The call ended a few minutes ago, and something feels wrong. You read out your card number to “the bank,” or confirmed your Social Security number for “a refund,” or let a “technician” connect to your computer. Now you’re wondering how bad it is.
That depends on exactly what you shared. Anything that can move money comes first: card numbers, banking logins, one-time codes and remote access. Identity numbers come next, and the rest is mostly about watching for what follows. Done in that order, most of the damage can be contained.
End the call before anything else
If you’re still in contact, stop. Hang up, stop replying to texts, and don’t call back any number the person gave you, even to “cancel.” Scammers often ring again within minutes with a new story: the transfer failed, a second agent needs to “verify” you, your account has been “frozen for your protection.” Each call is an attempt to get more.
If they still have remote access to a computer or phone, disconnect it from the internet now. Turn off Wi-Fi or unplug the cable.
Skip the embarrassment. These scripts are written and tested by professionals, and identity theft is common: according to the FTC’s 2025 data, as summarized by Experian, people filed 1,358,253 identity theft reports in 2025. In Canada, identity fraud was the most-reported fraud type in the CAFC’s 2025 figures, with 8,403 reports. Speed matters far more than how it happened.
List what you gave out, then sort it
Write down everything you shared, as precisely as you can. Then use the table to set priorities. The top rows can be used against you within hours; the lower rows matter over weeks and months.
If you can’t remember exactly what you said, assume the worst for anything the caller asked about. A stressful call blurs details, and it costs little to cancel a card that turns out to be safe.
A card or bank account number
Call the bank or card issuer on the number printed on the back of your card or on your statement. The FTC’s advice for card payments is to “Report it to the credit card issuer immediately” and ask for a refund. Ask the bank to cancel the card, flag the account and go through recent transactions with you. If you gave a checking account and routing number, ask what monitoring or account changes they recommend.
One rule while you’re on that call: never move money to a “safe account” at anyone’s request. No real bank asks for that.
An online banking password or a one-time code
A login or a code is more urgent than a card number, because it lets the scammer act as you. If you can still sign in, the FTC says: “Create a new, strong password for the account that was compromised,” then “Turn on two-factor authentication on the account.” Call the bank anyway, since a payee or your contact details may already have been changed. If you used the same password on any other site, change it there too; stolen passwords are routinely tried on other accounts. If the code you read out arrived by text, treat the account it belongs to as compromised and secure it the same way.
Remote access to your computer or phone
Tech support and fake refund calls often end with a remote-access app. After disconnecting, the FTC advises you to “Update your security software to make sure you have the latest protections” and to “Run a scan and delete anything it identifies as a problem.” Uninstall whatever app you installed during the call. Change your email and banking passwords from a different, clean device, email first. If you can’t be confident the machine is clean, have a trusted repair shop check it.
Your Social Security number
An SSN on its own won’t empty a bank account, but it lets someone open credit, file a tax return or claim benefits in your name. Place a credit freeze, described below. If you see signs it’s being used, go to IdentityTheft.gov, which offers to help you “Report identity theft and get a recovery plan.” An IRS Identity Protection PIN is worth getting too.
Your Social Insurance Number (Canada)
The Government of Canada’s guidance on SIN fraud is specific. File a police report and get a case reference number. Contact Canada’s two major credit bureaus, Equifax Canada and TransUnion Canada, through their official websites and consider a fraud alert, which “will instruct creditors to contact you before opening new accounts in your name.” Ask creditors to close any accounts you didn’t open, and report to the CAFC. The CRA advises reporting SIN misuse to Service Canada at 1-866-274-6627.
A new SIN is not the first step. The SIN Program says it “cannot issue a new SIN without proof that your SIN was used to commit fraud,” that “Requesting a new SIN does not guarantee that a new SIN will be issued,” and that “Having multiple SINs can increase fraud risk.”
Your carrier PIN or a code from your phone company
Call the carrier right away on its official number, change the PIN and turn on its SIM and port-out locks. With those details, someone can move your number to their own phone and start receiving your codes, the takeover described in SIM swap and port-out fraud.
