Is this call, text or email a scam — and what if I already paid?

Five pages in this library answer this. Hang up, then call the IRS yourself is the call that says you owe tax and the police are coming. Forward the spam text to 7726 is the text that keeps coming back. Type the address in yourself is the message that says your account is locked. A buyer never needs you to send money is the message from a buyer when you are selling online. Whose money is missing while the fraud is sorted out? is what the card rules do once money has gone, and the payment they do not cover. If you have already paid, the first page’s steps come first.

If you have already paid, act today, because speed matters. That is the first line of Hang up, then call the IRS yourself, and the page says the US steps come from the Federal Trade Commission. Paid with a gift card: call the number on the back of the card, tell the company a scammer has the card number and PIN, ask for a refund, and keep the card and the receipt. Paid by wire transfer, bank card or a payment app: call that company or your bank now, say a scammer tricked you, and ask them to stop or reverse it. Gave your Social Security number: in the US, IdentityTheft.gov builds a recovery plan for you. In the UK, report lost money to Report Fraud, or to Police Scotland on 101 if you live in Scotland. And the page says none of this is your fault: the call is designed to frighten careful people into moving fast. The card and bank-transfer rules are the last page below.

Hang up, do not call back the number they gave you, and never pay a caller by gift card or wire transfer — the IRS does not threaten arrest and never demands payment that way. Hang up, then call the IRS yourself gives four signs. The payment: many people say no government agency takes gift cards, and the IRS says it never calls to demand immediate payment by gift card, prepaid debit card or wire transfer. The threat: many people say real tax authorities do not threaten arrest, jail or a police raid over the phone, two more that the threat is the tactic, and the IRS says it does not threaten arrest or deportation. The rush: the IRS says it does not demand payment without giving you the chance to question or appeal what it says you owe. The fourth is a warning rather than proof: a request for personal or financial details, which the IRS lists as a red flag, though a genuine collection agency working for it will ask a few questions to confirm who you are, after you have had its letters.

The rule people repeat is not the test. Many people say the IRS always writes first, by mail, and never calls; the IRS says it normally makes first contact by mail, but some people say it can phone, a fourth that such calls are rare, and one person warns ignoring a call because you assume it is a scam can cost you penalties if it was a real notice. So the page rests on the check, which four separate conversations give: hang up, and call the official number you find yourself, on the IRS website or on a letter you already have, never the number the caller or the voicemail gave you. The IRS number for individuals is 800-829-1040, and its online account shows what you owe, if anything. A caller who knows your name, address or part of your number has proved nothing, because one person warns scammers may already hold real details from data breaches. Nor does the caller ID: the better-evidenced answer on the page is that scammers fake the number shown, and some people warn that a scammer may call back showing 911 after you hang up; it is the same scam. To report the call, the page gives the Treasury Inspector General for Tax Administration on 800-366-4484 or its online form, and the FTC at ReportFraud.ftc.gov. In the UK, it says HMRC will never threaten arrest, never leave a voicemail threatening legal action, and never ask you to pay with gift or payment vouchers; report a suspicious call through the GOV.UK online service, forward a suspicious text to 60599, and send a suspicious email to phishing@hmrc.gov.uk.

For an older relative, the page will not pretend to a method, but some people say older people are especially at risk from a different script, a family member in trouble who needs bail money, fast, with the same signs: the rush, the fear, the strange way to pay. For a note by their phone: the tax office never asks for gift cards, never threatens arrest, and never minds you hanging up and calling back on a number you look up. The Resource Bank here has the National Elder Fraud Hotline: if someone age 60 or older has been targeted by a scam, this free US Justice Department line helps them report it and figure out what to do next, on weekdays, 10am to 6pm Eastern.

When a spam text arrives, forward it to 7726 before you delete it, and never reply to it or open its link. Forward the spam text to 7726 says many people give the method, and it is the one the US Federal Trade Commission gives too: copy the message and forward it to 7726, which spells S-P-A-M on a phone keypad, so your wireless network can spot and block similar messages. Some people say the network’s automatic system usually answers asking for the number the text came from; copy it from the original message and send that too. The FTC also lists your messaging app’s own report-junk option, and takes reports at ReportFraud.ftc.gov. On replying STOP, the page draws the line at who sent it: a shop or service you recognise and once gave your number to, STOP is how you leave; a number you do not know, a prize you never entered for, a parcel you are not expecting, no reply at all. Do not call the number back either: three separate conversations say calling spammers back tends to bring harassment or threats, and the number shown may be faked anyway. If you already tapped the link, some people warn change your passwords straight away, above all any you typed in, and anywhere you used the same one; if you gave card or bank details, call your bank on the number on your card now. Some people say forwarding may not stop a spammer who keeps switching to new numbers or throwaway addresses, and one person warns whether it helps is something you will judge for yourself. In the UK, forwarding to 7726 is the route too; if your network’s help page gives a different number, use it, and if you lost money to a scam text, the page says report it to Report Fraud on 0300 123 2040, or to Police Scotland on 101 in Scotland. Elsewhere the code is not universal, so check your own network’s help page or your country’s telecoms regulator.

