After the scam: what to do in the hours, days, and weeks that follow

Retirees are among the most-targeted and hardest-hit victims of financial scams in Australia — investment scams, romance scams, impersonation scams (the fake call from "the ATO," "your bank," or "the police"), remote-access scams, and superannuation-targeting scams. Prevention is the ideal, but a substantial number of retirees are scammed each year, and the response in the first hours, days and weeks materially affects how much can be recovered and how the victim recovers emotionally. This article covers the post-scam workflow: the immediate actions, the reporting channels, the recovery avenues, the critical warning about secondary "recovery" scams, the emotional support that makes acting possible, and the longer-term rebuild.

The honest framing is that most scam losses are not fully recovered — but acting fast maximises the chance, and the response is as much about emotional support and preventing re-victimisation as about clawing back funds. This is general information only, not personal advice; if you've been scammed, act immediately and engage the official services.

Why is speed everything in the immediate response?

The single most time-critical action is to contact the bank's fraud or scam hotline immediately, available around the clock at the major banks. The sooner you contact your bank, the more likely you are to get your money back, because a bank can sometimes recall a transferred payment if it's reached before the funds leave the receiving account — and that window is often hours, not days (MoneySmart). So that call comes first, before anything else, and the message to the bank is to stop any transactions and freeze the accounts. After that, stop any ongoing payments the scammer set up (direct debits, recurring transfers), reissue cards, and change online banking credentials. If the scam involved remote-access software, disconnect the internet, shut the device down, and have it professionally checked before reconnecting, since the scammer may retain access — and change credentials for banking, email and myGov from a different, clean device. Throughout, document everything: screenshots, transaction records, communications, phone numbers, and the account the money went to. If a family member is helping someone recently scammed, the first words should be: "Have you called your bank's fraud line? Do that right now."

What are the formal reporting channels in the first days?

Several channels matter in the first days. Report the scam to Scamwatch, run by the National Anti-Scam Centre at scamwatch.gov.au, which feeds intelligence and disruption efforts. Report cyber-enabled scams to ReportCyber at cyber.gov.au, which refers reports to police where appropriate. Beyond the immediate hotline call, lodge a formal complaint with the bank through its internal dispute resolution process, documenting the scam and requesting recovery or reimbursement (MoneySmart). For significant losses a police report may be warranted and is required for some recovery processes, though police rarely recover scam funds since they're usually moved offshore — the value is the record it creates. Where personal information has been compromised, contact IDCARE, Australia's national identity and cyber support service (1800 595 160), which provides free, case-managed help to limit the damage. And tell the relevant institution directly — the super fund if super was targeted, the ATO if the ATO was impersonated.

What recovery avenues exist — the bank first, then AFCA?

The avenues run roughly in order of speed and viability. The best case is a recall of funds, where a bank contacted quickly retrieves the payment before it's withdrawn — which is exactly why speed matters so much. For scams paid by credit or debit card, a chargeback through the card scheme may recover the money within the scheme's time limits (commonly around 120 days), which is more viable for card payments than for direct bank transfers. Bank reimbursement has historically been inconsistent, but is now shifting under the new Scams Prevention Framework (see below) toward greater institutional responsibility where the bank fell short of its obligations, so reimbursement is worth pursuing where the bank's systems or response failed. And if the bank declines and the victim believes it failed its obligations — ignoring warning signs, weak scam-detection, a slow response — the next step is a free, independent complaint to the Australian Financial Complaints Authority (AFCA, 1800 931 678), which assesses whether the institution met its obligations and whether its conduct contributed to the loss; some victims have recovered this way, and a complaint should generally be lodged within two years of the firm's final response (MoneySmart). Throughout, expectations need managing honestly: most scam losses are not fully recovered, particularly for "authorised push payment" scams where the victim was tricked into authorising the payment themselves, which covers most scams.

What does the new Scams Prevention Framework change?

The landscape is shifting. The Scams Prevention Framework, legislated through the Scams Prevention Framework Act 2025, imposes new obligations on the sectors where most harm occurs — banks, telecommunications providers, and certain digital platforms including social media — requiring them to prevent, detect, disrupt and respond to scams, share scam intelligence with the ACCC, and provide clear pathways for consumers to report and resolve complaints (Treasury). AFCA is proposed as the single external body to handle scam complaints not resolved at industry level, and the proposed approach would see automatic payment to consumers for smaller verified losses (those of $3,000 and under), while for larger losses AFCA would weigh whether the businesses involved breached their obligations and also take the consumer's own conduct into account. The sector-specific codes are still being finalised, so the detail and the practical reimbursement outcomes are evolving — but the direction is clearly toward greater institutional responsibility than victims have historically faced.

