lost Android device). Pixel shown; other makers' menus differ.

1. On another device, open a web browser.
2. Type android.com/find in the address bar. On another Android phone you can use the Find Hub app instead, and on a friend's phone choose Sign in as guest.
3. Sign in with the Google Account that is on the lost phone.
4. Select the lost phone from the list.
5. Select Mark as lost, then Next.
6. Add a message for the lock screen if you want it returned. If it was stolen, leave your contact details off, as Apple and Samsung advise.
7. Select Mark as lost.

In short: android.com/find > [the device] > Mark as lost. Product-specific

Two more Google tools help. Remote Lock, part of Android's theft protection, locks the screen from android.com/lock with your phone number; Google says it needs an active SIM and Find Hub on, and works up to twice in 24 hours (Google, Protect your personal data against theft). A factory reset from Find Hub erases the phone permanently, after which Find Hub can no longer find it. For the phone company, Google says to give the phone's IMEI, the identity number of the phone itself, which the company can use to disable it; Find Hub shows it under the device's settings.

Samsung Galaxy. Samsung's own service is SmartThings Find or Samsung Find, at smartthingsfind.samsung.com or samsungfind.samsung.com. Sign in with your Samsung account, select the phone, and choose Lock or Erase data. Samsung also says not to go to the location of a stolen phone, and to tell the authorities. If you cannot erase it, Samsung says to change the passwords of the accounts signed in on it (Samsung, How to locate your lost Galaxy phone or tablet). Google's Find Hub works on Galaxy phones too.

Then call your phone company. Your phone number receives your codes, so it matters that no one moves it to another phone; the number lock in Two-step sign-in and passkeys guards against that. Write the call and any reference number on the incident log.

5. Reporting, help lines and the second scam

Report after the money and password steps. A report records what happened for investigators, and it is the step that lets the FBI's Recovery Asset Team try to freeze money when a transfer is reported quickly. The CFPB's short list of who to contact names the FBI, the FTC, your state attorney general and your local police, reached through their non-emergency number or website (CFPB, Who do I contact for help with a scam or fraud?).

When you file, have the incident log in front of you. Each site gives a reference or complaint number at the end; write it on the log. The FTC and IC3 do not settle single cases, so a report does not replace the call to your bank. Ask your bank

Free help lines

Two free lines help people work through the calls and reports.

• The National Elder Fraud Hotline, run by the U.S. Department of Justice's Office for Victims of Crime: 833-372-8311 (833-FRAUD-11), Monday to Friday, 10:00 a.m. to 6:00 p.m. eastern time, in English, Spanish and other languages. You are assigned a case manager, who stays your point of contact and helps with reporting at the federal, state and local levels (DOJ, National Elder Fraud Hotline). The hotline's page warns that scammers are posing as hotline staff and threatening lawsuits, and says not to give them personal information or money; report such a call to the FTC.
• The AARP Fraud Watch Network Helpline: 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. ET. Call to report a scam, to check whether something is a scam, or after you or someone you know was scammed. The helpline says it offers "guidance and support," not investigation or case recovery (AARP Fraud Watch Network Helpline).

Both numbers are already on this manual's numbers sheet, and the who to call table lists every line in this chapter with its hours.

The second scam: offers to get your money back

A recovery scam targets people who have already lost money, with an offer to get it back for a fee. The FTC says these scammers buy, sell and trade lists of past victims, and pose as a government agency, a consumer group, a law firm or the original company. They ask for an upfront "retainer," a "processing fee" or a "tax," or for your account numbers so they can "deposit a refund" (FTC, Refund and Recovery Scams). The FTC says real agencies and legitimate groups do not charge for refund help, do not ask for account numbers, and do not guarantee recovery. Its August 2026 alert says it more shortly: "Anyone who does is a scammer" (FTC, Watch for scammers who say they can help). IC3 counted 10,516 recovery scam complaints in 2025, with $1.4 billion in reported losses.

The fake can carry a real agency's name. Fake "FTC agents" text photos of employee IDs and badges; a real FTC employee will not contact you by text or WhatsApp or ask for payment to recover money (FTC, A real FTC employee won't text you their photo ID). Scammers also pose as IC3 staff, on social media and in AI-made videos of an FBI leader. The FBI says IC3 has no social media presence, will not contact you by phone, email, social media, apps or chat, and will not ask for payment to recover funds or refer you to a company that does (FBI, Scammers Impersonating the IC3).

The same pattern runs through account recovery: Google says you cannot call Google to get back into an account, and Microsoft's agents cannot send reset links. So the rule is short. Anyone who asks you to pay to get money or an account back is the scam. Our convention To check a name, the FTC suggests searching it with "complaint," "scam" or "review." To reach IC3 or the FTC, type ic3.gov or reportfraud.ftc.gov into the address bar yourself; the FBI says to skip "sponsored" search results, which are usually paid imitations.

1. Do not pay, and do not reply to the offer.
2. Do not give account numbers, a card number or remote access.
3. Write the offer on the incident log: who, how they reached you, what they asked for.
4. Report it at ReportFraud.ftc.gov and to your state attorney general, as the FTC suggests, and to the platform if it came by social media.

Helping someone who was scammed

The FTC's four steps for helping someone you care about are short. Lead with "kindness and concern instead of criticizing or expressing disappointment." Let them tell the story in their own words. Tell them the scammer is to blame; the FTC's own words are "The only person at fault here is the scammer." Then work out the next steps together: whether personal information was involved, and whether they want to report (FTC, If someone you care about paid a scammer). The FTC adds that scams can happen to anyone, and that scammers succeed when people are distracted or stressed.

