Enterprise Fraud Recovery Playbook 2025: Report & Protect

Act fast: stop contact, secure accounts, call your bank to reverse the payment, and report to official .gov portals. If your identity was exposed, freeze your credit and build a recovery plan. Speed matters: recovery windows are short.

U.S.-specific guidance. General information, not legal/tax/financial advice.

Step 1

Stop contact

Do not reply or click. Save screenshots and receipts.

Step 2

Secure accounts

Change email and financial passwords; enable 2FA.

Step 3

Call your bank/app

Ask for a block, recall, or dispute. Minutes matter.

Step 4

Report it

File with the FTC and, if online, the FBI IC3.

Report to FTC (ReportFraud.ftc.gov) Report to FBI IC3 (ic3.gov)

Other key portals: report IRS phishing · USPIS smishing article · report international scams · HHS‑OIG hotline

Key Terms

Identity theft: When someone uses your personal info (like your SSN or account numbers) without permission to commit fraud (FTC definition).
IC3: The FBI's Internet Crime Complaint Center, the central intake for crimes that used the internet or a network (IC3 overview).
Phishing / Smishing: Fraudulent emails or texts that trick you into clicking links, sharing info, or installing malware (FTC phishing guide).
Fraud alert: A free notice on your credit file that tells businesses to verify identity before opening new credit (FTC on alerts).
Credit freeze: A free lock that restricts access to your credit report to stop new accounts in your name (FTC on freezes).
IP PIN: A 6‑digit IRS number that helps block fraudulent federal tax returns filed in your name (IRS IP PIN).

What to Do Right Now

Every minute counts. Follow these steps in order to maximize your chances of recovery and minimize further damage.

Cut contact immediately. Don't respond, don't pay more, and don't click new links. Capture screenshots, messages, usernames, URLs, and receipts before anything disappears. The FTC outlines first steps for victims in What to do if you were scammed.
Call your bank, card issuer, or app now. Ask to block, reverse, or dispute the payment. For wires and ACH, request an urgent recall. For cards, request a fraud dispute. For P2P apps, use in‑app reporting and notify the linked bank/card (payment‑specific steps).
Report the scam. File with the FTC at ReportFraud.ftc.gov. If it used the internet (email/text, website, social media, crypto, online market), also file with the FBI's IC3. More reports help agencies spot patterns and build cases.
Lock down your accounts. Change passwords on email and financial accounts. Turn on two‑factor authentication. Review recovery email and phone numbers. Enable sign‑in alerts. See practical anti‑phishing habits from CISA's Recognize and report phishing.
If identity data was exposed or misused (e.g., SSN, account takeover): create a personalized recovery plan and get pre‑filled letters to creditors/credit bureaus via the FTC's identity theft recovery guidance (recover from identity theft). Place a free fraud alert or credit freeze to stop new accounts (freezes and alerts).
If it's IRS‑related (IRS imposter, refund fraud, W‑2/1099 issues): forward phishing to phishing@irs.gov and follow the IRS reporting steps (IRS phishing reporting; tax scam reporting).
If your tax identity was stolen: file IRS Form 14039 (Identity Theft Affidavit) and consider opting into an IP PIN for future filings (Form 14039; Get an IP PIN).
USPS smishing or mail fraud: don't click links; follow Postal Inspection Service steps and reporting options (USPIS smishing guidance).
Cross‑border scams: if a foreign seller/website is involved, submit to the global econsumer.gov system via the FTC notice (report international scams).
State protection: ask your State Attorney General's consumer office for help and to file a complaint (find your AG).

First‑Hour Playbook by Payment Method

How you paid determines your recovery options. Work the row that matches your situation. Speed is critical.

Unauthorized transaction

Card used without permission
Account takeover
You did not approve transfer

Use these rows: Credit Card · Debit/ACH (unauthorized) · Bank‑linked P2P (unauthorized)

Induced/authorized under fraud

You sent money after pressure
Gift cards, crypto, wire
Marketplace or social sale

Use these rows: Wire · P2P (authorized) · Gift cards · Crypto

Recovery Matrix by Payment Method
Payment	Who to contact first	Typical protections	Critical time window	What to say	Official resource
Credit Card	Card issuer	$50 liability limit for unauthorized charges	Immediately	“Fraud dispute/chargeback. Here is my evidence.”	what to do if scammed
Debit Card / ACH	Your bank	Report within two business days to limit liability to $50	Within 2 business days	“Unauthorized electronic transfer. Please block further attempts.”	FTC steps by payment
Wire Transfer	Your bank	Minimal consumer protection	Minutes	“Urgent recall/hold. Funds sent in error due to fraud.”	IC3
Bank‑Linked P2P (e.g., Zelle)	In‑app + your bank	Varies by authorization	Immediately	“Unauthorized vs. induced transfer. Open fraud claim.”	FTC guidance
PayPal / Venmo / Cash App	In‑app; then bank/card if linked	Buyer protection depends on transaction type	Immediately	“Report the transaction; open dispute; share evidence.”	FTC steps by payment
Gift Cards	Card issuer	Usually impossible once redeemed	Immediately	“Freeze any remaining value. Here is the receipt/code.”	FTC steps by payment
Cryptocurrency	Exchange + IC3	Typically irreversible	Immediately	“Here are wallet addresses and transaction hashes.”	IC3
Cash / Money Order / By Mail	USPS Inspection Service	Possible intercept if very fast	Immediately	“Possible mail intercept. Here is tracking/label.”	USPIS guidance

