Checklist · Consumer Protection

Responding to Fraud, a Scam, or Financial Exploitation: A Practical Checklist

15 U.S.C. § 1693

Type: Checklist
Jurisdiction: National
Date: 2026-03-26
Topic: Consumer Protection

This checklist runs a fraud loss from the first hour to civil recovery. Phase 1 is the first hour, where most recoverable money is either recovered or lost, and Phase 2 is the written confirmation and preservation that every later protection depends on. Phases 3 and 4 cover credentials, device security, credit freezes, and the identity theft toolkit. Phase 5 covers the reports and why each one matters, and Phase 6 covers the payment-specific routes, whose odds differ by orders of magnitude. Phase 7 covers elder exploitation and the contemporaneous documentation that prevents a second injury years later at the Medicaid look-back. Phases 8 and 9 cover civil claims, collection, and prevention going forward. Four model letters, a recovery table, and a ranked failure-mode list close the checklist.

Responding to Fraud, a Scam, or Financial Exploitation: A Practical Checklist

Consumer Protection > Fraud and Scams | Published 26 March 2026 - Updated 19 July 2026 | UpLaw - uplaw.us

Phase 1 is measured in hours. If you read nothing else on this page, read Phase 1 and make the first call before you finish the sentence you are on.

Keywords: first hour, recall, error notice, freeze, reports, payment routes, exploitation, claims

How to use this checklist

Nine phases with - [ ] items and a Why it matters, and the traps note under each.

Doctrine is in Consumer Fraud and Financial Exploitation: A Comprehensive Guide to Prevention, Recovery, and Remedies. The narrative is The Call That Sounds Right: How Modern Fraud Works and What Can Actually Be Recovered. The forms are in The Fraud Response and Financial Exploitation Toolkit.

Phase 1 — The first hour

[ ] Determine how the money moved — credit card · debit card · payment app · ACH · wire · gift card · cryptocurrency · cash · marketplace purchase.
[ ] Call the sending institution now.
[ ] For a wire: request a recall, by name, immediately.
[ ] For a debit card or bank-linked app: report an error under 15 U.S.C. § 1693f and request provisional credit.
[ ] For a credit card: assert a billing error under 15 U.S.C. § 1666 and note the liability cap at 15 U.S.C. § 1643.
[ ] Get a case number and the representative's name.
[ ] Ask the institution to flag the receiving account.
[ ] Call the receiving institution if identifiable.
[ ] For gift cards, call the issuer with the card numbers — the balance is occasionally frozen.
[ ] For cryptocurrency, record the wallet addresses and transaction hashes.
[ ] Do not wait to gather documents. Call first; document second.

Why it matters, and the traps. The payment method determines the remedy, and the window for the weakest methods is measured in hours.

The trap is preparation. People assemble a file before calling. Every hour spent preparing reduces the recoverable amount, because funds are moved onward within the first hour by design.

Phase 2 — Written confirmation and preservation

[ ] Send written confirmation of every oral report the same day.
[ ] Reference the case number and the representative's name.
[ ] Send by a method that proves delivery.
[ ] Note the sixty-day error-resolution deadline from the statement under 15 U.S.C. § 1693f.
[ ] Note the escalating liability tiers under 15 U.S.C. § 1693g — two business days for the lowest cap.
[ ] Do not delete anything. Screenshot every message, text, and email.
[ ] Save emails with full headers.
[ ] Record the phone numbers, the caller ID display, and the times of each call.
[ ] Save transaction confirmations, receipts, and account statements.
[ ] Write a timeline the same week — what was said, by whom, at what time, and which employees were involved.

Why it matters, and the traps. A verbal report is contested later; a datable written notice is not. Every protection in Phase 1 depends on when notice was given.

And the preservation trap is emotional. The instinct after a scam is to erase an embarrassing exchange. That exchange is the evidence — of the deception, of the identity of the perpetrator, and of the secrecy instruction that establishes the fraud.

Phase 3 — Credentials and devices

[ ] Change the email password first — email is the master key to every other account.
[ ] Then change banking, brokerage, and payment app credentials.
[ ] Enable two-factor authentication everywhere, preferring an authenticator app.
[ ] Uninstall any remote access software that was installed.
[ ] Assume any device that was remotely accessed is compromised; have it examined.
[ ] Check for mail forwarding, email forwarding rules, and changed recovery addresses.
[ ] Check for new devices or sessions authorized on financial accounts.
[ ] Check for changed beneficiary designations or added authorized users.
[ ] Review recent statements for transactions not yet noticed.
[ ] Notify any employer if a work account or work device was involved.