Name, address, email or date of birth
On their own these carry less risk, but they make the next scam more convincing. Expect emails and calls that quote your details back to you. A message that “already knows” you deserves more suspicion, not less.
Freeze or fraud alert: two different locks
In the US, two free tools stop criminals from opening new credit in your name. They work differently, and you can use both.
A credit freeze blocks lenders from viewing your credit report, which stops most new accounts. According to the FTC, “There’s no cost to place or lift a credit freeze,” and “A credit freeze lasts until you lift it.” You have to contact all three bureaus, Equifax, Experian and TransUnion, separately. When you apply for credit later, you lift the freeze for a while.
A fraud alert tells lenders to verify your identity before opening an account. It’s free as well. “An initial fraud alert lasts one year, but you can renew it,” and you only contact one bureau, because “The credit bureau you contact must tell the other two.” If your identity has been stolen and you’ve filed an FTC identity theft report or a police report, you can get an extended fraud alert that “lasts seven years.”
Canada has two major bureaus, Equifax Canada and TransUnion Canada, and the government’s SIN guidance recommends contacting both after a SIN is compromised. They handle requests separately, so ask each about a fraud alert and any other protection they offer.
Tip: The FCC’s cell phone fraud guide also suggests checking your credit report from each bureau at least once a year, staggered so you check one every four months, for free at annualcreditreport.com.
Tax accounts are a favourite target
Stolen identity details often end up on a fake tax return. In the US, the IRS offers an Identity Protection PIN, “a six-digit number that prevents someone else from filing a tax return” with your Social Security number. “Anyone who has an SSN or individual taxpayer identification number (ITIN) and is able to verify his/her identity” can get one. “An IP PIN is valid for one calendar year,” and a new one is generated each year.
In Canada, contact the CRA if you think your CRA sign-in was compromised, if your CRA account shows banking or address changes you didn’t make, or if a benefit application was filed without your knowledge. Its report page lets you report by phone or online, and after an online report a CRA officer contacts you within 14 business days. If the scammer was posing as the CRA in the first place, the CRA’s own verification steps are worth reading before the next call comes.
File the reports while the details are fresh
Reports create a record you may need later to dispute charges or accounts, and they help agencies spot active scams.
In the US, use IdentityTheft.gov if your identity may be misused and ReportFraud.ftc.gov for the scam itself, and tell local police if you lost money. If the caller impersonated Social Security or the IRS, report to oig.ssa.gov or tigta.gov as well.
In Canada, report to the Canadian Anti-Fraud Centre online or at 1-888-495-8501, and to your local police.
Wherever you are, keep a log of every call, case number and person you speak with. Which agency does what with your report is laid out in this reporting guide for both countries.
The calls that come after
Once scammers have your details, the next calls are usually more convincing. Some quote your address or the last four digits of your card. Others pose as your bank’s fraud team, the police, or a law firm that can recover your money for an upfront fee. That last one is simply another scam. The FTC itself “will never demand money, make threats, tell you to transfer money, or promise you a prize.”
How you paid decides how much can be recovered. Card payments have formal dispute processes. Transfers you authorized, gift cards and crypto are much harder; the FTC warns that crypto payments “don’t have the same legal protections as credit and debit cards do.” Nobody can change that for a fee.
For the next few months, check your bank and card statements weekly, read every “new login” or “password changed” email, and treat any call that mentions the incident with suspicion. Stolen details get sold and reused long after the first call, so keep the checks going after that, just less often.
Before returning an unknown call, look the number up on FreeSpy for its region, line type, community reports and any FTC complaints. If the page is unfamiliar, the field-by-field lookup walkthrough explains what each part means.
Sources
- FTC: What To Do if You Were Scammed
- FTC: Credit Freezes and Fraud Alerts
- IdentityTheft.gov
- IRS: Get an Identity Protection PIN
- Service Canada: Social Insurance Number fraud and data breaches
- CRA: Report a scam or identity theft
- FCC consumer guide: Cell Phone Fraud
- Canadian Anti-Fraud Centre: Top frauds of 2025
- Experian summary of FTC 2025 identity theft data