Scammed Online? What Victims Should Do First

Discovering that an online relationship, investment opportunity or trading platform may be fraudulent can cause shock, embarrassment, anger and uncertainty.

The exact type of scam may not be immediately clear. It could involve romance fraud, pig-butchering fraud, a fake investment platform or several overlapping forms of deception.

You do not need to identify the precise category before acting.

The immediate priorities are to prevent further loss, contact the relevant financial providers, preserve the evidence and secure any affected accounts or devices.

Act Before Trying to Categorise the Scam

Fraudsters may combine false identities, emotional manipulation and fabricated investments within the same scheme.

A person may initially appear to be a romantic partner, friend, financial adviser, recruiter or investment specialist. The contact may begin with personal conversation before introducing an investment, or the financial opportunity may be presented from the outset.

The first-response steps are broadly similar in either situation.

Do not send further money while trying to understand what happened.

The First Eight Steps

1. Stop further payments

Do not transfer more money for:

• Tax or withdrawal charges
• Account verification
• Security or insurance fees
• Wallet activation
• Emergency requests
• Legal or recovery costs

Fraudsters may claim that one final payment will release existing funds, complete a transaction or prevent earlier transfers from being lost.

Further payments rarely resolve a fraudulent restriction.

Cancel any scheduled transfers or standing instructions where possible.

2. Contact the bank, card provider or exchange

Tell the relevant institution that the payment may relate to fraud.

Provide:

• Payment dates and amounts
• Recipient names and account details
• Payment references
• Cryptocurrency transaction identifiers
• Receiving wallet addresses
• Platform or company names
• Relevant withdrawal or fee demands

Explain the suspected deception clearly. Do not describe the situation only as an investment that performed badly if the platform, identity or withdrawal process appears to have been fabricated.

Ask what fraud review, recall, chargeback or reimbursement options may apply.

Banks, card providers and cryptocurrency exchanges decide what action they can take under their procedures and legal obligations. Contacting them does not guarantee that a payment will be reversed or a recipient account restricted.

3. Preserve the evidence

Do not delete messages, profiles or platform information, even where the content is upsetting.

Preserve:

• Complete emails and messaging histories
• Profiles, usernames and telephone numbers
• Websites and platform records
• Bank, card and cryptocurrency transactions
• Contracts and promotional documents
• Withdrawal, release-fee and recovery demands

Keep original electronic records where possible rather than relying only on isolated screenshots.

Original emails may contain technical information that is lost when the message is copied or photographed.

4. Secure accounts and devices

Change passwords for affected:

• Email accounts
• Banking accounts
• Cryptocurrency exchanges
• Payment applications
• Social-media accounts
• Cloud-storage accounts

Use different, strong passwords and enable multi-factor authentication where available.

Check whether:

• Email-forwarding rules were added
• Recovery details were changed
• New devices accessed an account
• Remote-access software was installed
• Banking or exchange credentials were disclosed
• Identity documents were shared
• A cryptocurrency private key or recovery phrase was exposed

Contact the relevant provider immediately if account access may have been compromised.

Cyber-security support may be appropriate where remote access was granted or suspicious software was installed.

5. Record a clear chronology

Create a simple timeline showing:

• When and where contact began
• The names and identities used
• When money or investment was first discussed
• Each payment date and amount
• The recipient account or wallet
• What was promised before each payment
• When withdrawal problems began
• Further demands or threats
• Reports already made

A chronology can help banks, exchanges, solicitors, investigators and authorities understand the sequence without reviewing every message first.

6. Report the fraud

Report the matter through the appropriate national fraud-reporting service.

Where the scheme involves an investment firm, trading platform or financial promotion, it may also be appropriate to report it to the Financial Conduct Authority.

People in Scotland should follow Police Scotland’s reporting guidance.

The impersonated business, dating platform, social-media service or cryptocurrency exchange may also need to be notified through independently verified contact details.

Do not use contact information supplied by the suspected fraudster.

7. Obtain advice where proportionate

Legal or investigative advice may be appropriate where:

• The loss is substantial
• Several recipients or companies are involved
• Cryptocurrency was transferred
• The activity crosses jurisdictions
• A genuine business or professional was impersonated
• The available records are extensive or complex

The appropriate response depends on the evidence, payment route, jurisdiction and realistic prospects of obtaining further information.

8. Beware of recovery scams

Previous victims are often contacted by people claiming that they can recover the money.

The caller may impersonate a regulator, police officer, solicitor, court official, bank, cryptocurrency exchange or investigation company.

They may know details of the original fraud and claim that funds have already been located, frozen or approved for repayment.

Serious warning signs include:

• Guaranteed recovery
• Claims that money is already waiting
• Unexplained tax or release payments
• Impersonation of a regulator or authority
• Payment requests to a personal account
• Requests for passwords or wallet credentials
• Pressure to act immediately
• Refusal to provide a written scope of work

A legitimate professional adviser may charge an agreed fee. The existence of a fee alone does not prove fraud.

Verify every unexpected recovery provider independently before sharing information or making a payment.

Was It Romance Fraud, Pig-Butchering or Investment Fraud?

These categories can overlap, but the main distinction may help you find more specific guidance.

Romance fraud

Romance Fraud usually involves a fabricated emotional or romantic relationship.

The relationship itself is the principal method used to obtain money. Requests may involve travel, medical treatment, business problems or emergencies.

Pig-butchering fraud

Pig-Butchering Scams combine relationship building with a false investment opportunity.

After trust develops, the victim is introduced to a trading or cryptocurrency platform showing apparent profits. Withdrawals are later blocked and further payments demanded.

Investment fraud

Investment Fraud is presented primarily as a financial opportunity.

It may involve a fake trading platform, clone firm, fraudulent shares, cryptocurrency, property, commodities or another alternative investment.

Personal trust may still be developed, but the main representation concerns the supposed investment.

The label is less important than stopping further loss and preserving the available evidence.

Should You Confront the Suspected Fraudster?

Do not accuse the person impulsively.

Confrontation may cause them to delete accounts, remove websites, destroy communications, increase pressure or attempt blackmail.

Do not continue communicating purely to gather more information unless there is a clear case-specific reason and professional advice supports that approach.

Preserve the existing messages, avoid further payments and do not reveal that a bank, solicitor, investigator or authority has been contacted.

If identity documents were shared, inform affected financial providers, monitor for suspicious applications and follow the relevant issuing authority’s guidance.

Fraud and Financial Investigation Services

Conflict International provides Fraud and Financial Investigation Services to individuals, businesses, law firms and professional advisers dealing with online scams and disputed financial activity.

Depending on the available evidence, our work may include:

• Identity and alias research
• Company and connected-party enquiries
• Website and domain research
• Payment-recipient research
• Cryptocurrency transaction mapping
• Review of communications and documents
• Cross-border corporate research
• Evidence chronology preparation
• Clearly sourced reporting for legal and professional review

An account, company, wallet or telephone number may belong to an intermediary or money mule rather than the person directing the fraud.

Private investigators cannot compel banks or exchanges to disclose protected information. We do not guarantee that every participant will be identified or that money or cryptocurrency will be recovered.

Discuss a Suspected Online Scam

If you are concerned about a romance, pig-butchering or investment scam, contact Conflict International with the available communications and payment records.

We can assess what corporate, digital and financial enquiries may be proportionate.

Complete the enquiry form below to request an initial assessment.