Why it matters, and the traps. Remote access means every credential typed on that device is compromised, not just the one used.

And the forwarding-rule trap is the quiet one. A fraudster who adds an email forwarding rule continues to see everything — password resets, statements, and the fraud alerts — long after the passwords are changed. Check the rules, not just the password.

Phase 4 — Credit freeze and identity theft

[ ] Place a credit freeze at each nationwide consumer reporting agency — free, and stronger than an alert.
[ ] Consider a freeze at specialty reporting agencies as well.
[ ] Obtain the file disclosure under 15 U.S.C. § 1681g.
[ ] With an identity theft report, request the application and transaction records for the fraudulent accounts.
[ ] Dispute every fraudulent item under 15 U.S.C. § 1681i.
[ ] Assert the accuracy duty at 15 U.S.C. § 1681e and the reporting limits at 15 U.S.C. § 1681c.
[ ] Check who has pulled the report under 15 U.S.C. § 1681b.
[ ] When collectors call, send a validation request under 15 U.S.C. § 1692g and screen conduct under 15 U.S.C. § 1692e.
[ ] Note liability provisions at 15 U.S.C. § 1681n, 15 U.S.C. § 1681o, and 15 U.S.C. § 1692k.
[ ] For any federal suit, plead dissemination and harm per Spokeo and TransUnion.

Why it matters, and the traps. The freeze is free, takes minutes, and prevents new-account identity theft outright. It is the single highest-value protective act available.

The application records are the underused right. With an identity theft report, a victim can obtain the documents the fraudster submitted — which frequently identify them.

Phase 5 — The reports

[ ] Local police — required by many institutions before they will act, and by several identity theft rights.
[ ] The Federal Trade Commission — the federal clearinghouse; generates an identity theft report.
[ ] The FBI's internet crime complaint center — the escalation channel for wire recalls and cryptocurrency.
[ ] The state attorney general — UDAP enforcement and sometimes mediation.
[ ] Adult protective services — where an older or vulnerable adult is involved.
[ ] The state securities or insurance regulator — where an investment or policy is involved.
[ ] The consumer financial protection complaint process — produces written institution responses.
[ ] The platform or marketplace — purchase protection and account bans.
[ ] Keep a copy of every report and every confirmation number.
[ ] Note that reports do not extend any of the Phase 1 deadlines.

Why it matters, and the traps. Each report serves a different purpose, and several are prerequisites for the others — the police report in particular.

The trap is substitution. A criminal report is not a recovery mechanism. It builds patterns, it occasionally produces seizures, and it satisfies institutional requirements. It does not get the money back, and it must never delay Phase 1.

Phase 6 — Payment-specific routes

[ ] Credit card → billing error under 15 U.S.C. § 1666; network chargeback through the issuer; note 12 C.F.R. Part 1026.
[ ] Debit card → EFTA error resolution; provisional credit; the two-business-day tier.
[ ] Bank-linked app → report as an error anyway; then the platform's own dispute process.
[ ] ACH → EFTA where consumer-initiated; ask about a return.
[ ] Wire → recall request; FBI complaint center escalation; contact the receiving bank directly.
[ ] Gift card → issuer, with the numbers, immediately.
[ ] Cryptocurrency → report addresses and hashes; exchanges do freeze on law enforcement request.
[ ] Marketplace purchase → the platform's purchase protection program, which is frequently the best available remedy.
[ ] Any check involved → notify the bank of a forged or altered instrument immediately.
[ ] For a home-solicited sale, check the cooling-off right at 16 C.F.R. Part 429; for home-secured credit, rescission at 15 U.S.C. § 1635.

Why it matters, and the traps. The odds differ by orders of magnitude across these rows, and people routinely pursue the hopeless route while ignoring the available one.

The most commonly missed remedy is the marketplace platform's purchase protection, because the victim is focused on the bank.

