What should I do immediately after realizing I've been scammed online?

Act within the first 24 hours for the best chance of recovery. First, contact your bank or payment processor immediately — many can reverse transactions or freeze payments if you act fast enough. Report to the FTC at ReportFraud.ftc.gov, which creates an official record and sometimes triggers investigations. Change passwords on any accounts that were involved or might have been compromised. If you sent cryptocurrency, contact the exchange immediately. Document everything: screenshots, emails, transaction IDs, and the timeline of contact.

Can you get your money back after an online scam?

It depends heavily on how you paid. Credit card payments offer the best recovery chance — dispute the charge as fraud and your card issuer is legally required to investigate. Bank wire transfers are very difficult to reverse, but report immediately since banks sometimes recover funds in the first 24-72 hours. Cryptocurrency payments are almost never recoverable since transactions are irreversible. Zelle, Venmo, and Cash App payments to strangers are usually not recoverable since you technically authorized the transaction. Gift card payments are essentially unrecoverable.

What are the most common signs of a phishing email?

The most reliable indicators: a sender email address that doesn't match the company's actual domain (support@amaz0n-security.com vs. support@amazon.com), urgency creating pressure to act immediately, requests for passwords, payment information, or personal data via email, links that don't match the stated destination (hover over links to preview them), unexpected attachments, and grammar or spelling that seems off. Legitimate companies never ask for your password via email and never threaten immediate account closure requiring immediate payment.

Are romance scams as common as reported?

Romance scams are severely under-reported, so official statistics undercount the actual prevalence. The FTC reported $1.14 billion in romance scam losses in 2023 alone, making it one of the top fraud categories by dollar amount. Victims are disproportionately older adults, widowed or recently divorced individuals, and people experiencing loneliness — which means the population is large and growing. The average romance scam loss is over $10,000, with many victims losing their entire savings. Shame prevents reporting, so the real number is likely two to three times the reported figure.

How do I verify if an online store is legitimate before purchasing?

Check these in order: look up the domain age on Whois.domaintools.com (scam sites are usually less than six months old), search the business name on the Better Business Bureau site and Google Reviews with the word 'scam' or 'review,' verify a physical address using Google Street View, check that the site uses HTTPS (padlock icon), look for a real phone number and call it, and be suspicious of prices significantly below market rate. Use a virtual credit card for first purchases from unknown stores so you can dispute charges easily.

Online Scam Prevention: The 12 Scams That Stole $10 Billion in 2024

My mother called me in tears two years ago. She had spent three weeks communicating with someone she met on Facebook who claimed to be a retired military officer widowed in Germany. He was charming, attentive, and had asked her to invest in a "business opportunity" he was developing. She had transferred $8,400 before a friend raised concerns and she called me.

We caught it before she sent more. The "military officer" was operating from West Africa, using stolen photos of an actual American soldier, with scripts specifically designed to target recently widowed women in their 60s. The FBI estimates thousands of Americans lose money to the same operation every year.

Online scams stole an estimated $10.3 billion from Americans in 2023, according to the FBI's Internet Crime Complaint Center (IC3) — a figure that represents only reported losses. The real total is likely two to three times higher. The reason scams succeed isn't that victims are foolish. Scams succeed because they are sophisticated, psychologically calibrated, and designed by professionals who do this full time.

This guide covers the 12 most costly scam types, how to identify each instantly, and exactly what to do if you've been targeted.

The Scam Landscape: What the Data Actually Shows

The FBI's 2023 Internet Crime Report documented 880,418 complaints with losses exceeding $12.5 billion. The FTC's own data for the same period shows 2.6 million fraud reports with $10 billion in losses. The discrepancy reflects different reporting mechanisms — the real number is somewhere between and above both.

The fastest-growing fraud categories are investment fraud (particularly cryptocurrency scams), impersonation fraud, and tech support scams targeting older adults. Romance scams, while not the largest category by volume, generate the largest average individual losses.

For general online safety context, see our online safety resource library and our cybersecurity fundamentals guide.

