Money has been taken: what to do, in order

If money has actually left your account, the order matters more than anything else on this website, because one of these steps has a clock on it and the rest do not. Ring your bank first. Not the account recovery, not the reporting, not reading the rest of this page. Banks can sometimes stop or recall a payment that has only just gone, and that window is measured in hours.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

Why the bank comes before everything

Because it is the only step where speed changes the outcome. Reporting to Scamwatch tomorrow is nearly as useful as reporting today. Ringing the bank tomorrow may be too late to recall a payment that could have been stopped this afternoon. Everything else on this page can wait an hour. That call cannot.

Tell them plainly that the payment was not authorised by you, or that you were deceived into making it, and ask them to attempt a recall and to secure the account. Ask for a reference number for the report.

Then write it down

Before messages get deleted and charges get tidied away, capture the record. It is tedious and it is worth it, because you will be asked for the same details by three or four different organisations.

• Dates, times and amounts of each payment.
• Any account names, usernames, phone numbers or email addresses involved.
• Screenshots of the messages, the profile, and the charges. Screenshots rather than notes, because the originals may vanish.
• How you were first contacted, and by what route.
• Any reference numbers you are given along the way.

Report it, in this order

If your identity documents were involved

If you sent a photograph of your driver licence or passport to somebody, or they were taken from an account, that is a separate problem from the money and it lasts longer. IDCARE is the right call for this, because they will tell you which documents can be replaced, which can be flagged, and what to watch for.

Australian driver licences can generally be reissued with a new number when they have been compromised, which is worth asking your state road authority about, and credit reporting bans can be placed so that accounts cannot easily be opened in your name. IDCARE will walk you through both.

Expect to be contacted again

This is the part people are least prepared for, so it is worth stating plainly. Having lost money once, you are likely to be contacted by somebody offering to recover it, perhaps claiming to be a recovery agency, a law firm, a government department or your bank's fraud team.

It is the same trade, and often the same people, working from a list of those who have already paid. No genuine organisation charges a fee to recover scammed money. Your bank does not, the police do not, ReportCyber does not, and Scamwatch does not. If somebody rings you about money you have lost, hang up and ring your bank on the number on your card.

Then finish securing the account

Once the money side is moving, go back and finish the account itself, because an account still in somebody else's hands keeps producing new victims among people who trust you.

• The recovery router, for the official page that matches your situation.
• Change the password anywhere else you used the same one, starting with your email account, which is the master key to everything else.
• Turn on two factor authentication on your email and on your social accounts.
• Check your bank statements for the next few months, not just the next few days.

One thing worth saying

People are often more embarrassed than angry, and that is the reaction the whole trade depends on, because embarrassment keeps people quiet. These operations are run by organised groups who do this professionally, full time, with scripts refined against thousands of people. Being taken in by one is not a character flaw. Telling somebody quickly is the single most useful thing you can do, and it is the thing shame prevents.

Related pages on this site

• The recovery router , to finish securing the account.
• The people offering to recover it for you .
• There is no Facebook phone number .
• Banking online safely .