A scam rarely ends at the money. You may have shared identity documents, given remote access to a device, reused a password, or approved a wallet permission you did not understand. Work through this in order.
1. The device first
If you installed anything they sent, or gave anyone remote access, treat that device as compromised. Uninstall the remote access tool — AnyDesk, TeamViewer, QuickSupport and similar — run a full scan with reputable security software, and do not use that device for banking until it is clean. If in doubt, have it professionally wiped. Changing passwords on a compromised device hands the new ones straight over, so do the next step from a different device.
2. Email, before anything else
Your email account is the key to every other account, because it receives the password resets. Change the password to something unique, turn on two-factor authentication, and then check three things people forget: forwarding rules, filters, and connected apps. A forwarding rule silently copying your mail elsewhere is a standard move, and it survives a password change.
3. Banking and finance
- New, unique passwords on every banking and investment account.
- Two-factor authentication everywhere it is offered — an authenticator app in preference to SMS, because SIM swap attacks defeat SMS.
- Check for new payees, standing orders and scheduled transfers you did not create.
- Ask your bank to note fraud on your accounts, and ask whether cards should be reissued.
- Read every statement line for the last few months. Small unfamiliar charges are often a test before something larger.
4. Crypto wallets
- If you shared a seed phrase or private key at any point, that wallet is gone. Create a brand new wallet on a clean device and move any remaining assets immediately. Do not "change the password" — the seed is the wallet.
- Revoke token approvals. If you connected your wallet to a site, it may hold standing permission to move your tokens indefinitely, with no further action from you. Use a reputable approval-revocation tool to review and revoke everything you do not recognise. This is the step most people miss, and it is how wallets get drained weeks later.
- Move remaining balances to a hardware wallet if the amounts warrant it.
5. Your phone number
Call your mobile provider and add a port-out PIN or transfer lock to the account. A SIM swap gives an attacker your SMS codes, and it is a common follow-up when they know you hold crypto.
6. Identity documents
If you sent copies of a passport or identity card, assume they will be used to open accounts in your name. Place a fraud alert or credit freeze with the credit bureaus in your country, check your credit file, and consider a protective registration with your national fraud prevention service. Keep checking for six months or more; identity misuse often lags well behind the original theft.
7. Expect to be targeted again
Your details are now on a list. The next approach will be tailored, it will know real facts about your loss, and it will offer to fix it. Read recovery scams before it arrives, not after.