When a message asks you to log in, pay, or check your account, do not use its link: open the app or type the website’s address yourself, and if something is really wrong, you will see it there too. Type the address in yourself says some people give that rule, and its advantage is that you do not have to work out whether the message is real: if it is real, the warning will be waiting when you log in your own way, and if it is fake, you never went near the fake. One person on the page names the main risk: not a virus, but a copy of the real login page, built to collect your password or card number, and the copy can look exact. The page’s one exception is a password reset or a new-account confirmation you requested a minute ago, and even then you look at the address in the browser before you type anything; a reset you did not ask for, one person says, is a scam or a mistake.

If you already clicked or typed a password, the page turns to the agencies. The National Cyber Security Centre says: if you gave out a password, change it on every account that uses the same one; if you gave banking details, tell your bank; and if you lost money, tell your bank and report it to Report Fraud on 0300 123 2040 in England, Wales and Northern Ireland, or to Police Scotland on 101. In the United States, the Federal Trade Commission points to IdentityTheft.gov for the steps that match what you gave away, and says to update your security software and run a full scan. To report the message itself: in the US, forward phishing emails to reportphishing@apwg.org and texts to 7726; in the UK, forward emails to report@phishing.gov.uk and texts to 7726; elsewhere, your national fraud or cyber-security agency.

When you are selling, the money only ever comes to you: if a buyer asks you to send money, pay any fee, or read out a code, stop, because it is a scam. A buyer never needs you to send money is for people selling something privately online. Some people put it as one rule: in a real sale the seller receives money and is never asked to send any, whether it is for shipping paid by personal transfer, a “verification”, or movers. On the overpayment, the Federal Trade Commission explains that banks have to make deposited money available quickly, but it can take weeks for a bank to discover that a cheque was fake, and then the money comes back out of your account and you are the one who owes it; its advice is never to accept a cheque for more than the selling price. On the code, the Commission says a verification code a “buyer” asks you to read back lets them set up a phone number or an account in your name, and its rule is not to share any verification code with someone you do not know.

If it has already happened, act today: the Federal Trade Commission’s advice is to contact the company you used to send the money straight away, whether that is your bank, the payment app, the gift card company or a wire service, tell them it was fraud, and ask them to stop or reverse it. Then report it: in the US at ReportFraud.ftc.gov; in England, Wales and Northern Ireland to Report Fraud, the service that replaced Action Fraud in December 2025, online or on 0300 123 2040; in Scotland to Police Scotland on 101; elsewhere, to your own police or consumer-protection agency. One correction on the page is worth knowing before you ask: deposit insurance protects your money if a bank fails, not if you were tricked into sending it, so recovery depends on how fast you move. And one person said it plainly to someone who had just been scammed: it was not their fault, and they deserved to be heard, not judged.

Both kinds of card protect you from charges you did not make, but when a thief uses a debit card, the money comes out of your own bank account while the fraud is checked, and with a credit card it does not. Whose money is missing while the fraud is sorted out? is about charges you did not make, and it draws one line: if you were talked into sending money yourself, by a caller, a message, someone you were buying from or selling to, the fraud rules on the page are not the ones that apply, because a payment you made yourself counts as authorised even when you were deceived. If you paid a seller by card for something that never arrived, it says routes may still help: in the UK, the Financial Conduct Authority points to a chargeback through your card provider, or a Section 75 claim on a credit card; in the US, a credit card billing dispute covers goods that were not delivered as agreed. Citizens Advice explains that Section 75 applies if you paid by credit card for something that cost more than £100 and no more than £30,000, when the seller does not deliver or the goods are faulty; with a debit card the route is a chargeback, which can only return what you paid on that card. If you sent a bank transfer, the Financial Conduct Authority says a separate UK scheme has, since October 2024, required banks to refund eligible victims up to £85,000 for payments made by Faster Payments or CHAPS; it does not cover card payments. Wherever you are, call your bank at once anyway.

If what you found is a charge you did not make, a card or its number used without you, the page’s main rules apply: call the number on the back of the card now, and in the US follow up in writing straight away, the Federal Trade Commission says, with your account number and the date and time you noticed. On a lost or stolen US debit card the clock matters: report within two business days of noticing and the most you can lose is $50; report later and you could lose up to $500; and if you do not report an unauthorised withdrawal within 60 days of the statement that shows it, you could lose all the money taken, “and possibly more”, the Commission says, meaning money in accounts linked to that one. If the card is still in your wallet and only the number was stolen, you owe nothing, as long as you report within 60 days of that statement. For a credit card, the most is $50, and nothing at all if only the number was used. On a debit card, a US bank that cannot finish checking within ten business days must generally put the money back on a temporary basis, minus up to $50, while it carries on, the Consumer Financial Protection Bureau says. In the UK, as the Financial Conduct Authority explains it, a bank must put an unauthorised payment back by the end of the next business day, debit or credit; if your card was lost or stolen and you did not report it, you can be asked to pay up to £35; you have 13 months to claim, and the bank can refuse only in narrow cases: if you authorised the payment yourself, or acted fraudulently or with gross negligence, which means far worse than an ordinary slip. Elsewhere, the page says, your bank or your country’s financial regulator can tell you.

Who these pages are not for. The tax-call page is written mainly for the United States, and if you have an open matter with the IRS, letters you have answered, an audit, a payment plan, an offer to settle a debt, calls can be real, so check each one against your letters and your online account. The address page is not security advice for a person who may be deliberately targeted, and at work your employer’s rule comes first. The seller page is the wrong page if you are the one buying. And the card page’s rules are for cards issued in the United States and the United Kingdom, as regulators describe them in September 2026; they can change.