What is the recovery-scam trap?

Scam victims are frequently targeted again by secondary "recovery" scams, run by fraudsters who work from lists of known victims that circulate among criminal networks. They promise to recover the lost money for an upfront fee, or pose as law enforcement, a recovery agency, or a lawyer who can get the money back: "We've identified the scammers and frozen their accounts — to release your funds, we need a processing fee of $X." The desperate victim pays, and loses more. The absolute rule is that legitimate recovery never requires an upfront fee — banks, AFCA, police, IDCARE and Scamwatch do not charge for their services, so any contact promising recovery for a payment is itself a scam. Recently-scammed people are emotionally vulnerable and may grasp at the hope of recovery, which makes them prime targets for exactly this, so the warning has to be given explicitly and emphatically; it's the trap that turns one loss into two.

Why is the emotional dimension often the harder part?

Scam victims frequently feel intense shame and self-blame — "how could I have been so stupid?" — which is both painful and counterproductive, because it prevents reporting, prevents telling family, and enables ongoing victimisation. The reframe matters: scams are run by sophisticated criminal operations using manipulation techniques refined across thousands of victims, so being scammed is not a sign of stupidity — intelligent, capable, financially literate people are scammed regularly, and saying so plainly can unlock a victim's willingness to act. Isolation is common, as victims hide the scam and deepen the isolation that prevents support, and depression and anxiety can be serious, particularly because the money often can't be re-earned in retirement. Support is available through IDCARE for practical and emotional case-managed help, Beyond Blue and Lifeline for mental health, the victim's GP, and family where the victim is willing to involve them.

What does financial recovery look like, including the Centrelink angle?

Where funds can't be recovered, the task is to assess the damage and rebuild. Start by sizing the loss and its impact on the retiree's position and ongoing sustainability. There's a genuine, if bittersweet, silver lining for asset-tested pensioners: because the Age Pension rises by $3 a fortnight for every $1,000 of assessable assets below the cut-off (DSS Social Security Guide 4.2.3, https://guides.dss.gov.au/social-security-guide/4/2/3), a loss that materially reduces assessable assets can lift the Age Pension — it doesn't undo the loss, but the pension floor partly cushions it, so the changed asset position should be reported to Centrelink. Re-running the sustainability projection with the reduced assets often shows, particularly given that floor, that the retiree can still meet their needs with some adjustment, and demonstrating that concretely helps the victim see a path forward rather than catastrophising. On tax, money lost to a scam is generally not deductible for an individual, so don't raise false hope of an offset, though where a genuine investment was involved a capital loss may sometimes arise — confirm with the ATO or a tax adviser. And where super was illegally accessed or rolled into a scam scheme, specific recovery avenues through the fund, the ATO and AFCA, along with compliance issues, may apply.

What protective measures should follow?

Finally, address what enabled the scam — isolation, cognitive change, unfamiliarity with the threat, or a specific manipulation — and tackle the underlying factor. Practical safeguards include transaction limits, two-factor authentication, alerts on large transactions, and a cooling-off arrangement with the bank for large transfers. A trusted family member with visibility (not control) over accounts can spot unusual activity, and some banks offer formal trusted-contact arrangements. Where cognitive decline is a genuine factor, an Enduring Power of Attorney may be appropriate, though it's a significant step needing careful thought. Reducing instant liquidity — keeping large sums in term deposits rather than instantly transferable accounts — creates friction that can interrupt a future scam. Throughout, balance protection against the retiree's autonomy and dignity: intervention should be supportive, not controlling, unless capacity is genuinely compromised.

What do worked examples look like?

These two cases show the response in practice. They are illustrative only, not personal advice; scam response is time-critical, and the official services (Scamwatch, IDCARE, the bank, AFCA) should be engaged.

