Scams and fraud: the first steps people take

How the law usually works

Scams can involve stolen account details, impersonation, fake investments, online shopping, subscription traps, romance scams, or pressure to send money. The legal response often depends on an important distinction:

• Unauthorized transaction: Someone used your card, bank account, or payment service without your permission.
• Authorized payment caused by deception: You personally approved the payment, but did so because a scammer misled you.
• Poor-quality or missing goods or services: You paid a real business, but the product was defective, never arrived, or was not as described.
• Unwanted recurring payment: A business continues charging you after a trial, cancellation, or disputed enrollment.

Banks and payment providers often give stronger protections for unauthorized transactions than for payments you approved yourself. Even so, they may investigate whether you were deceived, whether you acted reasonably, and how quickly you reported the incident.

Consumer law may also provide rights against a genuine seller. Depending on the country, these can include cancellation rights for certain online purchases, refunds for defective goods, remedies for services that were not provided with reasonable care, and protection against unfair or misleading practices. These rights do not always make a scammer able to pay, so reporting and payment-provider action can still be important.

Common processes

1. Stop communicating and avoid sending more money. Scammers commonly create urgency, threaten consequences, or promise that another payment will unlock a refund. People often stop replying, avoid clicking further links, and do not pay “recovery agents” who demand an upfront fee.

1. Contact the bank, card issuer, or payment service through an official channel. People commonly use the number on the back of a card, the provider’s official app, or a statement—not a number supplied by the suspected scammer. They explain whether the transaction was unauthorized, made under deception, duplicated, part of a recurring charge, or connected with goods or services that were not supplied. They may ask for a payment recall, card replacement, account restrictions, or a formal dispute.

1. Secure accounts and devices. If a password, one-time code, card number, or identity document was exposed, people commonly change passwords from a safe device, especially for email and banking. They may turn on multifactor authentication, sign out other sessions, remove unfamiliar devices, and contact the mobile provider if a phone number may have been taken over. If a scammer installed remote-access software, people commonly disconnect the device from the internet and obtain trusted technical help before using banking services again.

1. Preserve evidence. Useful material can include screenshots, emails, text messages, caller numbers, web addresses, receipts, transaction records, delivery information, usernames, and the scammer’s payment instructions. People often write down a timeline while events are fresh. They generally avoid editing or deleting messages, although they may block the scammer after preserving the evidence.

1. Report the incident. Reports may go to a national fraud-reporting service, police, a financial regulator, a platform, or the relevant communications provider. Reporting may not produce a refund, but it can help identify patterns and protect others. A report number can also help when dealing with a bank or card issuer.

1. Check for continuing exposure. People commonly review recent statements, credit reports, email forwarding rules, shopping accounts, and subscription settings. They may contact a credit-reporting agency about a fraud alert or credit freeze where that option exists.

1. Follow up in writing. After a phone call, people often send a secure message or email summarizing the date, transaction, amount, and requested action. They keep case numbers and ask what documents or dispute forms are needed. A rejected claim may have an internal review or complaint process.

Deadlines and time limits

Deadlines vary considerably. People commonly act during the first day because payment recalls and account freezes become harder after funds move through several accounts.

Typical examples include:

• In the United States, federal rules commonly require a consumer to report certain unauthorized electronic fund transfers within 60 days after the statement showing the transaction was sent. Faster reporting can limit potential loss, and card-network rules may use different time periods.
• For US credit-card billing disputes, written notice is commonly expected within 60 days of the statement containing the error.
• In England and Wales, card-scheme chargeback requests commonly have provider time limits often described as around 120 days, but the exact period depends on the transaction and scheme. Section 75 claims for qualifying credit-card purchases do not use the same simple deadline and should be checked promptly.
• In Canada, account agreements and card-network rules commonly require prompt notice and may impose specific reporting periods. Federal consumer guidance often emphasizes notifying the institution without delay.
• In Australia, the ePayments Code commonly deals with mistaken or unauthorized electronic transactions and contains notice and investigation rules. The applicable period can depend on the payment type and circumstances.

These are typical guideposts, not a complete statement of your deadline. Confirm the applicable period with the financial provider, relevant court or tribunal, or a licensed lawyer where you live.

Documents that usually matter

Commonly useful documents include:

• Bank and card statements showing the transaction
• Receipts, invoices, order confirmations, and subscription terms
• The seller’s refund, cancellation, warranty, or delivery policy
• Screenshots of advertisements, profiles, websites, and checkout pages
• Emails, texts, call logs, and chat histories
• Shipping or tracking records
• A written timeline of what happened
• Proof of identity, if the provider requests it through a secure process
• Copies of reports made to police, regulators, platforms, or fraud services
• Records of password changes, account locks, and communications with the bank

You generally should not send passwords, full authentication codes, or unnecessary identity documents to an unverified contact.

How it differs by jurisdiction

United States: Federal protections differ between credit cards, debit cards, electronic transfers, gift cards, and payment apps. The Electronic Fund Transfer Act and Regulation E commonly address unauthorized electronic transfers, while the Fair Credit Billing Act commonly addresses certain credit-card billing errors. State laws may add protections for unfair practices, automatic renewals, data breaches, or gift cards. State filing deadlines and court procedures differ.

England and Wales: The Payment Services Regulations 2017 commonly govern unauthorized payment transactions and payment-service complaints. Consumers may also rely on the Consumer Rights Act 2015 for faulty goods, services, or digital content. Section 75 of the Consumer Credit Act 1974 can provide a route against a credit provider for certain qualifying purchases, including some misrepresentation or breach-of-contract claims. Chargeback is generally a card-scheme process rather than a universal statutory refund right.

Canada: Consumer protection is divided between federal and provincial or territorial law. The federal framework includes rules for federally regulated financial institutions, while provinces and territories commonly regulate consumer contracts, internet sales, payday lending, unfair practices, and some recurring billing issues. Card-network protections and account agreements are important, and remedies can differ substantially by province.

Australia: The Australian Consumer Law commonly provides guarantees for goods and services bought from businesses, including acceptable quality, matching description, and due care. The National Credit Code and payment rules may also matter. The ePayments Code addresses many electronic-payment disputes and is administered by the Australian Securities and Investments Commission. State and territory rules can affect contracts, tribunals, and enforcement.

When people consult a lawyer

Legal advice may be especially useful when the loss is substantial, the payment involved an investment or cryptocurrency, personal identity information was misused, a business denies a statutory consumer remedy, or a bank rejects a dispute after review. Advice can also help with a court or tribunal claim, a complaint against a financial institution, or a dispute involving a business outside your country.

If the scam involved threats, stalking, extortion, or an immediate risk of physical harm, contact emergency services first. If you are under pressure from someone who has access to your home, devices, or finances, consider contacting a trusted person or a local victim-support service from a safe device.