Changing all passwords may not be the first step after a digital scam. The order depends on what is at risk at that moment:if there is money going out, the bank comes first; if the email was taken, it could be the key to recovering the other accounts; If a messenger is being used to ask for money, you must regain access and notify your contacts.
On May 26, 2026, CERT.br launched the issue Scams: Fell? Here's What to Do, dedicated to post-measures against scams and fraud. The material recommends acting quickly, interrupting contact, contesting transactions, changing exposed passwords, keeping evidence, reporting malicious accounts and monitoring financial life.
The 5, 15 and 30 minute schedule presented below is a practical editorial synthesis of these guidelines and procedures provided by the Central Bank, the Ministry of Justice and the platforms themselves. It does not represent an official deadline or guarantee recovery of amounts or accounts.
Before You Begin: Identify the Most Urgent Damage
Don't try to solve everything at the same time. Ask this question:
What can the scammer still do now?
| Situation identified | First step |
|---|---|
| Pix performed, unknown movement or card exposed | Immediately contact the bank via app, phone or official website |
| Hacked email or email password delivered to a fake page | Recover and protect email on a secure device |
| WhatsApp or other messenger taken | Start official recovery and alert contacts through another channel |
| Social network hacked or fake profile created | Use the platform's own recovery or report and notify contacts |
| Link opened, file executed or suspicious application installed | Temporarily disconnect the device from the internet and use another secure device |
| Just a suspicious conversation, no data or payments sent | Stop contact, block and save relevant records |
If more than one situation has occurred, the priority is usually to: stop active financial losses, protect the account that allows you to reset the others, and contain the use of your name against others.
In the first 5 minutes: stop the damage
1. Stop talking to the scammer
Do not send any more money, documents, codes, photos or explanations. Do not attempt to negotiate a return and do not pay alleged fees to clear a chargeback. Before blocking contact, take essential screenshots, as long as it doesn't prolong exposure.
CERT.br recommends cutting off contact, not sending any more information and blocking the profile or number.
2. If there has been financial movement, talk to the bank now
Open the bank app directly or use the phone number provided on the back of the card and on the official website. Do not use numbers, links or centers sent during the conversation with the scammer.
Inform:
- which transaction occurred;
- date, time and value;
- destination account or key;
- if the operation was done by you after being deceived or without your authorization;
- if cards, passwords or the banking application itself could be compromised.
For a Pix related to fraud, scam or crime, request a dispute and activation of the Special Return Mechanism, the MED. The Central Bank advises that the dispute be made immediately on the institution's application. The order can be registered within 80 days, but waiting reduces the practical possibility of finding available balance. The refund is not guaranteed and may be full, partial or non-existent, depending on the analysis and availability of resources.
If a card's data has been exposed, block or cancel the card and linked virtual cards. Also dispute purchases you don't recognize.
3. If you have installed an application or allowed remote access, isolate the device
Temporarily disable Wi-Fi and mobile data on the suspect device. Make your next bank contacts and password changes on another cell phone or computer that you consider safe.
The Ministry of Justice recommends interrupting contact and temporarily disconnecting the cell phone used to access a suspicious link from the internet. It also advises changing passwords on a secure device.
Do not format the device immediately just on impulse. First contain movements, preserve available evidence and assess the need for technical or police guidance.
Up to 15 minutes: recover the most important account
After containing an immediate financial loss, choose the block corresponding to the compromised account.
Bank: block access and check what is still pending
In addition to contesting transactions already carried out:
- change your banking password on a secure device;
- terminate or block unknown access, when the application offers this option;
- cancel active virtual cards;
- check scheduled transfers, debits and investment redemptions;
- note the protocol and time of service;
- enable notifications for each new movement.
The Ministry of Justice recommends reporting fraud, forwarding evidence, blocking access, canceling virtual cards and checking scheduled transactions.
Email: protect the account that recovers the others
Email deserves priority when it has been hacked, when your password has been entered on a fake page or when it is used to reset passwords for banks, stores and social networks.
On a secure device:
- Log in via the provider's official page or app.
- Use the official recovery process if you are unable to access.
- Create a new, long and unique password.
- Review recovery phone number and address.
- Check recent logins, connected devices, and authorized apps.
- End sessions you don't recognize.
- Enable two-step authentication.
- Then change the password for other services that used the same combination.
Google advises reviewing security events, connected devices, recovery methods, and apps with account access. It also recommends immediately changing the password for the account and services where the same password was reused.
Equivalent procedures exist in other providers. Apple, for example, advises changing or resetting your password, correcting security information, and removing unknown devices.
Caution: Changing the password without reviewing recovery methods, devices, and sessions may be insufficient if the attacker has already changed other settings.