Wilhelmina, 74, realised an hour ago that the "ATO officer" who phoned about an unpaid tax debt — insisting she transfer $35,000 immediately to avoid arrest — was a scammer, and she made the transfer 90 minutes ago. Distraught, she called her daughter, who called the family's adviser. On these facts speed is everything. The adviser's immediate instruction is for Wilhelmina to call her bank's fraud hotline right now and say she's been scammed and wants to recall a payment made 90 minutes ago, because the transfer is so recent that there's a real, if not guaranteed, chance the bank can recall the funds before they leave the receiving account. While that's underway, she should freeze the account the transfer came from, change her online banking credentials in case details were obtained, and confirm no remote-access software was installed (the "ATO" scam sometimes escalates to "let me help you fix this on your computer"). In the following hours she should document everything, report to Scamwatch and ReportCyber, and lodge a formal complaint with the bank. The adviser also delivers the reframes that matter: this is not Wilhelmina's fault — the arrest-threat impersonation works precisely because it triggers panic in capable people — and the real ATO never demands immediate payment by transfer under threat of arrest, a lesson for next time. The daughter is asked to stay with her mother for support and to watch for recovery-scam approaches in the coming weeks, since Wilhelmina is now a known victim. If the recall fails, the adviser will assess the $35,000 loss, update Centrelink (her pension may rise as her assets have fallen), and rebuild the plan — but the first hour is about the recall.

Bruno, 78, was scammed three weeks ago by a fraudulent "cryptocurrency investment" that cost him $120,000 of his savings, and he told no one out of shame. Yesterday a "fund recovery specialist" called, offering to recover his $120,000 for an upfront fee of $8,000, and he's about to pay it; his son found out by chance and called the adviser. On these facts the urgent priority is stopping the recovery scam, because Bruno is about to lose another $8,000 to a secondary fraud that targeted him precisely because he's a known victim. The adviser's message, delivered immediately and directly, is: do not pay the $8,000 — this is a second scam, and legitimate recovery through banks, AFCA, police or IDCARE never charges an upfront fee. Once that's stopped, the original scam is addressed: three weeks on, a fund recall is likely too late, but the response is to report to Scamwatch and ReportCyber, lodge a formal complaint with Bruno's bank, and assess whether the bank failed its obligations, since a $120,000 transfer to a crypto platform may have warranted intervention by its systems — which, under the new framework, could support an AFCA complaint for reimbursement. IDCARE is engaged for case-managed support. Critically, the shame and isolation are addressed: Bruno hid the scam for three weeks, which both prevented help and left him exposed to the recovery scam, and the adviser and son reframe it — sophisticated crypto scams fool experienced investors, and the shame is the scammer's weapon, not a reflection of his character. The financial impact is real, but re-running his plan shows his Age Pension will rise as his assets have fallen and, with adjustment, he can still meet his needs. With his son now involved, protective measures follow: a trusted-contact arrangement with the bank, transaction alerts, and a conversation about reducing instant liquidity. On these facts the response weeks after the scam still mattered enormously — stopping the recovery scam alone saved $8,000, and the AFCA avenue may yet recover part of the original loss.

For retirees who've been scammed, and the family and advisers responding, the workflow is urgent, structured, and as much about emotional support as financial recovery. Act immediately (call the bank to attempt a recall — speed is everything — then freeze accounts, disconnect remote access, change credentials and document); report widely (Scamwatch, ReportCyber, the bank, IDCARE, and police for significant losses); pursue the recovery avenues (recall, chargeback, reimbursement under the evolving Scams Prevention Framework, and an AFCA complaint where the institution failed its obligations); give the recovery-scam warning emphatically, because legitimate recovery never charges an upfront fee and recently-scammed victims are prime targets; provide emotional support and reframe the shame, since sophisticated criminals fool capable people; rebuild the finances, updating Centrelink as the pension may rise and re-running the plan against the floor; and put protective measures in place. The headline most victims and families need to hear is to act fast (the recall window is hours), never pay anyone who promises recovery for a fee (that's the second scam), and remember that the shame is the scammer's ally — reporting and seeking help is what maximises recovery in both senses. This is a fast-moving area, so confirm the current channels, framework and time limits with the official sources before relying on them — but the shape of the response is durable.

Sources

• MoneySmart — What to do if you've been scammed
• MoneySmart — Unauthorised and mistaken transactions
• Treasury — Scams Prevention Framework
• DSS Social Security Guide 4.2.3 — Pensions and benefits assets tests