Short answer: If you have just entered your card details on what looks like a scam site, act inside the first hour. In this exact order: freeze the card in your banking app, call your bank or card issuer and report it as fraud so they can dispute the charge, change any password you reused with the shop, save screenshots as evidence, and report the site to the relevant consumer protection body. The faster you move, the higher your chance of getting the money back before it settles.
This guide walks you through what to do minute by minute in the first hour, what to do in the first 24 hours, and what to do in the days after that. It is written for the moment you realise you may have paid a fake store, not for the moment before you buy. For the prevention side, see our pillar guide on safe online shopping.
The first hour: stop the money from moving
Fraudulent charges are easiest to reverse before they settle, and card charges usually take anywhere from a few hours to two business days to fully settle depending on the network and the merchant’s country. Your goal in the first hour is to trigger the bank’s internal flag before that clock runs out.
Step 1: Freeze the card immediately in your banking app
Almost every current banking app (Chase, Bank of America, Wells Fargo, Barclays, HSBC, Deutsche Bank, ING, Revolut, N26, Wise and most others) has a one tap “freeze card”, “lock card” or “block card” option. Use it now, before you do anything else. This stops any further charges on the same card. If the scammer has your details, the first charge is often a small test amount and the second is a much larger one an hour or two later. Freezing the card prevents the second charge.
Step 2: Call the fraud line, not the general customer service line
Every major card issuer prints a dedicated fraud phone number on the back of your card and inside your banking app. That line is staffed 24 hours and gets you to a person who can dispute a charge on the spot. General customer service will make you wait, transfer you and often send you to the same fraud line anyway with an hour lost. When you get through, say clearly: “I want to report a fraudulent charge and open a dispute.” Give them the merchant name that appears on your statement (not the shop name you thought you were paying), the amount, and the date and time. Ask them to:
- Block the current card and reissue a new one with a new number.
- Flag the transaction for chargeback under the appropriate scheme (Visa, Mastercard or Amex all have well defined dispute categories for “goods not received” and “fraudulent transaction”).
- Confirm the reference number of the dispute in writing (usually in the banking app or by email).
Step 3: If you paid via PayPal, Klarna or Afterpay, open a dispute inside that service
Do this in parallel with the bank call, not instead of it. PayPal’s Buyer Protection process is inside the “Resolution Centre” of your PayPal account. Klarna and Afterpay have “report a problem” flows inside their apps. In all three cases, open the dispute as “item not received” (safer than “not as described” because it does not require you to receive the item first).
Step 4: If you paid by instant bank transfer, SEPA, Zelle or Venmo, call your bank now
Instant transfers are the hardest to reverse. Some banks can still stop the transfer if it has not yet been credited to the receiving account, but the window is minutes to hours, not days. Ask your bank specifically to “attempt a recall” of the transfer. Recovery rates are lower than card chargebacks (industry data from the UK’s Payment Systems Regulator puts APP scam refund rates near 65 percent under the new reimbursement rules that took effect in late 2024, but individual banks vary), but the attempt is still worth making and creates a paper trail.
Step 5: Change passwords for any account you reused with the shop
If you created a shop account with the same email and password you use on Gmail, PayPal, Amazon or your bank, that combination is now in a stranger’s hands. Change the password on every account that shares those credentials, starting with your email. Turn on two factor authentication where it is not already on. The fake shop’s real business model is often selling the credentials it collects, not shipping products.
The first 24 hours: build the evidence, expand the protection
Once the money stop is triggered and passwords are changed, you have breathing room. Use the next hours to build the evidence file that will make any dispute stick.
Take screenshots of everything
Save screenshots of the order confirmation page, the order confirmation email (including the full email header if you know how to view it), the product page you bought from, the shop’s contact page, any messages you exchanged with the seller, and the WHOIS record for the shop’s domain (a quick WHOIS lookup shows the registration date, which is often days or weeks before your order). Fake shops disappear fast. What you screenshot in the first 24 hours may not exist by the end of the week.
Check your card statement and bank statement for other unusual charges
Scammers usually test a card with a small charge (one or two dollars, sometimes at an odd merchant name) before hitting it with a larger one. Look back over the last week and forward every day for the next month. Anything you do not recognise, dispute.
File a formal report with the right consumer protection body
The report is not just a formality. It creates a public record that helps other consumers find the shop when they search for it, and in some jurisdictions it triggers investigations.
- United States: File at reportfraud.ftc.gov (Federal Trade Commission). For lost money above 100 dollars, also file with the FBI’s Internet Crime Complaint Center at ic3.gov.
- United Kingdom: Report to Action Fraud at actionfraud.police.uk or call 0300 123 2040.
- European Union: Report through your national consumer protection body. For cross border scams, the European Consumer Centres Network at eccnet.eu can help.
- Canada: Report to the Canadian Anti Fraud Centre at antifraudcentre.ca.
- Australia: Report to Scamwatch at scamwatch.gov.au.
Report the shop to the platform that surfaced it to you
If you found the shop through a Google Ad, a Facebook Ad, a TikTok Ad or an Instagram Shop link, report the ad or the shop inside that platform. Ad networks act on volume: one report does little, but the total volume from all victims usually triggers a takedown within days.
