Recovering money from cyber scams
If you have lost money as part of an online scam or wider cybercrime then this guide can help. You may have been tricked into sending money to a criminal’s account, a criminal may have logged into your online banking and tricked you into enabling payments, you may have been tricked into putting money into a scam investment or been sending money to a romance scammer (catfish). Regardless of how the money was stolen, follow the steps below.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
Recovering money from cyber scams - Do this first!
Report it to law enforcement - It is important that you report the issue to law enforcement ASAP. You will need a report number to help you work with your bank and other organizations. If you are in the USA you should report all cases of consumer fraud to IC3 and the FTC - whilst the FTC can’t act on individual reports, your report can help others. If the fraud also includes identity theft then you should report this here. For all other types of fraud, find the best place to report in the Department of Justice’s directory here. Reporting will also help get the scam shut down and may help you progress getting your money back.
Contact your bank - You also need to contact the financial organizations involved in making the payments immediately. This tool from Cybera allows you to make a global report with the aim of freezing the money ASAP. If it was your bank account then contact your bank and explain what has happened. If you know which bank the money was sent to you should also contact them. If this is done quick enough they may be able to freeze the money if it is still in transit and both should kick off a fraud investigation.
Beware recovery scams - after stealing money it is common for criminals to contact their victims pretending to be their bank, the police or money recovery experts. The aim is to steal more money by asking you to move money into a “safe” account or trick you into sharing information that will enable a further crime. Do not trust any communications by phone, email or text. Instead call the organization directly and check that it was really them that tried to get in touch.
Approaches to dealing with cybercrime related financial loss
How you can try and get your money back very much depends on how the money was stolen. Here we are going to focus on four different approaches: 1) Authorized payments (where you were tricked into making a payment), 2) Unauthorized payments (where the criminal actually carried out the payment using your accounts), 3) ID fraud (where you have been impersonated with a financial organization) and 4) card fraud (where they money was transferred by a credit or debit card payment).
1) When you have been tricked into making a payment (authorized push payment)
Authorized Push Payment (APP) fraud is often done through social engineering, it may be someone online that has coerced you into sending them money to help with medical bills or asked you to send them money so that they can release funds to you, or you may have received a false invoice.
In the US, there is currently no consumer protection for unauthorized push payments although work is being done in this space. Whilst victims of APP fraud in the US are less likely to get their money back, you should still take the steps listed above as your bank may have its own process to follow in these cases.
2) When a criminal has carried out the payment using your accounts (unauthorized payment)
In this scenario the criminal managed to get access to your online bank account and actually made the transaction - so you did not authorize the payment. This is common when individuals are tricked into providing remote access to their computers and then the criminal is able to take control and access the online bank account.
If you have had a transaction on your banking which you did not initiate you are covered by the Electronic Funds Transfer Act. You should:
Report it to law enforcement - follow the instructions above to report the unauthorized payment
Contact your bank - You should contact your bank as soon as you notice the transaction and within 60 days of receiving the monthly statement where the transaction is present. The financial institution, whether it’s your bank, a prepaid company or P2P provider, are required to conduct a reasonable investigation within 10 business days and report their findings to you within three days of completing the investigation. If they are unable to complete the investigation within this timescale then they should provisionally credit your account whilst they carry out the investigation, taking up to 45 working days. To not refund you, or to reverse the refund, the financial institution has to prove that the payment was authorized and if they say that they have proved this, you have the right to request an explanation for this.
3) When you have been impersonated with a financial organization (identity fraud / theft)
In this scenario a criminal has used your personal data to impersonate you with a financial organization. They may have taken out a loan, credit card or mobile phone contract in your name. For help with this area visit our Identity Theft Guide.
4) When you have made the payment using a debit or credit card (card fraud)
Card fraud happens when someone has used your card to purchase goods or services without your consent. You may have also purchased goods and services yourself that are faulty, not as described or haven’t been received at all. Both of these scenarios will be explored below.
Someone has made a payment using your credit or debit card
If someone has made a purchase using your card without your consent, they may have stolen your card, called your provider and ordered a new card pretending to be you, cloned your card or used your card information to purchase something online.
