The quick answer
Start here
If you may have paid a scammer or exposed an account, stop contact and act through independently verified channels. Contact your bank or card provider immediately where money or financial details are at risk. Secure affected accounts, starting with important recovery channels such as email, and follow the relevant provider’s recovery guidance. Preserve evidence without delaying urgent protection, then report through the appropriate Australian services. Recovery is not guaranteed, and anyone promising it for a fee deserves careful scrutiny.
You do not need certainty before asking for help
A scam can become apparent gradually: an invoice detail changes, a supposed support worker asks for another transfer, or an account suddenly behaves differently. You do not need to solve the whole story before telling your bank that a transaction or account may be at risk.
Stop sending money and stop following instructions from the suspected scammer. Verify the organisation through its official app, a known statement or a website address you independently locate. A caller transferring you to a “fraud team” is still the same unverified contact chain.
This guide organises practical recovery tasks; it is not a guarantee of account restoration or reimbursement. If there is an immediate threat to physical safety, use the appropriate emergency pathway. For account or money concerns, focus first on the affected institution’s verified help process rather than continuing a conversation designed to keep you under pressure.
Contact the bank or payment provider promptly
Scamwatch says to contact your bank or card provider immediately, report the scam and ask it to stop transactions. Tell the institution what happened, what was shared, when the payment occurred and whether someone may still have access. You do not need a polished written history before making that first contact.
Ask what immediate steps are needed for the affected accounts, cards or payment channels. Keep the reference number and instructions. If the payment was made through another platform, use that platform’s official support process too. Be clear about the payment method rather than assuming all transfers have the same recovery options.
A request to investigate is not proof that funds can be recovered. Keep an expected refund separate from money actually returned. If you disagree with the institution’s handling, ask about its complaint process and the relevant external financial complaints pathway.
If remote access was involved, use a trusted route for recovery
A person claiming to fix a problem may have persuaded you to install remote-access software or share your screen. ACMA warns about this type of request. The immediate question becomes whether the device or session can still be observed or controlled.
Stop the remote interaction and seek the provider’s or a trusted technical support pathway for securing the affected device. Use a different trusted device for urgent bank and account contact where possible. Do not enter new passwords into a session you suspect is still compromised, and do not install another tool at the caller’s direction to “undo” the first one.
Tell your workplace IT team promptly if a work device or account is involved. Preserve what you can safely identify, such as the application name and timing, without reopening a malicious attachment or engaging the scammer to gather more proof. A complete forensic record is not your first responsibility.
Source: ACMA: remote-access requests
Secure the email account that can reset other accounts
Email often acts as a recovery channel for banking, shopping, cloud storage and government services. The Australian Government’s cyber guidance explains why an attacker with email access can reach beyond the inbox. Follow the email provider’s official recovery instructions.
The cyber.gov.au checklist includes changing to a strong unique password, reviewing recovery details, signing out unfamiliar devices, enabling appropriate multifactor authentication and checking forwarding rules and automatic replies. A password change alone may leave another route open. Check the account’s security settings through the legitimate service.
Keep the recovery method under your control and review linked accounts that use the affected email or single sign-on. If you cannot regain access, report the account compromise to the provider and secure connected accounts through their own support processes. Some accounts cannot be recovered, so avoid treating a successful reset as the only possible outcome.
Make an exposure map without storing more secrets
Draw a small map in your private notes: money, email, phone number, identity documents, government services, work accounts and cloud storage. Mark each as affected, possibly affected or no known exposure. Then record the next verified contact for each affected area.
This is a way to avoid forgetting a connected account while repeatedly checking the same one. It is not a place to copy passwords, identity numbers or card details. A label such as “licence image shared; ask issuing authority about response” is enough for a general planning tool.
If the incident involved identity information, Scamwatch identifies IDCARE as a free identity and cyber-support service. Use its official route to discuss a response plan. Different exposed documents can need different issuer actions, so do not assume replacing one card resolves every identity risk.
Check myGov and linked services through the official process
If myGov or a linked service may be involved, open the official app or type my.gov.au yourself. Its scam guidance describes reviewing security, account history and connected devices, and contacting affected linked services. A change to bank details or a missing service link needs prompt attention through that service.