The 12 Most Costly Online Scams in 2024

Scam Type	How It Works	Red Flags	What To Do
Investment / Crypto Fraud	Fake investment platforms promise guaranteed returns; you deposit crypto that disappears	Guaranteed returns, pressure to recruit friends, inability to withdraw funds	Never invest in platforms you found online without independent verification; check SEC EDGAR
Romance Scam	Long-term fake relationship built online, then requests for money	Can never meet in person; always has emergency; asks for money or gift cards	Reverse image search their photos; never send money to someone you haven't met
Phishing Email	Fake email from bank, IRS, or known company requests login or payment	Sender email doesn't match official domain; urgent threats; links to look-alike sites	Never click email links; go directly to official site; call official number to verify
Government Impersonation	Caller claims to be IRS, Social Security, or police demanding immediate payment	Demands gift cards or wire transfer; threatens arrest; requests secrecy	Government agencies never call demanding immediate payment; hang up and call official number
Tech Support Scam	Pop-up or call claims your computer is infected; asks for remote access or payment	Unexpected pop-up with phone number; caller asks for remote access or gift cards	Legitimate tech companies don't cold-call; close the browser; never give remote access
Online Shopping Fraud	Fake websites or marketplace sellers take payment without delivering goods	Too-good-to-be-true prices; new domain; limited payment options; no real address	Check domain age; use credit card; look for reviews; verify address on Street View
Job Offer Scam	Fake employer offers remote job, sends fraudulent check to "buy equipment," asks you to forward remainder	Unexpected job offer; check before starting work; asks you to forward money	Legitimate employers don't send advance checks; fake checks bounce after you've forwarded real money
Lottery / Prize Scam	Claims you've won a prize but must pay fees first to collect	Must pay to claim prize; prize you didn't enter; requests bank info for "direct deposit"	No legitimate lottery requires payment to claim winnings
Rental Scam	Fake rental listings collect deposits for properties they don't own or control	Landlord can't meet in person; deal requires wire transfer; price too low for area	Always verify property ownership; never pay before seeing unit; use local payment methods
Grandparent Scam	Caller impersonates grandchild in distress or their lawyer, requests emergency wire	Creates urgency; asks you not to tell family; requests unusual payment methods	Hang up; call grandchild directly on known number to verify
Social Media Account Takeover	Compromised account used to solicit money from friends	Message from friend asking for money or gift card; story seems off; can't verify by phone	Call or text the friend on their actual phone to verify before sending any money
AI Voice Cloning Scam	Cloned voice of family member calls in distress requesting emergency funds	Slight audio artifacts; extreme urgency; unusual payment request; can't verify story	Establish a family "code word" for emergencies that only real family members know

Deep Dive: Crypto and Investment Fraud

Cryptocurrency and investment fraud is now the costliest scam category in the United States. The FBI reported $3.94 billion in cryptocurrency investment fraud losses in 2023 — a 53% increase from 2022. The primary mechanism is a scam type called "pig butchering" (translated from the Chinese term "sha zhu pan").

In pig butchering, a scammer establishes a long-term relationship with a target — sometimes taking weeks or months to build trust through daily messaging — before introducing an "investment opportunity." The target is initially allowed to make small "withdrawals" to build confidence, then encouraged to invest larger amounts. When they try to withdraw substantial funds, they're told they owe taxes or fees first. The money is gone.

I've spoken with victims of pig butchering who lost $50,000 to $300,000. These were not unsophisticated people. They were professionals who were simply deceived by someone who invested significant time in building a relationship before making any financial ask.

The single most reliable indicator of investment fraud: guaranteed or unusually high returns with low risk. No legitimate investment offers guaranteed returns. Anyone promising them is lying.

Resources: Report investment fraud to the FTC at ReportFraud.ftc.gov and to the FBI's IC3 at ic3.gov.

Deep Dive: Phishing and Its Sophisticated Variants

Standard phishing — fake emails mimicking trusted brands — has evolved. The current threat landscape includes:

Spear phishing targets specific individuals using personalized information gathered from social media and data breaches. A spear phishing email might reference your name, your employer, a recent purchase, or other specific details to appear more credible.

