Tool 1.2

Scammed or hacked? What to do now, step by step

Steps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent. Where to report it in five countries.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

1. Choose what happened, out of nine situations: a link you clicked, a password or code you gave, money you sent, a stolen WhatsApp or account, and others.
2. Choose your country (Colombia, Mexico, Argentina, Peru or Chile, or Somewhere else for general advice) to see where to report it.
3. Follow the steps in order: the first ones are the most urgent. You can print the list. Nothing you pick is sent anywhere: the steps are already in the page.

Pick what happened, then do the first block right away

The page covers nine situations: you clicked a suspicious link, typed a password on a fake page, gave card or bank details or a one-time code, sent money to a scammer, lost your WhatsApp, had your email or social media hacked, found someone pretending to be you, installed a suspicious app, or discovered loans or phone lines opened in your name. Each one has three blocks: Do this now, In the next 24–48 hours, and Watch out for.

If several things happened, for example you clicked a link and then typed your bank password, open the one about money first. Money that is still in the receiving account can sometimes be frozen, and that chance shrinks by the minute. Passwords can be changed a few minutes later.

If someone asked for your WhatsApp code

A contact writes: “I sent you a 6-digit code by mistake, can you forward it?”. You do, and WhatsApp logs you out. Choose My WhatsApp was stolen, or someone asked for my code, and your country, for example Colombia. The first block tells you to register your number again in WhatsApp, because the new SMS code logs out the other device; to wait 7 days if it asks for a two-step PIN you never set, as WhatsApp's help explains; and to warn your contacts through another channel so they don't send money.

The next block covers turning on two-step verification and checking Linked devices. Under Report it you get the official channels for your country, such as the police's CAI Virtual and the Fiscalía's online complaint service in Colombia. The page address changes to match your choice (for example ?s=whatsapp&c=CO), so you can send it to a relative who needs the same steps.

Mistakes that make it worse

Calling the number that came in the scam message, or answering a second message from “the bank's fraud department”. Paying someone who promises to recover your account or your money: that is almost always a second scam. Deleting the chat before taking screenshots, which you'll need for the report. Waiting until tomorrow to call the bank.

This page doesn't file reports or contact anyone for you. The report links open official websites, where you file it yourself. Getting money back isn't guaranteed: if you made the transfer yourself, banks often aren't required to return it.

FAQ

Guides for this tool

• G7Someone sent me money by mistake: is it a scam? What to doA stranger sent money to your account "by mistake" and wants it back at another number? Why you shouldn't return it yourself, and how your bank can.
• G8Loans in my name? Check your credit report and phone linesCheck for free whether someone took a loan or a phone line with your ID, in Colombia, Mexico and more, and how to dispute it and prevent it next time.
• G10“Hi Mum” scam: new number messages and cloned voicesHow the “Hi Mum, this is my new number” scam works, how a voice can be copied from short clips, and how to check before you send any money.
• G11WhatsApp two-step verification: stop account theftWhy WhatsApp accounts get stolen with the SMS code trick, how to turn on two-step verification, check linked devices, and recover a stolen account.
• G12Where to report a scam in Colombia and Latin AmericaThe official places to report online scams and hacked accounts in five Latin American countries, what to prepare first, and what happens after.
• G17Fake payment receipts: how shops can check they were paidA customer sends a transfer screenshot and says "I already paid". Why a receipt proves nothing, how to check in your app, and a routine for your shop.
• G18Work-from-home task scams: paid to like videos on WhatsAppPaid to like videos or write reviews, then asked to deposit money to unlock tasks? How task scams work, the warning signs and what to do if you paid.
• G22Lost or stolen cédula: what to do and how to get a duplicateWhat to do in the first hours after losing your Colombian cédula or having it stolen, how to get a duplicate, and how to keep others from using your ID.
• G23Nequi or Daviplata account stolen? What to do nowHow Nequi and Daviplata accounts get stolen with fake support, code requests and SIM swaps, how to block yours fast, and the one rule that prevents it.

More in this chapter

• 1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
• 1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
• 1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
• 1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
• 1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
• 1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
• 1.8Domain age checkerSee when a domain was registered, when it expires, its registrar and nameservers.
• 1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
• 1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
• 1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
• 1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
• 1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
• 1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