A scam can leave you unsure whether to protect your money, your account or your device first. Start with the action that could prevent further loss. A clicked link alone is not a safety verdict, while credentials, payment details or remote access can require more urgent steps.
Start here
Start with the safest next action
Pause contact with the suspected scammer, use an independent channel and work through the path that matches what happened.
Bank and help priorityStart here when money, payment details or identity information may be exposed.Read this part
Account accessUse this path when credentials, recovery details or remote access may be involved.Read this part
Incident recordRecord what you observed after urgent protective steps.Read this part
Protect money and get independent help
If you transferred money, shared card details or approved a payment, contact the bank or card provider immediately through an official channel. Ask what protective action is available, such as stopping or reviewing a transaction. The provider decides what can be done; no outcome is guaranteed. See Scamwatch’s advice on what to do after a scam.
Do not use a phone number, link or reply address supplied by the suspicious contact. If the situation involves cybercrime, you can report it through ReportCyber. Scamwatch also accepts scam reports. If there is an immediate threat to life or risk of harm, call 000. These reporting pathways are not a promise that an individual loss will be recovered.
Match the response to what happened
A suspicious message or clicked link may be an exposure to assess, not proof that an account or device was compromised. Urgency increases if you entered a password, payment detail or verification code; installed software; approved a sign-in; or gave someone remote access.
- Clicked only: stop interacting, close the page and avoid reopening the link to investigate.
- Credentials shared: use a trusted device and the provider’s official recovery or security process.
- Payment information shared: contact the bank or card provider immediately.
- Remote access or software installed: end the session if safe, contact the bank if financial information was accessible, and seek appropriate device support.
For remote-access scams, Cyber.gov.au advises ending suspicious calls and contacting the organisation independently. Removing a tool alone is not proof that a device is clean.
Verify an unexpected support contact before sharing access
If someone contacts you unexpectedly claiming to be from a bank, phone company, software provider or government service, pause before sharing your screen, installing software, reading out a code or approving a sign-in. A familiar logo, caller ID or a detail about you does not prove who is calling.
- End the unexpected contact politely. Do not use its phone number, link or reply address to verify it.
- Find the organisation’s contact details independently from an official app, card, statement or website you type yourself.
- Ask the organisation through that independent channel whether it contacted you and what action, if any, is actually required.
- If you already shared access, a password, payment detail or code, stop the conversation and follow the incident path in this guide.
Legitimate support can wait while you verify it independently. Do not let a caller’s urgency turn a routine support question into remote access or account recovery performed for you.
Bring in a trusted person
Ask someone you trust to sit with you while you check official contact details, review what was shared and write down decisions. A second person can help slow down pressure, especially when a caller demands secrecy, urgency or another payment.
If you need specialist support after a cyber incident, Scamwatch identifies IDCARE as a support option. Use official websites and phone numbers rather than details supplied by the caller. Keep the support focused on practical next steps, not on proving a theory about the scammer.
Record, report and watch for follow-up scams
After urgent money and account actions, make a private timeline. Note when contact occurred, what you observed, what you shared or installed in broad categories, which provider you contacted and any report or case reference. Keep original messages where safe, but do not reopen suspicious links or continue the conversation.
Be cautious of anyone who contacts you later promising guaranteed recovery, refunds or special access for an upfront fee. A follow-up offer can be another scam. Recheck important accounts through their official security pages and tell your trusted contact if the situation changes.
For further steps, use Scamwatch’s advice after a scam and, where appropriate, ReportCyber. If someone had remote access to your device, also see Australian Cyber Security Centre guidance on remote-access scams.
What to read next
If you’d rather have local help, see our onsite scam and account-security assessment.