Smishing (SMS phishing) sends fake text messages appearing to be from delivery services, banks, or government agencies. These are particularly effective because SMS messages feel more immediate and personal than emails.

Vishing (voice phishing) uses phone calls, increasingly with AI-cloned voices of known individuals or convincing synthetic voices mimicking company representatives.

Quishing uses QR codes in physical mail or print materials that lead to phishing sites. This vector bypasses email security filters entirely.

The defense against all phishing variants is the same: never use contact information or links provided in an unexpected communication. If you receive an urgent message from your bank, hang up or close the email, then call the number on the back of your card or go directly to the bank's website by typing the address.

Romance Scams: Why Smart People Get Fooled

My mother is an intelligent woman who reads widely and managed her own business for twenty years. She was still nearly defrauded of her savings by a romance scam. This is worth understanding: intelligence is not protection against these scams because they target emotional needs, not logical ones.

Romance scammers specifically look for individuals who are recently widowed, divorced, or experiencing loneliness. They work in teams, with scripts developed through extensive testing. The relationships are built slowly and deliberately, with the scammer investing significant time because the eventual payoff can be enormous.

Warning signs specific to romance scams:

The person cannot meet in person, always has a reason (military deployment, overseas job, family emergency). They escalate emotional intimacy very quickly. They introduce financial requests in the context of emergencies or opportunities that only require "temporary" help. They are always too busy or too far to video chat (and if they do video chat, the image may be blurry or the timing choppy — possibly because they're playing pre-recorded video).

Verification technique: Reverse image search every photo using Google Images or TinEye. Romance scammers use stolen photos of real people — often military personnel, doctors, or engineers — and reverse image search will often find those photos on legitimate profiles belonging to other people.

If you've been in a romance scam situation: The FBI's romance scam resources are helpful, and the organization StopRomanceScams.org provides peer support from other survivors, which many victims find valuable because of the shame barrier that prevents seeking help.

What to Do If You've Been Scammed

Acting quickly matters enormously. Here are the steps by payment type:

Credit card payment: File a dispute with your card issuer immediately. Under the Fair Credit Billing Act, card issuers must investigate disputes and you're generally not liable for fraudulent charges. This is the most recoverable payment method.

Bank wire transfer: Call your bank immediately — same day if possible. Banks can sometimes initiate a SWIFT recall within 24-72 hours. After 72 hours, recovery becomes nearly impossible. File a report with your bank's fraud department and request they contact the recipient bank.

Zelle, Venmo, Cash App: These platforms generally consider authorized transactions (where you sent the money, even if under deception) as non-refundable. File a dispute and explain the fraud, but recovery rates are low. Report to the FTC regardless.

Cryptocurrency: Almost never recoverable. Report to the FBI's IC3 and the FTC. If the platform has a U.S. presence, report to the appropriate financial regulator. Some exchanges freeze funds when law enforcement contacts them quickly, but this is rare.

Gift cards: Essentially unrecoverable. Report to the FTC and the specific gift card company — some have fraud departments that can sometimes freeze unused balances.

Reporting Resources Table

Agency	What To Report	Contact
FTC (Federal Trade Commission)	All consumer fraud	ReportFraud.ftc.gov
FBI Internet Crime Complaint Center	Cybercrime and internet fraud	IC3.gov
Your State Attorney General	State-level fraud	Find at naag.org
CFPB (Consumer Financial Protection Bureau)	Financial fraud and bank issues	ConsumerFinance.gov/complaint
Social Security Administration OIG	Social Security impersonation scams	OIG.SSA.gov
BBB Scam Tracker	Business and marketplace scams	BBB.org/ScamTracker
Platform reporting	Fraud on specific platforms	Use platform's built-in reporting

After reporting, consider placing a fraud alert or credit freeze with the major credit bureaus (Equifax, Experian, TransUnion) if any personal information was shared with the scammer. Our identity theft protection guide covers this in detail. You can also find our downloadable scam prevention checklist at /notes.