The moment you realize the "you won!" message was a scam, your stomach drops — but panic is the wrong response and so is embarrassment. What matters now is speed, because most of the damage from a giveaway scam happens in the hours after you hand over money or information. Work the checklist below in order, hardest-to-reverse first, and don't stop to beat yourself up. Sweepstakes scams are engineered by professionals; falling for one makes you normal, not foolish.

Stop the money before it leaves

If you paid a "processing," "insurance," or "tax" fee to release a prize, how you paid decides how fast you must move. Credit and debit card: call the number on the back of the card, say the word fraud, and ask to dispute the charge and reissue the card. Federal law (the Fair Credit Billing Act) gives you chargeback rights on credit cards, and most issuers extend similar protection to debit — but the clock is tight, so call today, not next week. Bank transfer, wire, or Zelle: call your bank's fraud line immediately and request a recall or reversal; wires are hard to claw back, but a same-day catch sometimes works.

Gift cards and crypto are the scammer's favorite tools precisely because they're built to be irreversible — but irreversible is not the same as hopeless. For gift cards, call the issuer (the number is on the card or its website), report it as used in a scam, and ask them to freeze the remaining balance; keep the card and your receipt. For crypto or a payment app, report it in-app and to the platform's fraud team right away. Then file with the FTC at reportfraud.ftc.gov and the FBI's ic3.gov — those reports create the paper trail your bank and card issuer will ask for.

Lock down your identity and logins

If you shared personal details — Social Security number, date of birth, address, or a copy of your ID — assume it's now for sale and act like it. Place a free credit freeze at all three bureaus: Equifax, Experian, and TransUnion. A freeze blocks new accounts from being opened in your name, costs nothing, and you can lift it in minutes when you need credit. Add a free fraud alert (one bureau notifies the others) and pull your free reports at annualcreditreport.com to check for accounts you didn't open.

If you clicked a link and typed a password — or you reuse that password anywhere — change it now, starting with your email, then your bank and any account sharing that password. Turn on two-factor authentication (an app like Authy or Google Authenticator beats SMS) so a stolen password alone can't get in. If a scammer had screen-share or remote access to your device, run a full antivirus scan and consider a factory reset. Finally, if you gave up your SSN, request an Identity Protection PIN from the IRS so no one can file a tax return as you.

Report, document, and monitor going forward

Reporting isn't just civic duty — it's how you build the record that gets money back and warns the next target. Beyond the FTC and IC3, report to your state attorney general, and if the scam arrived by mail (a fake "prize check" is common), file with the U.S. Postal Inspection Service at uspis.gov. Save everything: screenshots, emails, phone numbers, transaction IDs, and the scammer's usernames. If your identity was exposed, IdentityTheft.gov will generate a personalized recovery plan and an official affidavit.

Then set up watch. Free monitoring from your bank or CreditKarma will flag new inquiries, and you should skim your bank and card statements weekly for a few months — refund scams and repeat hits often follow the first one. Expect follow-up contact, too: scammers sell "sucker lists," and a recovery scam (someone offering to get your money back for a fee) is a second con aimed at people who just lost the first round. Nobody legitimate charges an upfront fee to recover your losses.

Move fast, report everything, and never pay a second stranger to fix the first one.