What to Do First When a Scammer Still Has an Open Chat With You

Short answer: If a scammer is still messaging you, stop sending money, codes, or personal information. Save the chat and any payment details as evidence, secure any exposed accounts through official channels, then report and block when it is safe to do so. If you are in immediate physical danger or facing stalking or threats, prioritize real-world safety first.

Date checked: This guidance was reviewed against the currently supplied public sources before publication; the source set is broad cyber-safety guidance rather than platform-specific help documentation.

An open chat is still an active risk. It gives the sender another chance to apply pressure, create urgency, ask for more money, or move you to another app, account, or payment route. A safer first response is usually to pause the interaction, preserve what is already visible, and make decisions outside the live conversation.

If crypto was involved, save wallet addresses, network details, and transaction hashes if you have them. Those details can help document what happened, but they do not by themselves prove who controls the receiving wallet.

Public cyber-safety guidance commonly warns users to be cautious with unsolicited contact, suspicious links, pressure tactics, and requests for sensitive information. In practice, that means a live scam chat is not just a record of what happened already; it can also be the channel for the next attempt to extract money, data, or account access.

A second risk is impersonation. If someone in the chat claims to be support, compliance, investigators, or a recovery service, do not rely on the identity presented inside the conversation. Verify any such claim through official contact points you find independently.

• demands for a final fee, release fee, tax, or verification payment
• pressure to switch to another app, wallet, or account
• requests for one-time codes, ID documents, or wallet recovery details
• urgent claims that you must act immediately to avoid losing funds
• claims that only the person messaging you can solve the issue

A chat can preserve useful evidence such as timestamps, usernames, phone numbers, wallet addresses, payment requests, and links. But a chat log alone usually does not confirm the sender's real identity, location, or legal control of a wallet or account.

Do not send more money, a final test payment, one-time login codes, identity documents, wallet recovery phrases, or private credentials. If you already suspect fraud, the first goal is to stop further loss and reduce exposure.

Capture the details that are easiest to lose:

1. full-screen screenshots of the conversation
2. the visible username, handle, phone number, or profile name
3. dates and timestamps shown in the chat
4. wallet addresses, payment instructions, and transaction references
5. links, email addresses, or account names they told you to use

Store the records somewhere you control. If you later report the incident, original screenshots and payment details are more reliable than trying to rebuild the timeline from memory.

Do not negotiate, argue, or try to fact-check the scammer inside the same chat. If needed, mute notifications and work from a separate checklist so the sender cannot keep steering your decisions in real time.

If the scammer knows your email address, phone number, exchange login, or similar details, review those accounts through the official app or website. Depending on the account, sensible high-level steps can include changing passwords, reviewing active sessions or linked devices, and checking authentication settings through official help pages.

If crypto was involved, note the wallet addresses, the blockchain network, and the transaction hash. These details can help preserve an accurate record of the transfer. They can show that a transfer happened on-chain, but they do not automatically identify the recipient.

Once you have preserved the key evidence, use in-app reporting tools where available and use official reporting or cyber-safety channels you locate independently. Blocking can help stop further contact after you have what you need. If the situation involves harassment, stalking, threats, or immediate safety concerns, leave the conversation sooner and prioritize personal safety.

• stop sending money, codes, documents, or wallet credentials
• screenshot the chat, profile details, and payment demands
• save wallet addresses, transaction hashes, and the network used if crypto was involved
• review exposed email, phone, exchange, or wallet-linked accounts through official access points
• report the account or conversation in-app if that option exists
• block after evidence is saved, unless immediate safety means you should exit sooner

Reality: Continuing the conversation can create more pressure and more opportunities for the scammer to ask for money or information.

Reality: Another payment demand is a warning sign, not proof that a release is real.

Reality: It may help document where funds were sent, but it does not by itself confirm the recipient's real-world identity.

Reality: Claimed support identities should be verified independently through official contact channels.

Do not treat the fee request as proof that the funds are recoverable. Save the message, record any wallet or payment details, and check the real platform's official support channel separately.

Do not rely on the displayed name or avatar. Go to the official website or app you already know and verify support options there instead of using contact details sent in the chat.

Shift from conversation management to containment. Review the affected account through official access points, update security settings where appropriate, and monitor related accounts the scammer may try next.

• arguing with the scammer after you already suspect fraud
• paying a small final fee to test the story
• trusting a new helper who appears soon after the loss
• using support links or phone numbers supplied by the suspicious contact
• sharing screenshots publicly if they expose your own personal information

Usually, no. If you already saved the key evidence, more contact may only create more pressure or new demands.

Where it is safe, save the key evidence first, then report and block. If there is harassment, stalking, threats, or an immediate personal safety issue, prioritize safety over preserving a perfect record.

Those details are not the same as wallet control. They may expose public transaction history on a blockchain, but they do not by themselves give someone your seed phrase, private key, or account password.

This article does not assume that ongoing contact improves recovery prospects. In many cases, continuing the exchange mainly increases exposure to more pressure, impersonation, or further payment requests.

• CERT Polska — official cyber-safety alerts and guidance.
• NASK — official cybersecurity institution.
• Gov.pl: Cyberbezpieczeństwo — official government cyber-safety guidance.