Phase 7 — Elder or vulnerable adult exploitation

[ ] Report to adult protective services.
[ ] Notify the bank and brokerage in writing that transfers were procured by exploitation.
[ ] Request the complete transaction and communication record from each institution.
[ ] Determine whether a trusted contact was on file and whether it was used.
[ ] Ask whether the institution's elder exploitation hold was available and applied.
[ ] If an agent under a power of attorney is involved: revoke it, demand an accounting, and consider surcharge.
[ ] Document the undue influence indicators: isolation · dependency · a confidential relationship · the influencer's participation in the transaction · a sudden change in a long-standing plan · unnatural disposition · secrecy and haste.
[ ] Obtain a capacity assessment where relevant.
[ ] Consider guardianship or conservatorship where capacity is genuinely lost.
[ ] Document everything contemporaneously for the Medicaid look-back under 42 U.S.C. § 1396p.

Why it matters, and the traps. The last item is the one nobody anticipates. Assets moved out of an older adult's control are treated as transfers in the five-year look-back — so a person defrauded of their savings can be penalized for the loss when they later need long-term care.

Contemporaneous documentation — the reports, the adult protective services file, the civil filing — is what supports an undue hardship waiver years later. It is the strongest practical reason to file the reports even where the family does not want a prosecution. See Applying for Medicaid Long-Term Care Coverage: A Practical Checklist.

Phase 8 — Civil claims and collection

[ ] Identify whether there is a reachable defendant.
[ ] Start with the state UDAP statute — lower proof standard, statutory damages, fee shifting.
[ ] For an agent, trustee, or caregiver: breach of fiduciary duty, seeking an accounting first.
[ ] Undue influence and capacity, to set aside transfers, deeds, and beneficiary changes.
[ ] Conversion, where identifiable property was taken.
[ ] Common-law fraud, if the elements are provable — usually harder and unnecessary.
[ ] Claims against institutions, where the transaction was wildly out of pattern, indicia of coercion were visible, a trusted contact was not called, or 15 U.S.C. § 1693f was not followed.
[ ] Civil RICO under 18 U.S.C. § 1964, where a pattern under 18 U.S.C. § 1962 can be pleaded.
[ ] Small claims court for losses within the limit against an identifiable local defendant.
[ ] Plan for collection before filing — see Enforcing a Money Judgment: A Comprehensive Guide to Discovery, Liens, Levy, and Fraudulent Transfer.
[ ] Calendar the limitations period for each claim.

Why it matters, and the traps. A judgment is not money. Identify assets before filing, not after.

And the most common error is reaching for common-law fraud when the state UDAP statute offers a lower standard, statutory damages, and fees.

Phase 9 — Prevention going forward

[ ] Adopt the rule: "I hang up and call the number on my statement."
[ ] Never grant remote access to a device.
[ ] Use a credit card for any transaction with a stranger.
[ ] Treat any secrecy instruction as conclusive proof of fraud.
[ ] Keep the credit freeze in place.
[ ] Verify changed payment instructions by phone, to a number already on file.
[ ] Set up a trusted contact at every bank and brokerage for an older adult.
[ ] Arrange for a named person to review mail and statements monthly.
[ ] Enable transaction alerts on every account.
[ ] Warn about recovery scams — anyone who contacts the victim offering to recover the lost funds for a fee is a second fraud.

Why it matters, and the traps. Exploitation depends on isolation, and a second set of eyes is the thing isolation cannot survive.

And the recovery scam is not a hypothetical. Victim lists circulate. A person who has just lost money is the most targeted person there is, and the second loss is frequently larger than the first.

Model letters

A. Wire recall request

"Re: [customer], account []. **I request an immediate recall of the wire transfer sent on [date] at approximately [time], in the amount of $[], to [beneficiary] at [receiving institution], reference [___].** The transfer was induced by fraud. Please initiate the recall now, notify the receiving institution, and confirm in writing what action has been taken and when. Please also provide the case number and the name of the representative handling this request."

B. EFTA error notice

"Re: [customer], account []. This is written notice of an error under the Electronic Fund Transfer Act. The transfer(s) described below were not authorized by me: [date, amount, payee]. I first learned of the loss on [date] and reported it by telephone on [date] to [representative], case number []. I request a prompt investigation, provisional credit to my account pending the investigation, and a written explanation of the results, together with copies of all documents relied upon."

