After you typed it
You typed your card on a page you no longer trust
Updated 6 September 2026
The unpaid-toll text, the parking QR, the “Netflix payment failed” link — they all end on a page that wants the sixteen digits. If you typed them, the next hour matters more than the next week. Shame can wait.
The issuer first
The number on the plastic is the one that can freeze or replace the card. A number from the fake site, or from a text that arrived right after, belongs to them. Ask the issuer what they need. We will not invent their hold times.
Passwords on the same page
If you also typed an email password or a one-time code, change that password from a different browser or phone. Turn on the issuer’s alerts. If a remote-support tool was part of the story, read the virus popup page.
Report, then stop
File at FTC ReportFraud. If a bank transfer or crypto left, use IC3 as well. Then stop. A “refund specialist” who found you is hunting the same panic. That is the second con.
Quick answers
- Should I wait to see a charge?
- Call now. The issuer can watch the card before anything posts.
- Someone called offering a refund.
- That is the next scam. Hang up.
- Did I get a virus too?
- Not from typing a card. Still do not run a file they email you.
This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.