It happens more often than people admit. A convincing phone call, a moment of distraction, a fake website that looked exactly right — and suddenly you’ve shared your bank details or an OTP with someone you shouldn’t have. First: don’t panic, and don’t feel stupid. Scammers are professionals at this. What matters now is speed. This Asandada24 guide gives you the exact steps to take, in order, to protect your money.
Act in the First 10 Minutes: The Emergency Checklist
Time is everything. A scammer with your details will try to use them immediately. Do these in order:
1. Call Your Bank Right Now
This is step one, before anything else. Call your bank’s official helpline — the number on the back of your card or your bank’s official website, never a number from the suspicious call or message.
Tell them exactly what happened: “I shared my OTP / card details / login with someone I now believe is a scammer.” Ask them to:
- Block or freeze the affected card or account immediately
- Flag recent transactions for review
- Note the incident on your record (this helps with disputes later)
Most banks have 24/7 fraud helplines. Save that number in your phone today — you’ll thank yourself later. Asandada24 also suggests saving your bank’s fraud email address, since some banks let you report suspicious activity by email with screenshots attached, which creates a useful paper trail from the start. If you’re unsure how banking security normally works, our beginner’s guide to digital payments explains the systems protecting you.
2. Change Your Passwords and PINs
From a trusted device (not the one you were tricked on, if possible):
- Change your online banking password
- Change your banking app PIN
- If you reused that password anywhere else, change it there too
Use strong, unique passwords this time. Our guide on How to Create Strong Passwords and Protect Online Accounts has a method that actually works in real life.
3. Check Your Recent Transactions
Look through your last few days of transactions for anything you don’t recognize — including tiny amounts. Scammers often make a small test charge first to see if the details work. Screenshot everything suspicious with timestamps.
4. Enable Every Alert Available
If you hadn’t already, turn on SMS and app notifications for all transactions, logins from new devices, and password changes. You want to know the instant anything moves. Asandada24 considers this the single highest-value security setting most people skip. One of our writers caught a fraudulent login attempt at 2 AM purely because this alert woke her phone — the bank blocked it before a single cent moved.
What Exactly Did You Share? Why It Matters
Not all shared details are equally dangerous. Understanding what the scammer has helps you (and your bank) respond correctly:
Just an OTP
OTPs expire quickly — usually within minutes. If you shared one a while ago and nothing happened, the window has likely closed. Still call your bank, but the immediate danger may have passed. Change your passwords anyway.
Card Number, Expiry, and CVV Together
This is serious. With all three, someone can shop online in your name. Ask your bank to block the card and issue a new number — not just a replacement with the same number. A new number kills the stolen details completely.
Online Banking Username and Password
Also serious. The scammer could log in directly. Change the password immediately, enable two-factor authentication if you haven’t (see What Is Two-Factor Authentication and Why Is It Important?), and ask your bank to review recent login activity for unfamiliar devices or locations.
Your Full Identity Details (ID Number, Address, Date of Birth)
This enables identity theft beyond just your bank — new accounts opened in your name, loans applied for. Beyond calling your bank, consider placing a fraud alert with credit bureaus in your country and monitoring your credit report for the next several months.
How to Recognize You Were Scammed (If You’re Not Sure)
Sometimes people share details and only feel uneasy afterward. These are strong signs it was a scam:
- The caller created urgency: “Your account will be blocked in 10 minutes!”
- They asked for an OTP, password, or CVV — real banks never do this
- The website URL was slightly off (a letter swapped, an extra word)
- They called from an unknown number claiming to be “bank security”
- They asked you to install an app or share your screen
- They knew some of your details already (bought from data breaches) to seem legitimate
If two or more of these apply, treat it as a scam and follow the emergency steps above. Trust your gut — that uneasy feeling is usually right. Learn the full pattern library in How to Recognize and Avoid Online Scams.
Disputing Fraudulent Transactions
If money already left your account, you can usually get it back — but you need to act properly:
- Don’t lecture or blame. Shame makes people hide problems instead of fixing them.
- Walk them through the emergency checklist above, starting with the bank call. Offer to sit with them while they call.
- Help them change passwords and check transactions.
- If they’re elderly or very distressed, consider calling the bank together on speakerphone.
- Remind them that reporting helps catch the scammers and protects others.
- You may need the report number for insurance claims or extended fraud disputes
- It creates an official record that helps if the scammer is caught
- In some countries, banks require it for claims above a certain amount
- Cybercrime units specifically track these patterns — your report could connect to an existing investigation
In most countries, consumer protection rules limit your liability for unauthorized transactions if you report promptly. The key word is promptly — delays weaken your position. The major card networks publish their own zero-liability policies for cardholders, which you can review on visa.com and mastercard.com.
Protecting Yourself Going Forward
Once the immediate crisis is handled, use it as a turning point:
Adopt a zero-trust rule for OTPs. From now on: no matter who asks, no matter how urgent they sound, you never share an OTP. Not with “bank staff,” not with “police,” not with anyone. Make this a hard rule with no exceptions, and tell your family too — elderly relatives are prime targets.
Use virtual cards for online shopping. A virtual debit card with spending limits means even leaked details can’t do much damage. At Asandada24, we’ve started recommending these as standard practice, not just a nice extra.
Separate your banking email. Use one email address only for banking, different from your everyday email. It dramatically reduces the phishing that reaches you.
Review the full protection checklist in our How to Protect Your Bank Account When Using Mobile Apps — it covers every setting worth enabling, many of which take under a minute.
Helping Someone Else Who’s Been Scammed
If a parent, friend, or colleague tells you this happened to them:
The Asandada24 team has helped several readers through this exact situation. Every single one said the same thing afterward: “I wish I’d called the bank immediately instead of panicking for an hour first.” Speed beats perfection here.
When to Involve the Police
For larger amounts or identity theft, file a police report:
Keep copies of everything: the report, your bank’s complaint numbers, screenshots, and any correspondence.
Frequently Asked Questions
I shared an OTP an hour ago and nothing happened. Am I safe?
Probably, but don’t assume. OTPs typically expire within minutes, so the immediate window has likely closed. Still call your bank to report it, change your passwords, and watch your transactions closely for the next few weeks. Some scammers wait before acting.
Will the bank refund money stolen after I shared my details?
It depends on your country’s rules and how quickly you reported. Banks distinguish between unauthorized transactions (where you were tricked) and authorized ones. Reporting immediately and cooperating fully gives you the best chance. There’s no guaranteed outcome, which is why prevention matters so much — but do report, because many victims do get their money back.
Should I close my bank account entirely?
Usually not necessary. Blocking the compromised card and getting a new card number is enough in most cases. Only consider closing the account if your full identity details were stolen and the bank advises it. Discuss options with your bank’s fraud team — they’ll tell you what the situation actually requires.
How do scammers get my phone number in the first place?
Data breaches, leaked databases sold online, social media, and sometimes just random dialing. Having your number isn’t special — what matters is whether you engage. The moment a stranger asks for banking details or an OTP, the conversation is over. Hang up, block, and if they claimed to be your bank, call the real number to verify. For more on staying safe day to day, see our mobile banking protection guide and Google’s safety resources on support.google.com.