FTC (general scams)

ReportFraud.ftc.gov →

FBI IC3 (internet-enabled)

ic3.gov →

USPIS (USPS smishing)

Guidance and reporting →

International

econsumer.gov complaint →

Copy-ready phone scripts

Credit card dispute

“I am reporting unauthorized/fraudulent charges on my credit card. Please open a fraud dispute and initiate a chargeback. I have evidence ready (screenshots, receipts, messages). Kindly provide a case number and next steps.”

Debit/ACH unauthorized

“I am reporting an unauthorized electronic funds transfer from my account. Please block further attempts and start an investigation. I need a case number and instructions for any written confirmation you require.”

Wire: urgent recall

“A wire was sent due to fraud. Please initiate an immediate recall/hold with the receiving institution. I can provide beneficiary details, tracking, and any correspondence. Please escalate and confirm actions taken.”

Bank‑linked P2P (e.g., Zelle)

“I need to open a fraud claim for a [select: unauthorized | induced] P2P transfer. I can provide the transaction ID, recipient handle, and message history. Please advise on reimbursement process and next steps.”

Crypto exchange report

“I am reporting a fraudulent crypto transaction. Please review and freeze any associated accounts if possible. Here are wallet addresses and transaction hashes. I have filed with the FBI IC3 and can share the IC3 confirmation number.”

Where to Report: by Scenario

Use the right portal. If it used the internet, file with IC3 in addition to the primary portal.

Report Router
Scenario	Primary portal	Secondary (if online)	Notes
Any scam (general)	ReportFraud.ftc.gov	IC3	Helps agencies spot patterns
Phishing / Smishing	recognize and report phishing	IC3	Go directly to the official site to verify
IRS / Tax	Forward to phishing@irs.gov; report IRS phishing; report tax scams or fraud	As applicable	Use Forms 3949‑A, 14157, 14157‑A
USPS‑themed scams	USPIS smishing guide	As applicable	Do not click unexpected delivery links
International / Cross‑border	report international scams	Add IC3 if online	Connects to econsumer.gov network
Medicare / Medicaid / HHS fraud	HHS‑OIG	As applicable	Covers fake cards, bogus equipment, billing fraud
State help (any consumer scam)	find your AG	Add IC3 if online	Local enforcement; possible recoveries via settlements

Identity Theft and Account Takeover

If your SSN or credentials were exposed, move fast and follow these steps.

Quick checklist

Create your plan
Generate pre‑filled dispute letters and steps via recover from identity theft.
Place a fraud alert
One‑year alert; lenders verify identity. FTC on alerts.
Freeze your credit
Equifax, Experian, TransUnion. Free and stops new accounts. FTC on freezes.
IRS identity theft
Submit Form 14039 if your return is rejected or you receive unexpected IRS notices.
Get an IP PIN
Block fraudulent e‑filings. See IP PIN overview or Form 15227.
Monitor and dispute
Check reports often; dispute in writing. See identity theft recovery steps.

Fraud Alert vs. Credit Freeze
Feature	Fraud Alert	Credit Freeze
Stops new credit?	No; lenders must verify identity	Yes; blocks new credit pulls
Cost	Free	Free
Setup time	Minutes	Minutes
When to use	Possible compromise; monitoring	Confirmed misuse or high‑risk exposure

Why this matters: fast freezes and alerts prevent new accounts, reducing long‑term damage.

Evidence You'll Need

Gather this information before you file reports or contact your bank. Complete documentation strengthens your case.

Dates, amounts, method, recipient accounts/wallets, transaction IDs/hashes Handles, emails, phone numbers, URLs, ads/listings, screenshots Receipts and gift card codes/photos Shipping labels and tracking FTC and IC3 confirmation numbers Police report number (if filed)

Tip: Use Print to save this page as a PDF and include it with your bank or exchange case.

Timelines and Expectations

Understanding what happens next helps you stay organized and follow up effectively.

Banks / Cards / Apps

Expect case numbers quickly; decisions may take days to weeks. Move fast: recovery often depends on timing (FTC first steps).

