If money was sent, call the bank's fraud line first — use the number on the back of the card, not one from the message.
If you clicked, replied, or gave them anything — even something small — assume they're still using it. One code or password can open email, and email opens the bank, the phone account, everything else.
This is not your fault, and most of those doors can be closed tonight. The order you do it in is what matters.
Here's how to read a message yourself. If you see even one of these, treat it as a scam until you've checked another way.
A rush. Act now, or something bad happens.
A secret. Don't tell your family, don't hang up.
A strange way to pay. Gift cards, wire transfers, crypto, a payment app, cash by courier.
A link or phone number inside the message. Real companies are happy for you to look them up yourself.
A voice you know, asking for money. Hang up and call them back on the number you already have.
The safe move is always the same: don't reply, don't tap, don't call the number in the message. Look the company or person up yourself and contact them that way.
That didn't go through.
The connection dropped before we could read it. Your message is still here.
While you wait: don't reply, don't tap any link, and don't call a number from the message.