What to do when a customer loses money to an impersonator

When a customer loses money to someone impersonating your company, act on four things at once. Stop the source by blocking and taking down the fake account, site or number. Point the customer to the right authorities and help them report it. Preserve the evidence and the payment trail. And contact anyone who might freeze the funds, such as the receiving bank or exchange, while there's still time.

Here's the checklist, with routes for the US, UK and Canada, and for payments made in crypto. For when reporting to agencies helps a company, see should you report fake support scams to the FTC or IC3.

1. Stop the source

• Get the phishing or payment page blocked and taken down. Once a malicious website or phishing link is confirmed, ChainPatrol gets it flagged in 20+ wallets in about 5–10 minutes and in browsers in about 1–3 hours. Blocking applies to web domains and URLs; fake social profiles and chat accounts are removed through platform takedowns.

• Report the fake account, ad or number that reached the customer.

• Post a short warning on your official channels if others are likely to be targeted.

2. Preserve the evidence

• Screenshots of every message, page and ad, with dates.

• Payment details: bank transfer references, card transaction IDs, or for crypto, wallet addresses and transaction hashes.

• The URLs, account handles and phone numbers involved.

3. Report it

4. Try to stop the money

• Bank transfers and cards. The customer should call their bank or card issuer immediately. Speed matters for recalls and disputes.

• Crypto sent to an exchange. Contact the receiving exchange's compliance team with the transaction hash and the victim's report. Exchanges can sometimes hold funds still on the platform.

• Stablecoins. Issuers can freeze tokens at specific addresses, but generally act on requests from law enforcement, and some require a court order. A fast police or IC3 report is what makes a freeze request possible.

• Active crypto incidents. SEAL 911, run by the Security Alliance, is a volunteer emergency response service for crypto security incidents.

5. Support the customer

• Tell them plainly what happened and what you're doing about the source.

• Explain your own policies on reimbursement or goodwill, if any, without promising recovery.

• Help them secure their account: password reset, two-factor authentication, revoked wallet approvals.

6. Close the gap

Ask how the customer found the fake. Most losses trace back to a few routes: a reply on social media, an ad, a lookalike page or a fake number. Fix the route, not just the case. See the account is the lure, the link is the loss.

Frequently asked questions

Can a company report on a customer's behalf?

Companies can file their own reports, and IC3 accepts reports from third parties for a victim. The customer should still report directly, because agencies and banks need the victim's account of what happened.

Will the money be recovered?

Sometimes, mostly when the bank, exchange or issuer is contacted quickly. No route guarantees recovery, so don't promise it.

Is this legal advice?

No. Talk to counsel about your obligations to customers and regulators.

See which impersonators are targeting your customers. Get a free scan, with results within 48 hours.

Sources

Accessed October 2026. Platform processes change; check each source for the latest.

• FBI IC3

• FTC, ReportFraud.ftc.gov

• Report Fraud (UK)

• GOV.UK, Report Fraud replaces Action Fraud

• Canadian Anti-Fraud Centre

• Security Alliance (SEAL)