C. Credit reporting dispute

"Re: [consumer], file [___]. The following items are the result of identity theft and are disputed: [account, creditor, amount]. Enclosed: a copy of my identity theft report and police report [number], and proof of identity. I request that these items be blocked and that you notify the furnishers. I further request, pursuant to my rights as an identity theft victim, copies of the application and transaction records relating to each fraudulent account."

D. Exploitation notice to a financial institution

"Re: [account holder], account []. I am writing to report that the following transfers from this account were procured by financial exploitation: [dates and amounts]. [Account holder] is [age], and [describe: was isolated from family by the recipient / relied on the recipient for care and transportation / has a diagnosed cognitive impairment]. **I request that you: (1) place a hold on further disbursements; (2) provide the complete transaction and communication record for the past [] months; (3) advise whether a trusted contact was on file and whether it was contacted; and (4) advise what steps were taken under your elder financial exploitation procedures.** A report has been filed with adult protective services."

The recovery table

How the money moved	Protection	Odds	Window
Credit card	15 U.S.C. § 1643 · § 1666	High	60 days from the statement
Debit — unauthorized	15 U.S.C. § 1693f · § 1693g	High if fast	2 business days for the lowest cap
Debit / app — induced	Generally none	Low	Hours
ACH	EFTA where consumer-initiated	Moderate	Days
Wire	None	Low, falling hourly	Hours
Payment app to a stranger	Generally none	Low	Hours
Gift card	None	Very low	Immediately
Cryptocurrency	None	Very low	Report the addresses
Cash	None	None	—
Marketplace purchase	Platform protection	Moderate to high	Per the platform

Read down the last column. Every row without a statutory protection is a race, and the race is usually over by the end of the first day.

Who does what

The victim, or whoever is helping them. Phase 1, immediately. Nothing else in this checklist matters as much, and none of it requires a professional.

A family member. Phase 3's account security and Phase 9's structural measures — the trusted contact and the monthly review. And the conversation: begin with "how did the money move," not with how it happened. Shame produces delay, and delay is what makes losses permanent.

A consumer lawyer. Phase 8's UDAP claim and the institutional claims, which turn on the facts preserved in Phase 2 — see Consumer Protection Law: A Comprehensive Guide to the FDCPA, FCRA, TCPA, and State UDAP Statutes and The Consumer Protection and Credit Toolkit.

An elder law attorney. Phase 7, including the power of attorney revocation, the accounting, and the Medicaid documentation — see Elder Law: A Comprehensive Guide to Incapacity Planning, Medicaid, and Guardianship and The Elder Law and Incapacity Planning Toolkit.

Adult protective services. Free, investigative, and capable of intervening where a family cannot.

And where identity theft is involved, the credit reporting mechanics are in Consumer Credit Reporting and Debt Collection: A Comprehensive Guide to the FCRA, FDCPA, and Identity Theft Remedies and The Consumer Debt and Credit Reporting Toolkit.

Failure modes, ranked

Delay caused by embarrassment. The largest single cause of unrecovered loss.
Preparing a file before making the first call.
Reporting only orally, leaving no datable notice.
Missing the two-business-day tier, or the sixty-day outer limit entirely.
Deleting the messages out of shame.
Not freezing credit after identifying information was disclosed.
Not checking email forwarding rules after a credential compromise.
Pursuing the bank while ignoring the marketplace platform's purchase protection.
Treating a police report as the recovery mechanism.
Reaching for common-law fraud instead of the state UDAP statute.
In an exploitation case, not documenting contemporaneously — and meeting the Medicaid look-back years later with nothing.
Falling for a recovery scam after the first loss.
Suing without a collection plan.
Not setting up a trusted contact for an older relative, which is free and takes minutes.

Items 1 through 4 are all about the first day, and they account for nearly all of the recoverable money that is never recovered.

Responding to Fraud, a Scam, or Financial Exploitation: A Practical Checklist

How to use this checklist

Phase 1 — The first hour

Phase 2 — Written confirmation and preservation

Phase 3 — Credentials and devices

Phase 4 — Credit freeze and identity theft

Phase 5 — The reports

Phase 6 — Payment-specific routes

Phase 7 — Elder or vulnerable adult exploitation

Phase 8 — Civil claims and collection

Phase 9 — Prevention going forward

Model letters

A. Wire recall request

B. EFTA error notice

C. Credit reporting dispute

D. Exploitation notice to a financial institution

The recovery table

Who does what

Failure modes, ranked

Related Documents