What to do if you’ve been scammed: A Step-by-Step Guide to Recover

The “After-Action” Plan: Supporting Employees Post-Scam

As security awareness professionals, we spend most of our time on prevention. But the reality is that even with the best training, some attacks will succeed. When an employee—or their family member—falls victim to a scam, the “recovery” phase is a critical moment for our security culture. By providing clear, compassionate, and actionable guidance for what to do after a breach, we build trust and ensure that a single mistake doesn’t escalate into a total compromise of personal or corporate identity.

Guidance to Encourage in Your Security Training and Awareness Program

To help your workforce move from “victim” to “recovered,” prioritize these four pillars of post-scam response:

• Stop the Bleeding Immediately: The first instinct for many is to argue with or “fix” the scammer. Instruct your team to sever all contact immediately. Documenting the interaction via screenshots and transaction IDs is vital, but further engagement only opens the door to secondary “recovery scams.”

• The “Payment Method” Playbook: Recovery steps differ wildly based on how the money was sent.

  • Credit/Debit: Leverage the Fair Credit Billing Act by reporting fraud to the bank immediately for a chargeback.

  • Apps & Wires: Contact providers like Venmo, PayPal, or Western Union instantly; while harder to recover, some can freeze funds if notified within minutes.

  • Gift Cards: Call the issuer (Apple, Google, etc.)—they have specific departments for fraud mitigation.

• The Identity Lockdown: If sensitive data like a Social Security Number was shared, the standard advice must be a Credit Freeze via IdentityTheft.gov. Encourage employees to also change compromised passwords and, most importantly, enable Multi-Factor Authentication (MFA) on all remaining secure accounts.

• Device Decontamination: If an employee allowed remote access or downloaded a “fix,” they must disconnect from the internet immediately. Guide them through running a full antivirus scan and performing a factory reset if the compromise was deep, ensuring no “persistence” is left behind for future attacks.

• Formalize the Reporting: Reporting isn’t just about getting money back; it’s about data. Direct your team to ReportFraud.ftc.gov. This helps law enforcement track trends and prevents others from falling for the same script.

By normalizing the conversation around scam recovery, you reduce the shame that often keeps employees silent—allowing for faster reporting and a more resilient organization.

Read the full step-by-step recovery guide here: What to do if you’ve been scammed: A Step-by-Step Guide to Recover