Step 1: Identify what you shared
Use the checklist below and follow the matching action steps.
If you shared a password
- Change the password immediately.
- Change passwords anywhere you reused it.
- Enable multi-factor authentication (MFA) on the account.
- Review recent logins/devices and sign out of unknown sessions.
If you read a one-time passcode (OTP) or MFA code
- Assume the scammer attempted a login in real time.
- Change the password immediately.
- Reset MFA methods if possible (app-based is strongest).
- Check account recovery options (email/phone) for changes.
If you shared card or bank information
- Call your bank using the number on the back of your card.
- Freeze or replace affected cards/accounts.
- Monitor transactions daily and dispute fraudulent charges.
If you shared your SSN or identity details
- Monitor credit and consider a credit freeze with major bureaus.
- Watch for new accounts opened in your name.
- Update passwords for email accounts first (email is the “master key”).
Step 2: Report and document
- Write down the time, number displayed, and what was requested.
- Report the scam through your carrier/bank/company channels.
Prevent this from happening again
Practice Phone Scam Defense Use Scam Lookup
FAQ
Should I call the scammer back?
No. Use official numbers and verified channels. Calling back can expose you to more manipulation or impersonation.
What’s the first account I should secure?
Your email account. If a scammer controls your email, they can reset passwords for many other services.