Under the Fair Credit Billing Act, if the transaction has taken place on a credit card you are protected against this type of fraud with a liability of $50, although some financial organizations will waive this liability all together, especially if you have reported your card as stolen before any unauthorized transactions occur.
Report it to law enforcement - follow the instructions above to report the unauthorized payment
Contact your bank - You should contact your bank as soon as you notice the transaction and within 60 days of receiving the monthly statement where the transaction is present, they may request that you do this in writing to their billing enquiries address. The credit card provider has 90 days from the date they receive your report to act. The financial institution, whether it’s your bank, a prepaid company or P2P provider, are required to conduct a reasonable investigation within 10 business days and report their findings to you within three days of completing the investigation. If they are unable to complete the investigation within this timescale then they should provisionally credit your account whilst they carry out the investigation, taking up to 45 working days. To not refund you, or to reverse the refund, the financial institution has to prove that the payment was authorized and if they say that they have proved this, you have the right to request an explanation for this.
If the transaction has taken place on a debit card, you are protected under the Electronic Fund Transfer Act. You should still follow the steps above but your rights are different. The amount you are liable for, if your card is stolen, may increase with time so you should report this as soon as possible.
Some debit cards still have a $0 liability policy and across all providers this remains the same if you report the card as stolen before any unauthorized transactions. If you report a theft within 2 days or 60 days the amount rises to $50 and $500 respectively. After 60 days there is no cap on the liability.
If your card was not stolen and the theft took place another way, then the 60 days start from the day the first unauthorized transaction took place.
You have paid for goods or services that you didn’t receive or weren’t as described
If you have purchased something that hasn’t arrived, a service that wasn’t delivered or the goods or services weren’t as described or faulty then you have rights.
The seller should ship the order within the timeframe they have given, if they don’t provide a timeframe then they have 30 days.
If there is a delay, then they should inform you and give you a new shipping date (or a reason for why they can’t provide one). They should give you the chance to respond and request a refund, if you don’t respond and the delay is less than 30 days then they should still send the goods. If the delay is more than 30 days then on the 30th day they should send you a refund.
Contact the seller or service provider - contact the person or company you purchased from first and ask for an update on shipping or to explain the item was not as described. Let them know what outcome you want, it may be that you want a refund, or a new product sent out. If you used a website like eBay or Amazon to make your purchase and the seller isn’t responding, try to contact the website directly, they should have processes in place to support these issues smoothly.
Dispute the charge if the item didn’t arrive (if you paid with a credit card) - If the seller won’t reverse the charge, or they aren’t responding to you, then you can file a dispute. If the item didn’t arrive then the charge is classed as a billing error, if you are still within 60 days of receiving the statement with the billing error then you should write to your issuers billing inquiries address. There are sample templates available to help you. The issuer must resolve the issue within two billing cycles of receiving the letter. If you are outside of the 60 days, you may not have protection but should still try to dispute the charge as some providers may still be willing to help.
Dispute the charge if the item didn’t arrive (if you paid with a debit card) - When using a debit card to pay, you don’t have the same protections as you do with credit cards. However, some providers may offer protection, contact their customer service line and send a letter to see if they will help.
Collect documents - if you received an item or service that was faulty or not as described, look at any documents you received with your purchase or that were emailed to you, you may be covered by a warranty or contract.
File a report - If you believe the missing or faulty item or service was fraudulent then you can file a report with the Federal Trade Commission. You can also file a complaint about a company’s products and services here.
Get support - there are organizations dedicated to helping consumers. For example, your local Consumer Protection Office may be able to support you and conduct investigations, Consumer Action exists to help you resolve complaints, as well as the Better Business Bureau.
Donate
To help people like you we rely 100% on donations from people like you.
Without donations we cannot keep our service free and provide help to the most vulnerable victims of cyber crime when they need it most. As a not-for-profit organization, 100% of your donation goes towards keeping The Cyber Helpline up and running - so 100% goes towards helping people like you. Donate now and help us support victims of cyber crime.