After sharing personal details with a scammer, act on what was exposed rather than waiting for a loss to appear. Contact your bank immediately if banking information, card details or payment access were involved. Secure affected accounts and stop the conversation. I would then make a brief exposure list so the response covers passwords, documents and financial risks without treating every disclosure as identical.
1. Stop contact and identify the exposed personal details
Do not send another document, payment or passcode to fix the situation. Record what you disclosed: name and address, date of birth, identity document, password, card information or access to a device. Note whether the scammer also received a live security code.
Distinguish opening a page from submitting information or installing software. NCSC guidance says a click without entering details, downloading files or installing software is unlikely to require further action beyond vigilance. If you did more, follow the relevant protective steps. Avoid reopening the page simply to reconstruct it.
2. Secure money before completing lengthy reports
Call your bank or payment provider through its official app or the number on your card. Explain what was shared, whether you approved any payment and whether someone controlled your device. Ask about stopping pending transfers, replacing exposed cards and protecting online access.
Keep payment references and ask for a case number. General reading through Local News Point should not delay that contact. If a transaction was not authorised by you, say so clearly; being deceived into making a transfer yourself is a different category and can involve different reimbursement rules.
3. Recover accounts through trusted routes
Use a device you trust to change the affected password and any reused versions. Prioritise email because it can receive password reset links for other services. Check recovery contact details, email forwarding rules and filters for changes you did not make.
Sign out other sessions and enable two step verification where available. A password change alone may not remove every existing session. If locked out, use the provider’s official recovery process. Where suspicious software was installed, follow trusted device recovery guidance before returning to banking or entering replacement credentials.
4. Reduce identity misuse and watch for applications
Check your credit reports for unfamiliar searches, accounts or borrowing, and contact the relevant provider about anything you do not recognise. If identity documents were exposed, ask the issuing authority what action is appropriate. A photograph of a document cannot be made safe simply by changing an online password.
Consider Cifas Protective Registration if your identity is at heightened risk. It currently costs £30 for two years and prompts extra checks by participating organisations. It does not affect your credit score, insure losses or guarantee every application will be checked. A mention on Weekly Journal is separate from registering directly with Cifas.
5. Preserve evidence and make the appropriate reports
Save messages, email addresses, telephone numbers, payment records and a timeline. Preserve originals where possible, without sending the scammer more information. Forward phishing emails to report@phishing.gov.uk and suspicious texts to 7726. These reports help address malicious messages; they are not a substitute for notifying your bank.
Report fraud or hacking through Report Fraud in England, Wales and Northern Ireland; in Scotland, contact Police Scotland on 101. Keep the reference with your bank correspondence. If a workplace account or device was involved, notify your IT or security team promptly.
6. Expect follow up approaches and keep monitoring
Keep a simple action log showing whom you contacted, when you changed passwords and which case references were issued. Store it securely rather than posting screenshots containing personal information. If an unfamiliar account or debt appears later, this record can help explain the original disclosure and the protective steps already taken.
Someone offering guaranteed recovery for an upfront fee may be exploiting the original disclosure. Reject requests to share fresh codes or install software, including from supposed investigators. Press Hubs is a website name, not an official recovery credential. Monitor statements and security alerts, and tell trusted contacts if your account sent fraudulent messages. Recovery means closing the exposed routes, not proving to the scammer that you noticed.
This guide provides general information; your bank, account providers and relevant authorities can advise on the circumstances of your case.