Do not follow an unexpected message offering to “restore” a government account in exchange for a code or payment. Use official helpdesk and recovery instructions, particularly if you cannot sign in. Stronger sign-in options can help, but configure them through the genuine service and understand how recovery works.
Treat an address or bank-detail correction separately from securing the account. You need to know both that the record is correct and that an unauthorised person no longer has access. A corrected profile alone does not establish that the wider incident is resolved.
Source: myGov: what to do after a scam
Preserve a useful timeline without delaying urgent action
After urgent protection steps, write a chronology: first contact, payment, information shared, unusual activity noticed and institutions contacted. Keep screenshots, transaction records, message headers or documents that are already available safely. Label the files so someone reviewing the incident can follow the sequence.
Do not keep communicating with the scammer to obtain an admission. Do not click suspicious links again just to capture a better screenshot. Record a URL from the existing message if safe, or explain to the relevant service what you received.
A short, accurate history is better than a dramatic narrative with guessed details. Write “I do not know whether this file was opened” when that is true. If new information arrives, append it with the date rather than silently rewriting the earlier record.
Report through the appropriate Australian services
Scamwatch and ReportCyber serve different reporting functions, and your bank or account provider still needs direct contact about its own service. Use the official guidance to choose the appropriate reports. A report to one body does not automatically notify every affected institution or begin a bank dispute.
Keep the reporting references and any follow-up instructions. If someone else’s account was used to contact you, warn them through an independent route where appropriate. If your own account sent malicious messages, follow the provider’s recovery guidance about notifying contacts safely.
You do not need to publish a full account of the incident to prove it happened. Public details can expose personal information and attract further approaches. Share sensitive evidence only through the approved channels of the organisations helping you.
Beware of the second scam: guaranteed money recovery
Scamwatch warns that people who lost money can be targeted again by offers to recover it. A person claiming access to a special recovery team, frozen crypto wallet or government refund system may be another scammer. An upfront fee and a promise of guaranteed results are reasons to stop and verify independently.
Keep control of the response. A legitimate complaint or recovery process should be checked with the institution or official body itself, not verified through a reference supplied by the new caller. Do not pay a release fee because the person knows details from the original scam; that knowledge is not proof of authority.
Cognivo’s checklist can organise calls and follow-ups. It cannot recover funds, assess a device’s security or confirm someone’s identity. Keep passwords and documents outside the tool. Review the list after the urgent stage so unresolved account, payment and identity tasks do not disappear behind one “reported” tick.
FAQ: Will the bank refund money lost to a scam?
It depends on the transaction, circumstances and applicable process. Contact the bank promptly and provide accurate information. Ask for a written outcome and use its complaint pathway if you disagree. Do not spend on the assumption that reimbursement will occur, and do not pay a stranger who guarantees they can obtain it.
FAQ: Is changing my password enough?
It may not be. Follow the provider’s account-recovery instructions and review recovery details, sessions, authentication methods and relevant forwarding settings. Also consider linked accounts and whether the device itself is affected. A password reset is one step, not a general certificate that every part of the incident has been resolved.
FAQ: Should I report first or secure my money first?
If money or financial access is at immediate risk, contact the financial institution promptly. Preserve what you can without delaying protection. Then complete the appropriate reports and account-recovery steps. Reporting helps document the incident, but it does not replace asking the affected bank or service to act on its own account.
FAQ: Can I put the scam documents into Cognivo?
Keep sensitive records in your own secure storage and submit evidence only through verified official channels. Cognivo is an organiser, not a secure evidence-submission service or incident-response provider. Use brief task labels and reference reminders rather than copying passwords, identity documents, banking details or private messages into the plan.
Put the next step into practice
Use your own confirmed figures and keep outstanding questions visible. Core tools are free, with no bank connection or compulsory account.
Open the Life-admin checklist ↗Sources and editorial notes
Sources checked 23 October 2026. Worked examples are fictional illustrations. Rules, eligibility and product terms can change; use the official source for your circumstances.
- Scamwatch: what to do after a scam ↗
- cyber.gov.au: recover compromised accounts ↗
- ACMA: remote-access requests ↗
- myGov: what to do after a scam ↗
- eSafety: online scams and reporting ↗
General information, not an individual financial or legal assessment. AI-assisted drafting with source checks; independent professional review has not been completed. How we prepare our guides · Suggest a correction