The first sentence matters.
Do not start with "why did you click that?"
Start with:
"You did the right thing by telling me. Let's secure things first."
You can ask questions later. The first job is containment.
What to do first
| Situation | First move |
|---|---|
| Money moved | Call the bank or payment provider |
| Password shared | Change it from the official site |
| One time code shared | Treat the account as compromised |
| Phone number transferred or no service | Call the carrier |
| Email opened a file | Disconnect, scan, and secure email |
| Child received threat | Save evidence and do not blame them |
What not to say
Avoid:
- "How could you fall for that?"
- "I told you this would happen."
- "Give me your phone."
- "You cannot use this anymore."
- "Why did you hide it?"
Those may feel understandable. They also teach the person to hide the next message.
A better script
Use this:
"I am glad you told me. We are going to stop the scammer, secure the account, and save screenshots. You are not the first person this happened to."
Then make the next step small.
If it was a parent
Read:
/us/blog/how-to-protect-parents-from-scams/
The goal is to protect without taking over. A parent needs a path to ask for help without feeling watched.
If it was a child or teen
Read:
/us/blog/how-to-protect-kids-from-scams/
This matters even more for sextortion threats, fake malware emails, and account takeover messages. The scammer wants the child alone and ashamed.
For prevention after recovery, set up spam text and email filtering on their iPhone together. Let them keep control of the phone while you make the safer settings easier to find.
Sources
- FTC, what to do if you were scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
- Research on emotions and help needs during financial scams: https://arxiv.org/abs/2604.06218
- FTC, reporting fraud: https://reportfraud.ftc.gov/