Shame keeps people from reporting. The FDIC and CFPB's Money Smart guide names shame and embarrassment as reasons people do not report, and says not to let them stop you (FDIC, Money Smart resource page). The Justice Department says it set up the hotline above because many crimes go unreported when people are scared, embarrassed or do not know whom to call.

• Offer to sit with them while they call the bank, and read the steps from this page while they dial. Their accounts, their call. Our convention
• Do not take over their accounts or devices without their permission. Changing a password or a setting on someone else's account is their decision to make with you (Your security file).
• Use the help lines together. A DOJ case manager or the AARP helpline can walk through the reports with them.

Sometimes a person cannot protect themself, or the person taking the money is someone close to them. The CFPB lists signs of financial exploitation: money missing, sudden changes in spending, unexplained withdrawals or large wires, unpaid bills, new names on accounts, a "new best friend," changed beneficiaries, or someone controlling their calls or visitors (CFPB, How can I tell if a friend, neighbor, or family member is a victim of financial exploitation?). Adult Protective Services (APS) is the state agency that takes reports when an adult may be abused or exploited. Ask your state's APS The Eldercare Locator, a service of the federal Administration for Community Living, connects callers to local services at 1-800-677-1116, by call or text (Eldercare Locator). The National Adult Protective Services Association lists each state's APS phone number and online form (NAPSA, Help In Your Area).

6. See it See it

Free pages that show the steps in each agency's own words:

• FTC, What To Do if You Were Scammed: the step list by how you paid and what you gave out, updated June 2026.
• IdentityTheft.gov: the FTC's site that turns what happened into a recovery plan.
• CFPB, getting money back after an unauthorized transaction: the deadlines in plain words.
• NCSC, Recovering a hacked account: the UK agency's order of steps after a takeover.

7. Practice Practice

This practice prepares the plan before you need it. Do it on a calm day.

Minimum: the bank, card and phone company rows of the numbers sheet filled from your own card and statement, and the quick start read once. Time: about 20 minutes. Materials: your bank and credit cards, a recent statement or phone bill, the numbers sheet, and the quick start. The numbers sheet is essential on a first pass.

1. Open the numbers sheet. The rows for the FTC, IC3, the DOJ hotline, the AARP helpline and IdentityTheft.gov are already filled in. The bank, card and phone company rows are blank on purpose.
2. Copy your bank's number from the back of your bank card or from a statement, and choose "back of my card" or "my statement" in the column for where you got it.
3. Copy each card company's number from the back of the card.
4. Copy your phone company's number from your bill, or from the company's site typed in yourself.
5. Add a row for each phone or tablet with the page you would use to lock it if lost: icloud.com/find for Apple devices, android.com/find for Android.
6. Read the quick start once, from top to bottom. Find the "Something wrong right now" link in the menu, so you know where it is on every page.
7. Print the numbers sheet or the check card, and keep it with your important papers. A printed copy works when the phone is the thing that is lost.

8. Your setup Your setup

The box below reads your situation, devices, email provider and how you pay. It shows the recovery and lost-phone steps for what you saved.

9. Check your work Check your work

Criteria

• Does the numbers sheet have your bank, card and phone company numbers, each copied from your own card, statement or bill?
• Can you name, without looking it up, the first call if money leaves your account?
• Do you know your main email provider's own recovery page, and that no one charges to use it?
• Do you know the page that locks each of your phones and tablets if lost?
• If something has gone wrong: does the incident log show the call to the bank (if money moved), the passwords changed, and each report with its reference number?

Worked example

Common mistakes

• Reporting before calling the bank. A report does not stop a payment. Call the bank first, then report.
• Calling the number the scammer gave, or one from a search ad. Use the back of the card, a statement, or an address you type in yourself.
• Changing passwords on the computer the scammer used. Use another device until the scan is done.
• Stopping at the new password. Check the recovery phone and email, forwarding rules and signed-in devices too, or the thief can come back.
• Putting your contact details on a stolen phone's lock screen. Apple says a thief can use them for a scam.
• Paying a "recovery" service. Agencies and legitimate groups do not charge to get money back.
• Not writing down reference numbers. Ask for one at the end of every call, and write it on the log while you are still on the phone.

What is still unresolved

This chapter does not settle whether money comes back. The bank, the card company or the payment service decides a claim; the CFPB, your state attorney general or a lawyer answers what the law says about yours. It does not settle whether a computer is clean after a remote session; the scan tells you what the security software recognized, and the maker or a repair shop you choose can check further. It does not settle whether a report leads to an investigation; the FTC and IC3 say they do not resolve individual cases. Putting the plan into a printed file you keep with your papers is Your security file.

10. Knowledge check and scenario

Checklist

• The numbers sheet has my bank, card and phone company numbers, copied from my own card, statement or bill.
• I have read the quick start once and know where its link is on every page.
• I know the first call if money leaves my account: the bank or card company, at the number on my card.
• I know my main email provider's own recovery page, and that no one charges to recover an account.
• I know the page that marks each of my phones and tablets as lost (icloud.com/find or android.com/find).
• If something has gone wrong: the incident log shows the bank call, the passwords changed, and each report with its reference number.
• I read the unauthorized-transfer timelines and the crypto receipt advice. (Go deeper; optional)
• I ran the five-minute drill with the person who helps me. (Go deeper; optional)