Your Parent Was Just Scammed. Here's the First 48 Hours.
A calm, ordered checklist for the two days after an older parent loses money to a scam — what's recoverable, who to call, and what to say.
If you're reading this in the middle of it, start here and read the rest later:
Call the institution that moved the money right now — before you finish this sentence, before you understand what happened, before you talk to your parent about it. Bank, card issuer, wire service, gift card company, crypto exchange. Recoverability drops steeply with time, and some windows are measured in hours rather than days. Understanding can wait. The phone call cannot.
Everything below assumes you've done that.
Hour one: stop the bleeding
Get them off the phone, and keep them off. If contact is ongoing, it's still active. These operations frequently keep victims on continuous calls for hours or days, precisely so the story can't be tested against anyone else. Nothing else you do works while the voice is still in their ear. Turn the phone off if that's what it takes.
Call the institution. Ask specifically for the fraud department, and use the phrase "unauthorized transfer, please attempt a recall." Wires can occasionally be recalled if flagged fast. ACH transfers sometimes can. Cryptocurrency almost never can, but exchanges can sometimes freeze a receiving wallet if it's still on their platform, so it's worth the call regardless of what you've read.
If gift cards were involved, call the card issuer directly — Apple, Google, Target, whoever. Funds are occasionally still on the card and occasionally recoverable. Keep the physical cards and the purchase receipts; both matter.
Freeze what's still exposed. If account numbers were shared or seen, freeze or close them. If a debit card was used, cancel it. If remote access software was installed, disconnect that computer from the internet and stop using it for anything financial.
Do not attempt to negotiate or reason with the scammer. People try. It never works, it confirms the number is live, and it invites a second wave.
Hours two to twelve: secure the perimeter
Change the email password first. Not the bank — the email. It's the reset mechanism for everything else, which makes it the highest-value target and the first thing to secure. Do it from a device that was not involved in the incident. Turn on multi-factor authentication while you're there.
Then the bank, then everything else. Any account sharing the compromised password. Check email settings for forwarding rules or new recovery addresses that shouldn't be there — a common quiet step after an account takeover.
Assume the computer is compromised if remote access was granted. Not "probably fine." Treat it as compromised until a qualified technician has examined or reimaged it. Whoever was on that machine may have taken saved passwords, browser sessions, and documents.
Freeze credit at all three bureaus. Equifax, Experian, TransUnion. Free, takes minutes online, reversible whenever needed. Do this even if the scam wasn't identity theft — personal information gathered in one incident circulates.
Write down everything while it's fresh. Names used, numbers called, exact times, dollar amounts, account numbers money went to, what was said. Screenshot the texts and emails before anything gets deleted. Memory degrades fast, especially under stress, and every institution and agency you deal with over the next month will ask for these details.
Day one to two: report it properly
Reporting rarely recovers money. Do it anyway, and understand why: it's a prerequisite for insurance, bank claims, and any future legal action; it's how patterns get traced across victims; and the same operators are running the same script against thousands of people, so your report is a data point in someone else's case.
FBI Internet Crime Complaint Center — ic3.gov. The primary federal channel for internet-enabled fraud. Include everything you documented.
FTC — ReportFraud.ftc.gov. Feeds the federal database used by law enforcement, and generates a recovery plan.
Local police. Many departments will treat it as a low-priority report, and it's still necessary — banks and insurers routinely ask for a police report number.
State Attorney General's consumer protection division. Often the most responsive on elder fraud specifically, and several states have dedicated units.
Adult Protective Services if a caregiver, family member, or anyone with ongoing access was involved, or if there's concern about capacity. This is a different situation from a remote scam and needs a different channel.
The Senate Special Committee on Aging fraud hotline at 1-855-303-9470, which can help direct you to the right agency when it isn't obvious.
If a specific institution facilitated it — a crypto ATM operator, a wire service, a money transfer agent — report to them directly and to the FTC. Some operators have their own fraud-reversal processes.
The conversation you're about to have
This is the part that isn't a checklist, and it's the part that matters most a year from now.
Say the true thing first. Something like: these people do this full time, they've run this script thousands of times, and it worked on you because it's designed to work. This isn't a comforting lie. Federal prosecutors, bank executives, and cybersecurity professionals have lost money to these schemes. The scripts are refined against tens of thousands of calls. That's the actual situation.
