What to do in the first hours after a scam, according to GASA

According to the Global Anti-Scam Alliance, the first hours after a scam matter more than most people realise. Its Consumer Education Working Group has built a 5-Step Response Plan setting out what to do immediately, and what to check in the days after.

The plan exists because the period right after a scam is when further harm is still preventable. Accounts can still be locked. Devices can still be checked. Contacts can still be warned before a criminal reuses the same story on them. The five immediate steps are designed to be done in that window, not weeks later.

What the immediate steps protect

The response plan sets out five actions to prioritise straight after a scam. GASA does not publish the exact wording of each step in this release, but it groups them around limiting further harm, protecting compromised accounts and personal information, and starting recovery. Anyone who has just realised they were scammed should treat these as the first job, before anything else.

What comes after the first steps

Once the immediate actions are done, a second checklist covers risks that can remain. This includes reporting the scam through the platform the criminal used to make contact, checking devices for malicious software, freezing credit, and taking action if personal identifying information was exposed. GASA also recommends watching accounts for unusual activity, telling close contacts that messages sent from the victim's name or number may not be genuine, and reviewing privacy settings on social media.

That last point matters more than it first looks. A scam rarely ends with one victim. Criminals often use information or access gained in one scam to approach the same person again, or to approach people connected to them. Warning contacts is not a courtesy step, it closes a route the criminal is likely to try next.

The second scam to watch for

GASA's plan flags a specific follow-up risk: criminals contacting people who have already been scammed, offering to recover the lost money, investigate the case, provide legal help, or retrieve stolen cryptocurrency, for an upfront fee. The plan's advice here is direct. Verify the identity of anyone who makes unsolicited contact, and treat any promise to recover funds in exchange for payment first as a warning sign, not an offer of help.

The sequence in the plan shows something worth acting on: being scammed once raises the odds of being targeted a second time, by someone using the first scam as the opening line. The longer-term guidance, a password manager for strong unique passwords and multi-factor authentication turned on wherever it is offered, is aimed at closing that door before it opens.

The full plan is designed to be shared. GASA says it can be distributed freely to scam victims and the wider public, and organisations can adapt its visual style while keeping the original content and the reference to the Global Anti-Scam Alliance.