If you're reading this today, start at step one and work down. The order is deliberate — money first, because it's the only step with a clock on it. Everything else can be done tomorrow if it has to be.
One thing before you start: whatever you're feeling about how this happened, put it aside for twenty-four hours. Anyone can be scammed. These scripts are tested on tens of thousands of people and refined for a living. Your parent lost money to a professional, not to their own foolishness — and the faster you make that clear, the faster you'll get the details you need.
· Call the bank — the number on the back of the card
Not the number from any email or text. The one printed on the card, or on a real statement. Ask specifically about recalling or reversing the transfer, freezing the account, and issuing new card numbers. Wire transfers and payment apps are the hardest to claw back and the most time-sensitive — if that's what happened, this call is the whole ballgame. Write down who you spoke to and when.
Say this: Say the words “I need to report fraud and stop a payment.” Those exact words route you to the team that can actually act.
· Freeze credit at all three bureaus
Equifax, Experian, and TransUnion, each separately — a freeze at one does nothing at the other two. If any personal details were shared (Social Security number, date of birth, address), assume they're now for sale and freeze regardless. Do this even if only money moved: the same call often harvested enough to open accounts later.
Worth knowing: Freezing is free, doesn't affect a credit score, and can be lifted in minutes when it's needed.
· Report it — ReportFraud.ftc.gov, then IC3
The FTC report generates a recovery plan at IdentityTheft.gov if identity data was involved. If it happened online or by phone, file with the FBI's IC3 too. Neither will likely recover the money. Both build the case that makes recovery possible and feed the data that gets these operations shut down — most elder fraud is never reported at all, which is exactly why it keeps working.
Worth knowing: Reporting takes about ten minutes and gives you a reference number banks and insurers will ask for.
· Change passwords, starting with email
Email, then banking, then anything that shares a password with either. If remote access was granted to a computer — this is standard in tech-support scams — treat that machine as compromised: disconnect it from the internet, and have it looked at before it's used for anything financial. Turn on two-factor authentication where it's offered.
Order matters: Email first, always. Whoever controls the inbox can reset everything else.
· Write down everything, while it's fresh
Memory for this degrades fast, and every institution you deal with over the next month will ask for the same details. One document saves your parent from re-telling the worst story of their year to six different people. Keep the original texts and emails — they're evidence, not clutter.
Capture: Dates, times, phone numbers, names used, amounts, exact words if you remember them. Screenshot every message before deleting anything.
· Have the conversation — but not tonight
The instinct is to fix it immediately with rules and restrictions. Resist that for a day. The single biggest predictor of a second scam isn't cognitive decline — it's silence, because someone who felt humiliated the first time will hide the second one. What you want out of this conversation is not a set of rules. It's an agreement that the next strange call gets mentioned.
Open with: “This happened to you. It didn't happen because of you.” Then stop talking and let them answer.
Then, in the following week
- Watch for the recovery scam. People who've been scammed are resold as leads. A caller offering to recover the lost money for a fee is the same operation coming back. Anyone who asks for payment to retrieve stolen funds is stealing again.
- Check statements going back six months. The first loss is often not the first contact. Look for small recurring charges as well as large ones.
- Ask the bank about a trusted contact. Most institutions let an account holder name someone the bank may call if activity looks wrong. It doesn't grant any account control — it just means someone else gets a phone call before the money is gone.
- Agree on the family word. A word only the family knows, required before any money moves, no matter how much the voice on the phone sounds like family. Voice cloning has made this the single most useful thing on this list.
Print this. Put it in the drawer with the passports. The best time to read it is before you need it.