The money has already been sent, and Ilia Nikolaevich Zavialov sets out what the first hour has to cover

A payment made by the account holder is read by the payment system as an intended instruction, so nothing about it reverses on its own. What remains is a request from the sending bank to the receiving bank, asking for whatever is left to be held. That request succeeds or fails on a single condition, which is whether a balance is still sitting in the receiving account when it arrives. Everything worth doing in the first hour exists to reach that condition sooner.

The receiving account is rarely the final destination. It usually belongs to a person recruited to pass money along, and its whole purpose is to accept a transfer and forward it within minutes. From there the sum is split across several accounts, converted into something else, or taken out at a machine. Each of those steps removes another part of the balance that a freeze might have caught.

The size of this category explains why banks keep desks dedicated to it. UK Finance counted 248,070 cases of authorised push payment fraud across 2025, with 576.4 million pounds sent by the payers themselves. Every one of those payments was approved by the person who lost the money, which turns recovery into a request passed between two institutions. The volume also means the person answering the call has handled the same situation before.

The route out of a receiving account is built for speed and for breaking the trail. A transfer divided into smaller amounts across several accounts stops being one traceable sum within a few moves. Part of it leaves the banking system through card purchases of goods that resell easily. Part of it converts into cryptocurrency at an exchange or a machine, after which the sending bank has nothing left to ask about.

Conversion is the step that changes the odds most. The Internet Crime Complaint Center reports that around half of all losses declared in the United States now involve cryptocurrency. Once a payment crosses into that layer, a request between two banks has no counterpart. The minutes spent hesitating before the first call are spent at the exact moment the balance is still reachable.

This is also why the size of the payment changes nothing about the urgency. A small sum travels as fast as a large one, because it attracts no manual review inside the receiving bank. A few hundred can be gone in the time it takes to draft a polite message. The hour is short for everybody who is inside it.

The first call goes to the bank that sent the money, on the number printed on the card or shown inside the official application. Three facts open the conversation: that the payment was made under deception, the exact time and amount, and the details it went to. The request itself asks for a recall to be raised with the receiving bank and for the case to be logged as authorised push payment fraud.

Using the category name is worth the two seconds it costs. It moves the call from general customer service to the desk that contacts other banks. A description given in ordinary words can be recorded as a dispute about a purchase, which travels a much slower route. The vocabulary here belongs to the bank, and repeating it back is the quickest way into the right queue.

Two things are worth securing before the line goes down. The first is the reference number of the recall request, because every later conversation begins with it. The second is written confirmation of what was asked for and at what time. That written trace becomes the evidence of timing if the case is later assessed for reimbursement.

The card and the account belong in the same call. Where details were typed into a page or read out to a caller, the card is stopped and the banking password changed while the line is still open. One call then covers both the money and the access that went with it.

The strongest instinct in that hour is to contact the person who took the money and demand it back. That message does two things. It confirms that the payment has been noticed, which is the signal to move the balance immediately, and it reopens a conversation with somebody who has already succeeded once. The second attempt usually arrives as an apology, a technical explanation and a smaller payment that will supposedly release the first.

Deleting the conversation comes from the same instinct and costs more. The messages, the profile, the number and the page the account details came from make up the record the bank and the police will ask for. Anger and embarrassment both push towards clearing the screen, and the screen is the case file.

Telling somebody in the household early does more than share the weight. A person who was not inside the conversation reads the same messages without the pressure that produced the payment, and they notice the parts that were designed to be missed. It also ends the isolation the approach depended on, which usually prevents a second payment that day.

Screens change quickly after a payment. Accounts are closed from the other side, listings are taken down, chat histories are wiped, and a page that existed an hour ago returns an error. The record therefore gets captured first and read afterwards, which reverses the order that feels natural.

A usable record has a small number of parts. The payment confirmation carries the time, the amount and the receiving details. The conversation is captured as images together with the profile of whoever wrote it, since a description from memory loses the detail that matters. The number or address that made contact, the address of the page that supplied the account details, and any email kept with its headers intact complete the set.

The channel of first contact deserves its own line in the note. In the British figures for 2025, 66 per cent of authorised push payment cases began online and a further 17 per cent began through telephone networks. Both routes leave a trace that lives on equipment belonging to somebody else, which is why the copy on your own device survives. Ten minutes of capture at this stage saves weeks of reconstruction later.

A report to the national fraud body serves purposes the first call does not. It fixes the date and time at which the loss was declared, which matters when a bank assesses a claim months later. It produces a reference number that other institutions accept as proof that the case exists. It also places the details into a system where the same receiving account may already stand against other reports.

The aggregate value of reporting is easy to underestimate from inside a single case. The Internet Crime Complaint Center recorded 1,008,597 complaints for 2025 with losses approaching 21 billion dollars, a rise of 26 per cent on the previous year. Those totals exist because individual people filed while the details were still fresh. The account numbers, wallet addresses and telephone numbers inside them are what allows one report to connect to another.

