The money is gone, reality sinks in, and the first reaction of almost every victim is the same: shame and cleanup. Delete the conversations with the scammer, block the contacts, get rid of everything that recalls the deception. It is the most human reaction there is, and it is exactly the one that destroys the case. In the romance scams that drain a lifetime's savings, in the fake investment platforms, in the cloned profile that asked for money in a relative's name, the chance of holding someone accountable and recovering anything lives in the records the victim, on impulse, eliminates. The first 48 hours are not for cleaning; they are for preserving and acting, in that order.
Hour zero: the bank and the police report
If a transfer was made via Pix, the first phone call is to your bank, immediately: there is an official refund mechanism for fraud cases, triggered by the institution itself, and it works better the earlier the request goes in, because it tries to reach the money before it is scattered across other accounts. Notify the bank formally, keep the protocol number, and file the police report, which today can be done online in most states. The report is not bureaucracy: it is the document that enables the bank, the police, and the subsequent judicial measures, and it records the date you learned of the scam.
Preserve: the delete-nothing rule
Everything that happened between you and the scammer is evidence. The complete conversations (not just the "important" parts), the profiles and numbers used, the transfer receipts, the emails, the ads or groups where the contact began. Do not delete, do not block yet, do not "organize" the conversations, and resist the temptation to confront the criminal, who at the first sign of suspicion erases the trail on his side. Keep the device as it is: if a forensic examination becomes necessary, the evidence with real value comes from the conversation on the original phone, with its metadata, not from a loose, re-forwarded screenshot. If the scam involved access to your device or computer, stop using it and seek guidance before "wiping it just to be safe".
"Shame says delete; the case says keep. Between those two impulses, in the first hours, it is decided whether the scam will have consequences for anyone beyond the victim."
Close the doors that are still open
A scam rarely ends with the first loss. With the data obtained, the criminals attempt the second wave: new contacts posing as "the detective who recovered your money", loans in your name, access to your accounts. Change your passwords from a secure device, starting with your primary email, which is the master key to your digital life: it is through it that all other passwords get reset. Enable two-step verification on everything, especially WhatsApp, which is the favorite target. And one preventive guideline I repeat in interviews: avoid tying your cell phone number and your primary password-recovery email to the same set of sensitive accounts; whoever captures one takes the rest. Monitor your taxpayer ID with the credit protection services in the following weeks.
When forensic work comes in (and when it is worth it)
Not every scam calls for a private forensic examination, and honesty requires saying so. For smaller amounts, the path of the police report, the bank, and the platform tends to be proportional to the damage. Forensic work starts to make sense when the amount justifies civil pursuit, when authorship needs to be demonstrated technically (tracing the money, analyzing the accounts and numbers used, assembling the dossier that supports the lawsuit), or when the scam hit a company and becomes a liability case. In those scenarios, the examination turns the victim's scattered paperwork into a technical narrative with a beginning, a middle, an end and, above all, with addresses: where the money went and through whose hands it passed. The feasibility assessment, at the laboratory, is done before any engagement, precisely so the victim does not spend good money chasing lost money.
And a caution about the people you love: a good share of the victims of long-running scams, like romance scams, hide the situation from their families out of shame. Asking with respect, without judgment, is often what interrupts the scam before the next transfer.
The second wave: the fake rescue scam
There is a cruel market built on those who have already fallen: the recovery scam. Days or weeks after the loss, the victim is approached by a "lawyer", a "specialized firm", or even a "police chief" who claims to have located the money, and only needs a fee, a judicial deposit, an advance cost to release it. It is the same group, or competitors who buy victim lists, draining for the second time someone who is fragile and eager for redress. The yardstick for not falling: legitimate recovery does not charge an advance fee for a promised result, does not arrive by unsolicited message, and does not demand secrecy about its own process. Any contact of that kind gets verified through official channels: the firm's public phone number, the case number in the courts' systems, the agent's official credentials. When in doubt, the right answer is always the same: hang up and seek help through a channel you chose, not through the channel that came to you.
The pocket summary of the 48 hours
- Bank immediately (Pix has a refund mechanism; every hour counts) and the online police report;
- Delete nothing: conversations, profiles, receipts, and device preserved as they are;
- No confrontation with the scammer: he erases everything on his side at the first sign;
- Passwords changed from a secure device, starting with the primary email; two-step verification on everything;
- Large amounts, authorship to demonstrate, or a company involved: technical assessment before filing.
The scammer counts on two allies: the victim's haste during the scam and the victim's shame after it. Against the first, distrust; against the second, method. Whoever preserves, notifies, and acts in the first 48 hours turns the position of victim into the position of party, and that difference, in cases I have followed for over two decades, is what separates the story that ends in loss from the story that ends in accountability.
