The moment you understand that the broker, the trading platform, or the smooth account manager was a fraud, you are in a race. Stolen funds do not sit still. Fiat moves through layered mule accounts within hours, and crypto is split across fresh wallets and pushed toward exchanges almost as fast. What you do in the first 72 hours often determines whether a recovery effort has anything left to chase. This checklist sets out the steps in priority order, with the legal and banking mechanisms behind each one. It is general information and not legal advice, outcomes vary by case, and no recovery can ever be guaranteed.
Hour 0: Stop every further payment immediately
The single most common way victims lose more money is by continuing to pay after the scam has started to unravel. If you have recurring card authorisations, standing orders, or saved payment details on the platform, cancel them now. Do not log in to make a final withdrawal that the platform claims is pending. Do not send one more deposit because support says the previous transfer failed. Every additional franc you send after this point is money that will almost certainly never come back.
Hour 0: Never pay a release fee, tax, or insurance charge
When you try to withdraw, a fraudulent platform will often invent a barrier. You are told you must first pay a withdrawal tax, an anti money laundering clearance fee, a liquidity bond, or insurance against transfer risk. This is the same scam continuing under a new label. There is no legitimate financial product on earth where you must send fresh money to release money that is already yours. Paying a release fee does not unlock anything. It simply adds another loss, and it flags you as a paying target, which is how victims later receive a second wave of contact from fake recovery agents. If anyone demands an upfront fee to free your funds, treat that as confirmation of fraud, not as a hurdle to clear.
Hours 0 to 6: Screenshot and preserve everything
Evidence decays. Platforms take their sites offline, chat histories vanish, and account managers block your number. Before any of that happens, capture it all. Screenshot your account dashboard showing the supposed balance, the deposit and withdrawal history, and any open positions. Save the full email thread, the WhatsApp or Telegram chats, the names and phone numbers used, and the website URLs. Photograph or export your bank and card statements showing each transfer with dates and amounts. Where you can, save original files rather than only screenshots, because metadata can matter later. If money left by card or bank, write down the exact merchant descriptor that appears on your statement. If it left by crypto, record the wallet addresses you sent to and, critically, the transaction hashes (the long identifiers that let an analyst trace each movement on the blockchain). A clean, dated evidence pack is the foundation of every later step, from a chargeback claim to a court application.
Hours 0 to 12: Contact your bank and card issuer
Call the fraud line on the back of your card, not a general number, and ask them to freeze the card and flag the transactions as fraudulent. Speed matters here for a specific reason. If you paid by debit or credit card, you may be able to raise a chargeback through the card scheme. Visa and Mastercard both operate fraud and dispute reason codes that can apply to investment scams, for example Mastercard reason code 4837 (no cardholder authorisation) and 4863 (cardholder does not recognise), and Visa dispute condition 13.5 and the 10.4 fraud category. These claims sit on tight deadlines, often counted from the transaction or statement date, so raising them early protects your rights even if the investigation takes longer. If you paid by bank transfer, ask whether a recall or an indemnity claim against the receiving bank is possible, and insist that your bank notes the report in writing. Get a reference number for everything.
Hours 0 to 24: Lock down your own security
Many platforms ask victims to install remote access software such as screen sharing or remote desktop tools so the account manager can help you trade. If you did this, the fraudster may have seen your banking logins and your device. Uninstall any remote access software, change the passwords on your email and online banking from a different, clean device, and enable two factor authentication everywhere. If you shared identity documents, be alert to the risk of identity misuse in the weeks ahead.
Hours 12 to 48: Report to the police and regulators
File a criminal complaint. In Switzerland this engages StGB Art. 146, the offence of fraud, and a formal report (Strafanzeige) creates an official record that supports later civil and banking steps. Report to the police in your own canton or country. Keep the case number. Alongside the police, report to the relevant financial regulator, because regulators track fraudulent operators and your report may connect to existing intelligence. Depending on where the platform claimed to be based, that could mean FINMA in Switzerland, BaFin in Germany, the FCA in the United Kingdom, or CySEC in Cyprus, where many offshore broker brands route their licensing claims. A regulatory complaint rarely returns money by itself, but it builds the paper trail.
Hours 24 to 72: Contact a recovery lawyer
This is the point to bring in professional help, and it is genuinely time sensitive. A specialist can assess which routes are realistic before the trail goes cold. Where funds left by card, the focus is on the chargeback window. Where funds left by bank transfer, a lawyer can move quickly on cross border freezing tools. In Switzerland, a SchKG Art. 271 Arrest can freeze assets held here, and within the EU the European Account Preservation Order can freeze bank accounts across member states before the other side has a chance to react. To find out who actually holds the money, courts can grant disclosure against banks and intermediaries, for example through a Norwich Pharmacal order in common law jurisdictions, which compels an innocent third party such as a bank or exchange to reveal the identity behind an account.
For crypto cases, tracing is its own discipline. Analysts use blockchain clustering to group wallets that are controlled by the same actor, then follow the flow to the point where it reaches a regulated exchange. At that exchange, a court order can trigger KYC unmasking, linking the wallet to the real identity behind the customer account. None of this works if the hashes and addresses were never recorded, which is why the evidence step above matters so much. You can read more about how we approach on chain crypto tracing and forex and CFD scam recovery, and our step by step recovery process explains what to expect after first contact.
A short word on second scams
After a loss, you may be contacted by someone claiming to be a recovery agent, a regulator, or even law enforcement, offering to get your money back for an upfront fee. This is a recovery scam, and it targets people precisely when they are most vulnerable. A legitimate firm explains its fee structure transparently and never guarantees a result. If you are unsure whether contact is genuine, do not pay, and speak to a regulated lawyer first. You can always reach our team through our confidential contact page.
The hardest part of being defrauded is the feeling that there is nothing to be done. Often there is, but the window is narrow. Move through this list in order, keep every record, and get specialist eyes on the case while the money may still be traceable.