Do not ask how they didn't see it. In any of its forms — didn't you think it was strange, why didn't you call me, I've told you about this. Nobody has ever recovered from these sentences. And the practical cost is enormous: shame is the primary reason fraud goes unreported, and this conversation determines whether you find out about the next one in hour one or month three.
Expect grief, not just embarrassment. People who've been through this describe something closer to bereavement — particularly in romance and distress scams, where what's lost includes a relationship or a version of themselves they trusted. Some replay the calls for months. Depression following a large fraud loss is common and under-recognized. If it persists, it's worth raising with their physician, and it's a reasonable thing to name gently rather than wait out.
Watch for the second wave. Victim lists circulate. Within weeks, someone will call offering to recover the money for a fee — a "recovery service," a "fraud investigator," sometimes claiming to be from an agency you just reported to. It's the same operation making a second pass, and it works alarmingly often because the person is desperate to undo what happened. Say this out loud, in advance: no legitimate agency will ever charge you a fee to recover stolen funds.
And resist the impulse to take everything over. It's a natural response and it's usually the wrong one. Stripping a parent's financial autonomy after a loss compounds the humiliation, and it frequently drives the next problem underground — because now they really can't tell you. Add visibility and friction instead: transaction alerts, a second signature on transfers, an agreed callback rule. Structure that a competent adult would reasonably accept, not custody.
What actually gets recovered, honestly
Setting expectations correctly is kinder than optimism.
Credit card charges have the strongest protections and are frequently reversible.
Debit card and ACH transactions are sometimes recoverable if reported very quickly, with much shorter windows than most people expect.
Wire transfers are occasionally recallable within a short window, and rarely after. Speed is the only variable that matters.
Gift cards are sometimes recoverable if funds haven't been drained, which is why the call in the first hour matters so much.
Cryptocurrency is very rarely recoverable. This is the hardest one to say and it's better said early than discovered slowly.
Cash sent by courier or mail is effectively unrecoverable.
Banks are not generally obligated to reimburse transactions the customer authorized, even when the authorization was obtained through deception. There's active policy debate about whether that's the right rule, and some institutions exercise discretion, particularly for older customers and particularly when the case is documented well and reported fast. So report thoroughly, ask directly, and escalate if the first answer is no — but plan on the basis that the money may be gone.
Once the immediate work is done
Wait a week or two. Then do the boring, durable things: transaction alerts set low, multi-factor authentication on email and bank, a trusted contact on file, the four rules on an index card by the phone.
Do it together, and do it as a mutual arrangement rather than a set of restrictions. Something in the shape of: this happened to our family, so here's how we're both going to handle money calls from now on.
That's the version people keep. The other version gets quietly undone.
Frequently asked questions
Is it worth reporting a small loss? Yes. Small reports establish patterns across victims, and the same operators are almost never working a single household. Reporting also builds the paper trail you'll need if something larger surfaces later.
Can a lawyer help recover the money? Rarely, in cases where the funds have gone overseas — and be extremely cautious about anyone who contacts you offering recovery for a fee. An elder law attorney is genuinely useful for a different set of questions: capacity, financial protections going forward, and whether anyone with ongoing access to your parent was involved.
Should I report it if my parent doesn't want me to? This depends on capacity and on your legal standing, and it's a real dilemma rather than an easy call. You can report your own knowledge of a crime to the FTC and IC3. Overriding a competent adult's wishes has costs — to the relationship and to whether they tell you anything next time. If you believe capacity is genuinely impaired, that's a different situation and Adult Protective Services is the right channel.
How do I know if it's really over? Compromised information circulates for years, so the honest answer is that exposure doesn't fully end — which is an argument for durable structure rather than vigilance. Watch specifically for renewed secrecy about money or calls, which is the earliest sign that contact has resumed.
My parent seems fine but they're not acting like themselves. Common, and worth taking seriously. Large fraud losses produce a real grief response, and it often surfaces as withdrawal or flat affect rather than distress. If it persists beyond a few weeks, mention it to their physician.
Ommpo Care gives families ongoing visibility into a parent's household charges and billing, and gives your parent a live line to call before acting on something urgent. Plans from $49/month.
General information, not legal or financial advice. If you believe a crime has occurred, contact local law enforcement and report at ic3.gov and ReportFraud.ftc.gov.
