Already clicked or shared something?

1Match the response to what happened

A click alone does not prove that your device is infected. What you did next matters: entering a password, downloading a file, allowing remote access or sending money each changes the next step.

1. Money sent: contact your financial institution or payment provider immediately through known details. Ask what can be stopped or secured.
2. Card or banking details shared: contact your financial institution immediately using known details, even without a payment or visible charge, and ask what needs to be secured.
3. Password or code shared: use official account recovery on a trusted device. Change exposed or reused passwords and review account protection.
4. Opened a suspicious attachment or installed something: stop using that file or app. Get device-check guidance from the device maker or a technician you independently trust; do not install a “fix” offered by the suspicious message. Use another trusted device for sensitive accounts while it is checked.
5. Remote access allowed: interrupt the connection and get trusted technical help; avoid sensitive tasks on the affected device until it has been checked.

Sources:[1][2][3]

2Preserve useful information

Keep messages, receipts, transaction details and dates if you can do so safely. Do not keep engaging with the suspected scammer to collect more.

1. Contact local police if you have been a victim and ask for a file number.
2. Report fraud or cybercrime through the official Canadian reporting service.
3. If identity information was misused, follow CAFC guidance about accounts and the two credit bureaus.

Sources:[1][4]

3Watch for a second approach

Someone may offer to recover the money for an advance fee. Prior knowledge of what happened does not make them trustworthy. Do not pay a recovery fee to an unsolicited contact or give them remote access.

Sources:[1][5]