Online fraud victim? What to do in the first hours

If you sent money or data to a scammer, call your bank immediately on the number printed on your card, ask for blocking and a review of the transactions, change your passwords from a clean device and keep all evidence in its original form. Then file a criminal complaint. Do not pay anyone who promises to recover your money.

Key points

Fraud and attempted fraud reported to Romania’s National Cyber Security Directorate (DNSC) reached 3,937 cases in 2025, 91% more than in 2024, and phishing remained the main attack vector.
Speed matters: a transaction flagged within hours has a better chance of being stopped than one discovered a week later.
Evidence should be kept in original format (e-mails with headers, exported chats, bank statements), not only as photos of a screen.
Computer fraud (art. 249 of the Romanian Criminal Code) carries 2 to 7 years in prison.
One fraud is often followed by a second: “recovery agencies” asking for upfront fees. They are scams too.

What does online fraud look like in 2026?

The methods have changed less than the packaging. The most common scenarios seen in practice:

Fake investments promoted with public figures. Clips and ads in which central bankers, business leaders or well-known journalists apparently recommend a platform. DNSC has flagged deepfakes using the voice and image of public figures and journalists to promote fake investment platforms, and in February 2026 the National Bank of Romania publicly warned about deepfake posts featuring its governor, Mugur Isărescu, used for fake investment offers.
Bank phishing. Messages imitating a bank, courier or authority that lead to fake pages where victims enter their details and confirmation codes. Some scenarios even bypass two-step authentication, as shown in our analysis of bank phishing and 2FA bypass.
Non-existent sales and rentals. Products or apartments that do not exist, paid in advance.
Cloned-voice calls. A voice that sounds like a relative urgently asks for money.

The common element is time pressure. The scammer wants you to act before you check.

The first hours: checklist

Call your bank on the official number (on the card or in the app), never on a number received in a message. Ask them to block the card or access, report the fraudulent transactions and ask which dispute or payment recall options exist.
Change passwords for e-mail, banking and social media from a device not used during the fraud. Turn on two-step authentication.
If you installed an app at the scammer’s request (for example, remote access software), disconnect the device from the internet and stop using it for banking until it is checked.
Stop all contact with the scammer and do not send “unlock fees” or “withdrawal commissions”. They are part of the fraud.
Keep everything and delete nothing: chats, e-mails, phone numbers, wallet addresses, links, platform names, statements.
Write down the timeline: what happened, when, which amounts, to which accounts.

Which evidence to keep and how

Evidence	Keep it correctly	Common mistake
E-mails	Export in original format (.eml) or forward as attachment, with headers	Screenshot only
WhatsApp, Telegram, Messenger chats	Export from the app, plus screenshots showing date and number	Deleting the chat out of embarrassment
Fake website	Full address (URL), screenshots, date of access	Platform name only
Payments	Bank statements, transfer confirmations, crypto wallet addresses, transaction IDs	No exact amounts or times
Calls	Phone numbers, time, duration, recordings if any	“They called from a hidden number” with no other details
Installed apps	App name, device kept unchanged	Resetting the phone before analysis

Screenshots help but are not enough on their own. E-mail headers and transaction data show where a message came from and where the money went.

The criminal complaint: making it useful

In Romania, a complaint is filed with the police or the prosecutor’s office. Depending on the case, the acts may qualify as computer fraud (art. 249 of the Criminal Code, 2 to 7 years) or as other offences; the prosecutor decides the legal qualification. For the victim, what matters is a clear, documented complaint:

who you are and how you came into contact with the scammer;
the full timeline, with times and amounts;
the accounts, phone numbers, web addresses and wallets involved;
the list of evidence you hold and confirmation that you can hand it over in original format;
confirmation that you informed your bank, and when.

The injured party can propose evidence. A file organised from the start, with numbered evidence and a clear timeline, is easier to work with for anyone who takes it over.

When do you need a lawyer?

For large sums, for frauds involving several people, or when you want to claim damages in the criminal case, a lawyer protects your interests and decides what is filed and when. The lawyer can, in turn, request an independent technical analysis of the electronic evidence.

Beware of the second fraud: “fund recovery”

Once a victim posts online about being scammed, messages quickly arrive from “international lawyers”, “recovery agencies” or “blockchain specialists” promising to return the money for an upfront fee. In reality they are often the same or related networks. The rule is simple: no serious organisation guarantees recovery, and nobody needs your password or codes to help you.

How to protect yourself next time

Check any investment offer in the financial supervisory authority’s registers, not on the website promoting it.
Never install remote access apps at the request of someone who called you.
Agree on a “family password” for urgent calls asking for money.
Treat any clip of a public figure “recommending” an investment as suspicious until proven otherwise.

For hands-on practice in recognising fraud, CysEdu offers courses, interactive guides and simulations as part of the campaign “Analizează. Decide. Acționează.” (Analyse. Decide. Act.). More real cases in our articles on investment fraud and bank phishing.

How ProDefence can help

ProDefence works technically on online financial fraud cases: analysing unauthorised transfers, the messages and websites used, apps installed on the victim’s device, and documenting evidence for the authorities. Our role is technical: to establish what happened and document the evidence. The outcome is a technical report and evidence documented in a form usable in criminal proceedings. See Cybercrime investigation and malware and fraud analysis.

If you already work with a lawyer, they can engage ProCIS for case file organisation, chronology and technical analysis of messages, files and metadata (currently contracted in Romanian). Individuals without a lawyer are referred to a professional who can contract the service. We do not promise to recover money: we promise correct, verifiable technical documentation.

For prevention, at home or at work, CysGame (in Romanian) offers free interactive quizzes and missions on phishing and data protection, training exactly the reflexes that fraudsters rely on.

Frequently asked questions

I sent money to a scammer. Can I get it back?

Sometimes, especially if the bank is informed immediately and the transfer has not yet been completed or withdrawn. The chances drop quickly with time. Nobody can guarantee recovery. Call your bank at once, file a complaint and keep all evidence in original format.

Where do I report online fraud in Romania?

To the police or the prosecutor’s office. The complaint should include the timeline, amounts, accounts and numbers involved, plus a list of evidence. The prosecutor decides the legal qualification. For large sums or complex cases, a lawyer helps you follow your interests in the case.

Are screenshots enough as evidence?

They help but are incomplete. Export chats from the app, save e-mails in original format with headers, and keep bank statements and transaction identifiers. Do not reset or format the phone or computer used during the fraud before it is analysed.

An “international lawyer” says they can recover my money. What should I do?

Do not reply and do not pay anything upfront. Unsolicited messages promising recovery after a fraud are very often a second scam. If you want a lawyer, choose one yourself after checking their bar registration.

The clip with a public figure recommending the investment looked real. How can I tell?

Current deepfakes are convincing. Check the offer through the person’s or institution’s official channels and in the financial supervisor’s registers. Both the National Bank of Romania and DNSC have publicly warned that the image and voice of well-known people are used in such frauds.

What can technical analysis do in an online fraud case?

It can reconstruct how the fraud happened, which apps or pages were used, where data and money were sent, and document the evidence so that its integrity can be verified. The result supports the criminal complaint and the lawyer’s work, without guaranteeing recovery of the money.

Sources

Romanian Criminal Code, art. 249 (computer fraud)
DNSC, Annual Activity Report 2025 (August 2026)
National Bank of Romania, public warning of 18.02.2026 on deepfake posts
Romanian Police, February 2026 warning on cloned-voice fraud

Alexandru Angheluș, ProDefence. Cybersecurity specialist and author of several published analyses on online financial fraud and bank phishing.