What to do if you are scammed

Jen Cormack • September 1, 2025

Protect yourself from online scams - what to do if you've fallen victim

photo of a credit card with a fishing hook attached

Protect Yourself from Online Scams – What to Do If You’ve Fallen Victim

Online scams are evolving rapidly, and even the most cautious people can fall victim. Criminals now use artificial intelligence, spoofed phone numbers, and fake websites to trick users into sending money or handing over personal information. If you’ve been targeted, the most important step is to act quickly and report it.

In the United States, victims should report online scams to the Internet Crime Complaint Center (IC3) at www.ic3.gov. This FBI program works with the National White Collar Crime Center and the Bureau of Justice Assistance to track and respond to internet-facilitated crime.

Another important resource is the Federal Trade Commission (FTC) at reportfraud.ftc.gov. The FTC accepts consumer complaints and provides detailed guidance on how to protect yourself from further harm.

The scale of the problem keeps growing. The FBI's Internet Crime Complaint Center received more than one million complaints in 2025, with reported losses of nearly $20.9 billion. Complaints involving cryptocurrency accounted for more than $11 billion of that total, a 22% increase from 2024, and investment fraud alone accounted for more than $8.6 billion. Victims aged 60 or over reported more than $7.7 billion in losses.

Scams to Watch For in 2026

AI-Powered Phishing Attacks

The FBI has reported a rise in AI-driven phishing emails that are more convincing than traditional scams. These emails often mimic your actual writing style or reference recent purchases, travel, or communications, making them appear highly personal and trustworthy. Because they are tailored by artificial intelligence, they can slip past spam filters and trick even savvy users into clicking links or sharing sensitive data.

Google Breach-Related Phishing & Vishing

After the recent Google Salesforce server breach, cybercriminals are exploiting the incident to frighten users into handing over login credentials. Victims may receive emails warning that their Gmail or Google accounts are at risk, followed by phone calls from spoofed “650” (California) numbers pretending to be Google support. These scams combine phishing (email) and vishing (voice calls) to appear more credible.

Cryptocurrency Romance Scams ("Pig Butchering")

Romance scams remain one of the most emotionally devastating frauds, and most of the large losses now involve cryptocurrency. The Federal Trade Commission reported $1.16 billion lost to romance scams in 2025. The scheme usually follows the same stages:

The approach. Contact starts on a dating app, on social media, or through a text message that looks like a wrong number. The person appears attractive, successful and attentive.
The relationship. Daily conversation builds trust over weeks or months. The person avoids meeting in person and often avoids live video.
The pitch. The person says their wealth comes from trading cryptocurrency and offers to teach you. There is no request for money at this stage, which is what makes it convincing.
The fake platform. You are directed to a trading website or app that looks professional and shows your account growing. The platform is fabricated and the profits are numbers on a screen.
The trap. When you try to withdraw, you are told about technical problems or taxes and fees that must be paid first. Paying them produces new demands. Eventually the contact disappears.

Newer versions use artificial intelligence. Scammers now use AI-generated photos, deepfake video and even live video calls to appear real, and some pose as celebrities. The FBI logged more than 22,000 complaints of AI-facilitated fraud in 2025, with nearly $893 million in losses.

Warning signs include a new online contact who steers the conversation toward investing, pressure to use a platform you have never heard of, discouragement or anger when you mention withdrawing, and any request to pay a fee in order to get your own money back.

Recovery scams. People who have already lost money are often targeted a second time by someone claiming to be a recovery agent, attorney or investigator who can get the cryptocurrency back for an upfront fee. Be cautious of anyone who contacts you first, guarantees recovery, or asks for payment in cryptocurrency.

Government & Official Impersonation

The FBI warns of vishing and smishing scams in which criminals impersonate senior government officials or law enforcement officers. Using spoofed caller IDs and even AI-generated voices, scammers threaten victims with arrest, fines, or frozen benefits if they do not comply immediately. Because the calls or texts sound so authentic, victims often panic and follow instructions without stopping to verify the source.

Toll & Package Delivery Text Scams

One of the largest scams currently targeting U.S. smartphone users involves fake toll violation or DMV text messages. The message typically claims the recipient has unpaid tolls, taxes, or parking violations, and that failure to pay will result in license suspension or legal action. Victims who click the link are directed to a fake payment page designed to steal credit card details. Similar tactics are also used with fraudulent UPS, FedEx, or Amazon “delivery” texts.

QR Code Scams (Brushing Technique)

Scammers are increasingly using QR codes to deliver malware or phishing links. In one scheme known as the “brushing technique,” criminals mail unsolicited packages containing QR codes, tricking recipients into scanning them out of curiosity. Once scanned, the codes may install malware, open fake login pages, or steal personal data. The FBI has also warned about Browser-in-the-Browser (BiTB) attacks, where QR codes lead to pop-ups that look like legitimate sign-in pages but are designed to capture your credentials.

Medusa Ransomware

The FBI is tracking the Medusa ransomware gang, which has been launching targeted phishing campaigns to compromise Gmail, Outlook, and corporate networks. Once access is gained, attackers encrypt files and demand ransoms ranging from $100,000 to millions of dollars. In addition to financial damage, these attacks often involve data theft, meaning sensitive personal or business information may be leaked or sold on the dark web even if the ransom is paid.

What to Do If You’ve Been Scammed

Stop communication immediately. Don’t reply or send more money.
Document everything. Save emails, texts, receipts, and screenshots.
Save the cryptocurrency details. Record every wallet address, transaction ID, platform web address and the dates and amounts of each transfer. Law enforcement needs these to trace funds.
Do not pay to withdraw. A demand for taxes or fees before a withdrawal is part of the scam.
Report it. Use IC3, the FTC, and your state attorney general’s office. For fraudulent trading platforms, also report to the CFTC at CFTC.gov/complaint.
Notify your bank. Ask about reversing charges or freezing your accounts.
Protect your identity. Place fraud alerts or freezes with Equifax, Experian, and TransUnion.
Seek professional help. A private investigator can assist with scam verification, dark web searches, and evidence collection.

How Jennifer Cormack Consulting Can Help

At Jennifer Cormack Consulting, I specialize in fraud investigations and scam response. Whether you've been targeted by a romance scam, phishing attack, or a breach-related scheme, I can: