Scammed in Crypto? What to Do in the First 24 Hours

Why the first 24 hours of a crypto scam matter

Crypto sent to a scammer's own wallet can't be pulled back. The CFTC's August 2026 advisory says a transfer to an address "cannot be reversed, no matter how large the value being sent." But most scams touch something that can be stopped on the way: a bank wire that hasn't settled, an exchange account the scammer cashes out through, a stablecoin the issuer can freeze. Those windows close in hours or days, not weeks.

The strongest evidence for speed comes from the FBI's own numbers. Its 2025 Internet Crime Report says the IC3 Recovery Asset Team, which works with banks to freeze fraudulent transfers, handled 3,900 incidents in 2025 and froze $679,013,183, a 58% success rate. Its advice is plain: "If you discover a fraudulent transfer, time is of the essence." Those are mostly bank transfers caught early. Crypto that's already gone wallet to wallet is far harder.

This page is the emergency version, hour by hour. For the full list of agencies and forms, see our guide to reporting a crypto scam.

Hour 0 to 1: stop the money moving

1. Stop paying and stop replying. No "release fee," "tax," "unlock deposit" or "last payment." The FBI warned in March 2023 that crypto fraud victims told to pay fees or taxes to withdraw "are unable to get their money back, even if they pay." Don't confront the scammer either. It only invites a new story, or threats.
2. Call your bank's fraud line if any money left by wire, transfer or card. This is the call most likely to get money back. Use the number on the back of your card or the bank's own website. Ask for a recall of the wire or transfer, and say the word "fraud." If you bought crypto with a card or bank transfer to send to the scammer, report that too.
3. Report the payment to the exchange or ATM operator you sent from. Use the help center inside the app or the phone number printed on the kiosk, never a number from a search ad. Tell them it was fraud, give them the receiving address, and ask them to flag it and reverse anything still pending.

If the scammer is still on the phone, hang up. Many government and tech support impostors stay on the line on purpose, coaching you through each payment. The CFTC lists exactly that, "staying on the phone with you during the transaction," as a red flag.

Who to call first, by how you paid

Find the way your money left, and start with that row.

For the bitcoin ATM rules state by state, see our bitcoin ATM scam refund guide. Deadlines can be short. Minnesota's refund law, for example, requires notice within 14 days.

Hours 1 to 4: lock down what's left

1. Change passwords on the real sites. If you typed a password into a fake login page, change it on the real exchange or email account, then turn on two-factor login with an authenticator app.
2. Revoke token approvals. If you connected a wallet to a scam site, revoke every approval you don't recognize, newest first. Our token approvals guide shows how.
3. Move to a new wallet if your recovery phrase leaked. If you typed your seed phrase anywhere or read it to anyone, that wallet is gone for good. Create a new wallet somewhere clean and move what's left. Our seed phrase compromised guide covers sweeper bots that grab anything you send in for gas.
4. Remove remote access. If a "support agent" had you install screen-sharing software, uninstall it, disconnect the device from the internet, and have it checked before you log in to anything.

Hours 4 to 12: build your evidence file

The FBI's crypto reporting guidance says the most important information is the transaction details: the crypto addresses, the amount and type of crypto, the date and time, and the transaction ID, also called the hash. Collect them once in a single document, then copy from it into every form.

• Every payment. Open your exchange or wallet history. For each one, copy the transaction ID, the address you sent to, the coin, the amount and the time. Keep bitcoin ATM receipts and note the kiosk's location.
• How it started. The first message, the profile, phone numbers, usernames and the app where you met. Screenshot profiles before they disappear.
• Every site and app. The FBI asks which websites and applications the scammer told you to use, and any two-factor codes they asked for.
• A short timeline. Five to ten lines: first contact, each payment, when you realized.

Don't delete the chats, even the embarrassing ones. And don't wait for a perfect file: the FBI says to report even if you have no transaction details at all.

Prefer to watch? The next danger after a scam: fake "recovery" offers, in under a minute.

Hours 12 to 24: make it official

1. File at ic3.gov. Type www.ic3.gov into the address bar yourself. The FBI's July 2026 warning describes spoofed IC3 sites aimed at people who were already scammed, and says sponsored search results "are usually paid imitators." Include every receiving address and transaction ID.
2. File with the FTC at ReportFraud.ftc.gov. It goes into a database used by law enforcement across the country.
3. Get a police report number. Banks, exchanges, ATM operators and tax preparers often ask for one. For a bitcoin ATM loss, some state refund laws require a report to police or a state agency.
4. Send your report numbers back to the bank and the exchange. An IC3 complaint number gives their fraud teams something to act on.
5. If it was an investment pitch, tell your state securities regulator. The SEC and CFTC take tips too. The reporting guide above has the links.

Helping a parent? The National Elder Fraud Hotline at 833-372-8311, open Monday to Friday, 10 a.m. to 6 p.m. Eastern, assigns a case manager to callers 60 and older. Our guide to protecting parents from crypto scams covers the conversation after.

What not to do in the first 24 hours

• Don't pay for a "forensics report." The FBI warned in August 2023 that recovery fraudsters charge upfront and then "produce an incomplete or inaccurate tracing report and request additional fees." It also says private recovery companies "cannot issue seizure orders." Tracing a wallet doesn't move a single coin back. Our guide to whether crypto scams can be traced explains why.
• Don't answer recovery ads or comments. The FBI says these ads show up in search results, social media and comment sections under scam news. See how crypto recovery scams work.
• Don't keep using a wallet whose phrase leaked. Anything you send into it can be taken.
• Don't borrow money to "unlock" the balance. The balance on a fake platform was never there. Our flash USDT guide shows how cheaply a fake balance is made.

What happens after the first day

Expect silence. The IC3 doesn't give case updates, and most reports are reviewed and passed to the agencies that can act. Money comes back only when it lands somewhere a court or a company can freeze it, and that takes law enforcement and time. Keep your file, because seizures get matched to victims through the reports that name the same addresses. If the loss came from a fake investment, it may count at tax time; see whether crypto scam losses are tax deductible.

Still not sure it was a scam? Our one-minute scam quiz helps, and the Scams hub has every guide in one place.

First 24 hours after a crypto scam: FAQ

What should I do first if I got scammed in crypto?

Stop paying and stop replying. Then call your bank's fraud line if any money left by wire, transfer or card, and report the payment to the exchange or bitcoin ATM operator you used. Those are the only calls that can still stop money in motion.

Can a crypto transaction be frozen or reversed?

A confirmed transfer to someone else's wallet can't be reversed. But an exchange can hold funds still on its platform, and a stablecoin issuer can freeze tokens, usually at law enforcement's request. Bank wires that bought the crypto can sometimes be recalled if you call fast.

How fast do I need to report a crypto scam?

The same day if you can. The FBI's Recovery Asset Team froze $679 million in 2025, mostly bank transfers reported quickly, and some state bitcoin ATM refund laws set deadlines as short as 14 days. Filing late still helps investigators.

Should I pay a crypto recovery or forensics company?

No. The FBI warns that recovery fraudsters charge upfront fees and hand over inaccurate tracing reports, and that private companies can't issue seizure orders. Real agencies never charge you to work your case.

What information do I need for the report?

For every payment: the transaction ID, the address you sent to, the coin, the amount and the date and time. Add how the scammer contacted you, the sites and apps they used, and screenshots. If you're missing details, file anyway.

Will the FBI contact me after I file?

Only if investigators need more information, and then it's an FBI field office or other law enforcement, not IC3 itself. Anyone claiming to be from IC3 who calls, emails or messages you is an impostor.