Field note · 8 min read

How to Get Your Money Back After a Scam

You already paid. The clock started. Here's what actually works in the first 24 hours, what works later, and what's already gone.

You clicked an ad. You paid. Then something stopped adding up. The tracking number never moved. The "clinical-grade device" arrived as a piece of molded plastic. Or the charge came back a second time, at a price you never agreed to, from a company name you don't recognize. Now you want the money back.

Whether you get it comes down to two things: how you paid, and how fast you move. Those are the only two levers. Credit cards give you a specific dispute right written into federal law. Debit cards get a different, thinner set of rules. Payment apps mostly run on their own policies, not statute. Crypto and gift cards have almost nothing. Nobody tells you which lane you're in, so most people spend the first two days emailing a seller who was never going to answer, and lose the days that mattered.

For scale: in 2025 the FTC took in 3 million fraud reports totaling $15.9 billion in reported losses. Nearly 30% of people who lost money said the scam started on social media, and those reports alone accounted for $2.1 billion — more than any other way scammers made contact. More of that money went to scams that started on Facebook than on any other platform. You are not an unusually gullible person. You are in a very large group with a paperwork problem. Below is the paperwork.

The first hour: capture, then call the money — not the seller

Do the capture before anything else, because scam storefronts and ad creatives disappear fast. Screenshot the ad, the product page, the checkout screen, the confirmation email, and every message you exchanged. Save the exact URL. Copy the merchant name as it appears on your statement — it is usually different from the store name, and that string is what your bank searches on. Note the amount, date, and transaction ID. Then write one short timeline in plain language: what you were promised, what you paid, what arrived or didn't. You will retell this four or five times — bank, payment app, FTC, maybe the card network — and telling it the same way every time is most of what makes a dispute stick.

Then call the company that moved the money, not the company that took it. The FTC's guidance is blunt on this: contact the company you used to send the money, tell them it was fraud, and ask whether they can stop or reverse it. For a card, that's the issuer's dispute line on the back. For a transfer, your bank. For an app, the app. Phone first, because speed matters, then repeat it in writing — the written version is what starts the legal clocks. Do not wait on the seller's reply to your third email. Waiting is how people miss deadlines they didn't know existed.

Credit card: the strongest hand you can hold

A credit card gives you the Fair Credit Billing Act, and the definition of a "billing error" is broader than most people assume. Under Regulation Z it covers not just charges you never authorized but property or services "not delivered as agreed" or not accepted. So "it never shipped" and "the ad sold me a leather bag and this is coated cardboard" are both billing errors, not just complaints. Send the dispute in writing to the issuer's billing-inquiries address — not the payment address — within 60 days of the statement the charge first appeared on. The issuer must acknowledge within 30 days and resolve within 90. And you are not required to fight it out with the merchant first: the CFPB's official commentary says so explicitly, so a rep who tells you to go work it out with the seller is wrong about the law. Separately, federal law caps your liability for unauthorized credit card charges at $50, and most issuers apply zero.

The card networks stack their own deadlines on top of the statute. Visa's cardholder dispute window is generally 120 days from the transaction date, and for merchandise that never showed up the clock runs from the last date you expected delivery, capped at 540 days from processing. Two practical notes. First, use the system's own vocabulary: "not as described" and "never delivered" are routing categories, while "I got scammed" is not. Second, if the charge repeated, dispute every instance and state plainly that you never agreed to a recurring plan — one refunded charge does not close an open subscription.

Debit card and bank transfer: same plastic, weaker rules

Debit runs on Regulation E, where your speed literally sets your liability. If your card or credentials were lost or stolen and you notify the bank within two business days of learning it, your exposure is capped at $50. Report after that and it can rise to $500. If an unauthorized transfer shows up on a statement and you sit on it for more than 60 calendar days, the losses after that point can be unlimited. Once you do report, the bank generally has 10 business days to investigate; if it needs longer, it has to give you provisional credit while it finishes, correct a confirmed error within one business day, and report its findings within three.

Here is the part nobody says out loud. Regulation E's core protection is for transfers you did not authorize. If you typed in your own card details and clicked buy, the bank treats that as authorized — even though you were lied to. At that point you are relying on a network chargeback, which is real but discretionary in a way the credit-card statute is not. Wires and bank-to-bank transfers are worse still, because they are designed to be final. Ask your bank to attempt a recall the same day, and call the wire company directly — the FTC lists MoneyGram at 1-800-666-3947 and Western Union at 1-800-325-6000. Then file with the FBI's IC3 immediately: its Recovery Asset Team asks receiving banks to freeze fraudulent transfers, and in the FBI's 2023 reporting that process got holds placed on roughly 71% of the money in the cases it took. It only works while the money is still sitting in the receiving account.

Payment apps: PayPal is the exception, not the rule

PayPal is the one consumer app with something resembling a real dispute system. Purchase Protection covers "Item Not Received" and "Significantly Not As Described," and you get 180 days from the payment date to open a dispute — which is longer than most people realize, so an old charge may still be live. The catch is that it only applies if you paid as goods and services. Friends-and-family payments are excluded, and "send it as friends and family so we both save the fee" is one of the most efficient ways a seller talks you out of your own protection. If you funded the PayPal payment with a credit card, you still have the card dispute sitting behind it as a backstop.

Venmo, Cash App, and Zelle are a different category. They were built to move money between people who already trust each other, and there is no general buyer protection for paying a stranger. Once the money lands, the recipient generally has to agree to send it back. Report it anyway — to the app and to the bank behind it — and be precise about which claim you are making: someone got into your account without permission (unauthorized) is a much stronger case than you sent it because you were deceived (induced). Those two have very different odds. Persistence is not pointless here either: how these rails handle fraud disputes has drawn regulatory action, including a 2025 CFPB consent order requiring one major app's operator to pay redress to users over incomplete investigations. Document everything and escalate in writing.

Crypto and gift cards: assume it's gone, report it anyway

Crypto is honest about what it is. Transactions are not reversible, and the FTC states that flatly. There is no issuer, no chargeback, no dispute button. What you can still do is narrow the window: contact the exchange or kiosk operator the same day, give them the transaction hash and the receiving address, and ask them to flag it — funds that haven't moved off a platform can sometimes be frozen. Then file with IC3 immediately. The volume explains the urgency: IC3's 2025 report logged 181,565 cryptocurrency-related complaints and more than $11 billion in reported losses, with crypto kiosks alone accounting for over 13,400 complaints and more than $388 million.

Gift cards are the one "unrecoverable" method where fast action genuinely sometimes works. Call the company that issued the card — not the store where you bought it — and say the card was used in a scam. Keep the physical card and the receipt; you'll need the numbers. The FTC's position is that the faster you report, the better your odds, because if the balance hasn't been drained yet some issuers will freeze it or refund you. After that, report where it counts: reportfraud.ftc.gov, ic3.gov, your state attorney general, and BBB Scam Tracker. In the UK, that's Action Fraud on 0300 123 2040. Reporting rarely recovers money by itself. It is how a payment company justifies acting on your case, and how the pattern gets on the record for the next person.

Kill the recurring charge — then don't fall for the second scam

If the charge repeats — the mystery-box "subscription," the free trial that converts, the $2 sample that becomes $79 a month — a single refund fixes nothing. Do three things in order. Revoke authorization with the company in writing and keep the copy; email counts. Tell your bank you have revoked authorization and ask for a stop payment order, and if you give that instruction by phone, expect them to want written confirmation within 14 days. Then keep watching the statement. Do not assume a new card number ends it: Visa and Mastercard both operate services that automatically push updated card credentials to enrolled merchants, so a reissued card can quietly keep paying the same subscription. Closing the account is the only reliable kill. And do not count on a legal right to cancel with one click — the FTC's amended Negative Option Rule was vacated by the Eighth Circuit in July 2025. Cancel in writing, keep proof, and screenshot the confirmation.

Then, days or weeks later, someone contacts you. They've seen your case. They can recover your funds. They're with a law firm, a blockchain forensics team, a consumer advocacy group, a government agency. They just need a fee first, or a small "release payment," or your account details to send the money to. This is the second scam, and it targets you specifically because you already lost once — the FTC calls the lists these leads come from "sucker lists," sold with your name, what got you, and how much you paid. The FBI has warned about scammers impersonating IC3 itself, logging more than 100 such reports between December 2023 and February 2025, nearly all of them opening with the claim that your money had been found. Here's the check: legitimate recovery never begins with them contacting you, and never begins with you paying. Your bank, your card issuer, the FTC, and IC3 are all numbers you dial. If it showed up in your inbox, your DMs, or your phone, it is the scam — and the answer is no.