Law Enforcement Intake (FTC / IC3)

Reports feed investigations and trend analysis; reimbursement is not guaranteed but supports disputes (IC3 intake).

Identity Theft Fixes

Alerts and freezes take effect quickly; disputes may take several weeks per creditor/bureau cycle (FTC on alerts/freezes).

Why This Matters

FTC Reported Losses (2024)

$12.5B

Source: FTC loss figures

Internet‑Crime Losses (IC3)

$16.6B

Source: IC3 losses

Fraud operates at scale and speed. Social platforms are a major conduit; consumers have reported substantial losses via social media since 2021 (FTC social media losses).

Scammers use sophisticated tactics: fake websites, AI voice clones, and urgent pressure to bypass defenses.

For leaders, invest in resilient controls and fast escalation paths. For technical teams, deploy strong authentication, phishing‑resistant MFA, and takedown/reporting workflows. For individuals, act quickly: secure accounts, contact your bank, and report through official .gov portals.

Risk Patterns and 2025 Threats to Watch

Impersonation (Government, Company, Tech Support)

No legitimate agency will ask you to move, withdraw, or convert money to "protect" it. They won't demand payment via gift cards, crypto, or wire. Report imposters to the FTC and IC3 (how to avoid a scam).

Phishing and Smishing Everywhere

Verify sender addresses. Hover to preview links before clicking. Use a known good website or phone number to contact the organization-never use contact info from a suspicious message. CISA's guide explains safe reporting and verification basics (CISA phishing tips).

Crypto and Fast‑Settlement Channels

These are prized by scammers because reversals are hard. If you paid this way, act immediately and include technical details (wallet addresses, hashes) in your reports (IC3 complaint).

FAQs

Can I get my money back after a wire?

Sometimes. Ask your bank to recall the wire immediately. If funds are not withdrawn, recovery may be possible. For online scams, also submit to the FBI's internet‑crime intake (IC3 complaint). Wire transfers have minimal consumer protection; speed is critical.

Should I pay a fee to “recover” my money?

No. That is often a second scam. Government agencies and banks do not charge upfront fees to recover fraud losses. Report to the FTC and follow official steps (FTC recovery steps).

Do I need a police report?

Local reports can help for identity theft or large losses, especially if a creditor or insurer asks. Keep FTC/IC3 confirmation numbers and evidence organized (identity theft recovery).

I clicked a phishing link. What now?

Change passwords immediately. Turn on two‑factor authentication. Run security scans. Contact affected companies using a known‑good website or number. For IRS‑related issues, forward to phishing@irs.gov and follow IRS steps (IRS phishing guidance).

What if a tax preparer mishandled my tax info?

Use IRS tools for misconduct and violations: Form 14157, Form 14157‑A, and Form 3949‑A.

Do I report to both the FTC and FBI?

For internet‑enabled scams, file both: the FTC for general scams and FBI IC3 for online crime (FTC report; IC3 report).

A One‑Page Checklist (First 30 Days)

Print this and check off each step as you complete it.

Today: Stop contact. Call your bank/card/app. Change email and financial passwords. Enable 2FA. Collect evidence (FTC first steps).
Today: Report to the FTC and, if online, to the FBI IC3 (FTC intake; IC3 intake).
48 hours: If identity data was exposed, place a fraud alert or credit freeze with the credit bureaus (alerts/freezes).
Week 1: Build your identity theft recovery plan. Contact affected companies and send disputes as needed (identity theft plan).
Weeks 2-4: Re‑check statements and credit files. Track case numbers, letters, and outcomes. Keep freezes in place until you genuinely need new credit (freeze basics).

For Leaders and Teams

Executives

Expect rising losses and overlapping jurisdiction. Offer a simple internal "first hour" protocol: stop‑pay, secure accounts, collect evidence, report to FTC/IC3, and brief legal/compliance. Centralize proof‑of‑loss templates and executive contacts for banks/exchanges.

CTOs / CISOs

Harden identity (phishing‑resistant MFA, password managers, session monitoring). Build takedown/reporting muscle (abuse mailboxes, DMARC, HSTS, brand monitoring). Pre‑stage incident playbooks for wire/ACH recall, crypto triage, and marketplace fraud.

Ops / Finance

Pre‑authorize rapid‑response procedures with banks. Document recall workflows. Maintain up‑to‑date lists of required data (transaction IDs, hashes, counterparties, correspondent banks). Every minute saved in the first hour increases recovery odds.

Disclosures and Limits

This guide is for U.S. readers and general information only; it is not legal, tax, or financial advice. Laws and platform policies change. For personalized guidance, consult your bank's fraud team, a qualified professional, or law enforcement.

Always verify .gov domains: Official reporting portals end in .gov and use https. Scammers create fake portals that look real-double-check the URL before entering personal information.

Got Scammed? The 2025 U.S. Playbook to Report, Recover, and Protect Yourself