Messenger: resume number and notify your contacts
If your WhatsApp account or another messenger is sending messages without your authorization:
- only use the recovery process offered by the application;
- reconfirm your number when prompted;
- never pass on the code received by SMS, call or email;
- review linked devices or sessions;
- enable two-step verification;
- notify relatives, clients and colleagues by call, SMS or other network;
- ask them not to make transfers or believe in recent orders.
On WhatsApp, the official recovery flow may ask for the full number and a six-digit code. You may also be asked for your two-step verification PIN.
CERT.br recommends alerting contacts when an account is hacked, a fake profile is created or someone claims that you changed your number and starts asking for Pix or bill payment.
Social network: recover, report and contain false identity
When the profile was hacked:
- look for the official option “my account was hacked”, “I forgot my password” or equivalent;
- recover the associated email first if it is also compromised;
- change password;
- terminate unknown sessions;
- remove applications that you have not authorized;
- enable two-step authentication;
- save messages and publications made by the attacker.
When a fake profile was created:
- record screenshots of profile, username and posts;
- copy the profile identifier or address to your evidence record;
- report the account for falsehood or imitation;
- ask close contacts to also use the reporting tool;
- notify publicly, without disclosing personal documents or bank details.
The Ministry of Justice recommends using the networks' own recovery tools, reporting cloned profiles, notifying friends and family and never paying a ransom to return the account.
Up to 30 minutes: organize the evidence and record what happened
Preserve evidence before it disappears
Create a folder and save when available:
- screenshots of conversations;
- phone number, username and profile involved;
- dates and times;
- Pix receipts, bills and payments;
- recipient data displayed on the receipt;
- emails and password change notifications;
- new login alerts;
- ads, pages or offers used in the scam;
- protocols, attendant names and platform responses;
- a chronological description of what happened.
Do not edit the images or delete conversations before saving the records. Also don't keep accessing suspicious links just to get new screenshots.
The CERT.br specification highlights that this evidence may be necessary for refund or refund requests, police reports, consumer complaints and possible legal action.
Register the police report
The police report does not replace immediate communication to the bank. If there is money in movement, the bank must be activated before or in parallel.
In the BO, include:
- how the contact started;
- what was requested;
- what information was delivered;
- amount and payment method;
- account, key or recipient;
- phone numbers and profiles;
- dates and times;
- banking protocols;
- evidence gathered.
Registration can be done in person or through the virtual police station in the state of residence, depending on local availability. The Ministry of Justice recommends attaching prints, call records, receipts and transfer data.
Report content within the platform itself
After saving the evidence, report the profile, ad, message or page used in the scam. Reporting may help stop the use of that account against others, although removal is not automatic or guaranteed.
First 30 minutes checklist
Within 5 minutes
- Stop contact.
- Contact the bank if there was a payment, Pix or access to the account.
- Block exposed cards.
- Disconnect the device with possible remote access from the internet.
- Switch to a secure device.
Within 15 minutes
- Recover and protect compromised email.
- Change exposed or reused passwords.
- End sessions and remove unknown devices.
- Recover the messenger and notify contacts.
- Start recovering or reporting the social network.
Within 30 minutes
- Save conversations, profiles, receipts and protocols.
- Register the police report.
- Report fraudulent accounts, ads or pages.
- Check new movements and logins.
- Note all measures already taken.
What not to do after falling for a scam
Don't pay more to “unlock” money or recover an account. Fee, deposit or ransom requests may be a continuation of the scam.
Do not look for the bank using a phone number sent in the suspicious message. Open the app yourself or check the back of the card and the official website.
Do not change passwords on a device that may be under remote control. Use another device until you have checked or reinstalled the equipment.
Do not approve login notifications that you did not initiate. CERT.br advises you to refuse unknown authentication requests.
Do not believe in a return promise guaranteed by MED. The mechanism increases the possibility of recovery, but depends on the analysis of the case and the existence of resources.
Do not immediately delete the device and all messages. Containment is urgent, but some information may be needed as proof. CERT.br recommends reinstalling or restoring devices when malware is suspected; This step must occur after preserving what is relevant and, in complex cases, with technical or police guidance.
After the first 30 minutes
Continue tracking bills, invoices, logins and notifications. If documents or personal data have been exposed, watch for attempts to open accounts, loans, or misuse of identity.
CERT.br recommends monitoring transactions, active sessions and financial records in the Central Bank Registry. It also suggests contacting Procon, registering a complaint with the Central Bank or seeking legal advice when the problem is not resolved.
If the scam involved more than one account, proceed by dependency:
- email and phone number;
- banks and payment methods;
- password managers and cloud storage;
- messengers;
- social networks;
- stores, subscriptions and other services.
When complete, create unique passwords, keep two-step authentication active, and periodically review devices, authorized applications, and recovery information.
Open the official application or website of the compromised bank or platform now. Then, save this checklist in an accessible location — an organized response can reduce the scope of the scam and facilitate recovery requests.