Write a review on independent review platforms
Once the bank dispute is opened and you have the case reference, publish a factual review on independent platforms like Trustpilot, Sitejabber or a directory site such as WebWiki. State only what happened to you, include the date and the amount, and avoid speculation. Honest reviews from victims are the single most effective way to warn the next round of shoppers, and they usually rank higher in search results than the shop’s own site within a few weeks.
The days after: monitor and clean up
The first hour and the first 24 hours are about damage control. The days after are about identity protection.
Watch your credit report
If the fake shop harvested more than card details (name, address, date of birth, sometimes a photo of ID), the risk moves into identity theft. In the US, request a free credit report from each of the three bureaus (Equifax, Experian, TransUnion) through annualcreditreport.com and check for accounts you did not open. In the UK, use the free service from Experian, Equifax or TransUnion (Noddle). In Germany, request the free SCHUFA “Datenkopie” once a year.
Consider a credit freeze if identity theft is a real risk
A credit freeze prevents new accounts from being opened in your name until you lift it. It is free in the US and takes minutes to place with each bureau. In the UK the equivalent is CIFAS Protective Registration, which flags your file so lenders apply extra verification checks. Neither affects existing accounts.
Check that the bank dispute actually resolved
Bank chargebacks are not instant. The bank usually issues a provisional credit within a few days, then investigates for up to 90 days before making the credit permanent. Check your account weekly during that window and reply promptly to any request for additional documents. If the dispute is rejected, ask for a written explanation and consider escalating to the financial ombudsman in your country (Financial Ombudsman Service in the UK, Consumer Financial Protection Bureau in the US).
Clean up your data footprint
The shop had access to whatever you gave it at checkout: name, address, email, phone number, sometimes a birthday. Consider using a forwarding email address (Apple’s Hide My Email, DuckDuckGo Email Protection, or a self hosted alias service) for future new shops so you can burn the address if it starts receiving spam or phishing. If your phone number starts getting scam calls after the incident, that address book is now in a phishing database.
How likely is it that you get the money back?
Realistic expectations, based on 2025 and 2026 industry data:
- Credit card, disputed within a few days: Recovery rate above 90 percent for straightforward “goods not received” cases. This is the strongest recovery path.
- PayPal Buyer Protection: Recovery around 70 to 80 percent for eligible transactions, with most cases decided within 10 to 30 days.
- Debit card: Recovery around 60 to 75 percent, but slower and the money is out of your account during the dispute.
- Instant bank transfer under the UK’s 2024 reimbursement rules: Around 65 percent of authorised push payment scams reimbursed in the first year of the new rules, with the rate expected to rise.
- Cryptocurrency: Effectively zero. There is no dispute mechanism on public blockchains.
These numbers are goals to aim for, not guarantees, and each case turns on the facts. But they explain why the payment method choice at the moment of purchase matters so much and why the “first hour” advice above is so heavily weighted toward card issuers and payment services with real dispute infrastructure.
Frequently asked questions
Should I contact the shop first before reporting it?
No. If it is a scam shop, contacting them tips them off that you noticed, and the “support” reply you get is designed to delay you past the dispute window. Go straight to the bank first, then report the shop, then, if you have any bandwidth left, send a polite one line email so you have a paper trail of your side.
What if the charge has not shown up yet on my statement?
Freeze the card and call the bank anyway. Banks can see pending authorisations before they post to your statement, and it is easier to cancel a pending charge than to dispute a settled one.
What if I entered only my card number and CVV, but did not complete the checkout?
Assume the card is compromised. The site captured the data whether or not the payment page finished. Freeze the card and reissue it. The cost of a new card in the post is nothing compared to the cost of a fraud loss.
Can the bank refuse to refund me?
Yes, but not for the reasons scammers try to make you feel guilty about. A card issuer can refuse a chargeback if the merchant provides evidence of delivery, if the dispute is opened outside the scheme’s time window (usually 120 days for Visa and Mastercard), or if the transaction was clearly authorised for the goods delivered. Being tricked into buying from a fake shop is normally covered by “goods not received” or “not as described”. If the issuer rejects a valid dispute, escalate to your national ombudsman.
Do I need a police report?
Usually not for the card dispute itself, but some banks or PayPal cases request a case number from the relevant fraud reporting body. In the UK, an Action Fraud report generates a Crime Reference Number that most banks accept. In the US, the FTC report plus (for larger losses) an IC3 report cover most cases.
Should I ever pay a “recovery agent” who promises to get my money back?
Never. Recovery scams target people who have already lost money to a first scam, using their name in scam victim databases sold on. A real bank chargeback, a real ombudsman complaint and a real law enforcement report cost you nothing. Anyone asking for an upfront fee to recover your money is scamming you a second time.
Related reading and sources
- Safe Online Shopping: The Essential Guide for 2026
- How to Tell If a Website Is Trustworthy: The Complete Checklist
- The Most Common Online Scams in 2026 and How to Avoid Them
- How to Check If a Website Is a Scam: 12 Warning Signs
- US Federal Trade Commission, reportfraud.ftc.gov
- US FBI Internet Crime Complaint Center, ic3.gov
- UK Action Fraud, actionfraud.police.uk
- UK Payment Systems Regulator, mandatory reimbursement rules for APP fraud (in force October 2024), psr.org.uk
- European Consumer Centres Network, eccnet.eu
- Visa and Mastercard chargeback rules, official issuer guidance