The report is written from the record while it is open. Times, amounts and identifiers go in exactly as they appear, without rounding and without paraphrase. A short factual narrative in plain order carries further than an account of how the day felt. Where the receiving bank is known, its name belongs in the report as well.

A transfer rarely travels alone. The conversation that produced it often included a code read aloud, a password typed into a page, or an application installed to demonstrate something on the screen. Each of those hands over access that outlives the payment, and access is quieter than a missing balance. Nothing announces itself, so the check has to be made deliberately.

The check runs through a short list. The banking password is changed and every active session ended, since an open session survives a password change. The email password is changed as well, since the mailbox is the recovery route for everything else. Any remote access application installed during the call is removed, and the device restarted afterwards.

Card details deserve separate attention where they were shown or typed. A card that appeared on a page can be reissued from the application without another call. Subscriptions and stored payment tokens follow the card number, so a single reissue closes several doors at once.

A loss is followed by a second approach often enough to be treated as part of the same pattern. It comes as a call or message from somebody who already knows the case, sometimes within days and sometimes months later. The story involves traced funds, a seized account or a compensation list with a name on it. It ends at a payment that has to be made before the money can be released.

The tell is structural, and it holds regardless of how the caller sounds. Money has to leave again before anything comes back, under whatever label suits the authority being claimed: a fee, a tax, a bond, a conversion charge. Genuine recovery runs through the bank, through the fraud report and through a court, and none of those routes opens with a charge collected by telephone.

Public posts describing the loss make the second approach easier to aim. A comment under a news article or a question in a forum supplies a name, a rough sum and a good reason to expect contact. Keeping the details of a case inside the official channels removes the raw material the follow up is built from.

The hour carries different consequences depending on who is standing inside it. Victims aged 60 and over reported an average loss of 38,501 dollars against an overall average of 20,699, which is 1.86 times higher. Larger sums usually mean savings held in one place, with fewer institutions involved and less chance anyone notices before the transfer completes. The recall route stays the same, and the amount at stake in the first ten minutes does not.

Payment methods in those cases tend to close the recall route entirely. Among older people who lost 10,000 dollars or more to somebody posing as a company or a government service, 33 per cent paid in cryptocurrency, 20 per cent by bank transfer and 16 per cent in cash. A separate branch of these schemes sends a courier to collect cash or gold bars in person, which takes the bank out of the transaction altogether.

Where the payment left as cash or metal, the first hour changes shape without losing its value. The police report becomes the opening call, and the description of the courier and the vehicle is the evidence that matters. Footage from a doorbell camera and the memory of a neighbour are both worth asking about while memories are still fresh.

Most of this hour can be assembled on an ordinary day. The fraud line of the bank goes into the phone under a name that is easy to find under pressure. The application that shows payment history is worth opening once before it is needed, so that the confirmation screen is already familiar. A household rule that any money request gets confirmed by a call to a stored number removes many of these situations before they begin.

It also helps to know how these stories usually end. In the American impersonation figures, four reports out of five involved no financial loss at all, which means the attempts outnumber the successes by a wide margin. Most attempts fail where somebody stops to check independently. That check stays available at every moment, even after the money has gone.

The hour rewards order more than it rewards quick thinking. Bank first, record second, report third, access fourth, and no contact with the other side at any point along the way. Written down once and kept somewhere visible, that sequence works on the day when clear thinking is the thing least available.

I sent money to a scammer, can I get it back?

Sometimes, and the odds depend almost entirely on whether a balance is still sitting in the receiving account when the recall request reaches it. The call to the bank starts that request, which is why it comes before anything else in the hour.

How long do I have to cancel a bank transfer I made myself?

There is no fixed window, because a payment you authorised is treated as an intended instruction and never reverses automatically. What exists is a recall request between the two banks, and it works while the money has not been moved onward, usually a matter of hours.

What do I say to the bank when I have been scammed?

Give the time, the amount and the receiving details, state that the payment was made under deception, and ask for a recall to be raised and the case logged as authorised push payment fraud. Ask for the reference number and for written confirmation before the call ends.

Should I message the scammer and ask for my money back?

No. It tells them the payment has been noticed, which is the signal to move the balance onward, and it opens a second conversation with somebody who has already succeeded once.

Can a transfer to a cryptocurrency wallet or exchange be recovered?

It is considerably harder, because a request between two banks has no counterpart once the funds have crossed into that layer. Around half of all losses declared in the United States now involve cryptocurrency, which is one reason the first minutes carry so much weight.

Someone rang offering to recover my money for a fee, is that genuine?

An offer that requires a payment from you before anything comes back is a fresh approach built on the loss. Recovery runs through the bank and the fraud report, and neither of those opens with a charge collected over the telephone.