I replied to a scam email. Now what?

What your reply told the scammer

• Your email address works, and a real person reads it.
• You were willing to engage, which can move you onto a list for follow-up scams.
• Possibly your name, phone number, or location, if your email signature includes them.
• Not your password or your money. A reply alone doesn't give them access to your account.

Do this now

1. Stop replying

   Don't send a follow-up to say you know it's a scam, and don't ask to be removed. Any reply keeps the conversation going.

2. Report it

   In Gmail on a computer, open the message, click More next to Reply, and choose Report phishing. You can also forward it to [email protected].

3. Block the sender

   Then delete the thread after you've reported it, unless you need it as evidence.

4. Check what you sent

   Scroll through your sent message. Did it include anything from the list below?

Free recovery checklist

Get the step-by-step plan in your inbox

Email addressEmail me the checklist

The printable C.A.L.M. checklist and who to call. No sales pitch. Or open the checklist now (PDF).

If your reply included more than "yes" or "who is this?"

• Your phone number: Expect calls. Don't trust anyone who "follows up" on the email. See scammer has my name, address and phone number.
• A photo of an ID, a check, or a card: Treat everything on it as exposed.
• Card or bank details: Call your bank now. See I gave a scammer my card number or bank account information.
• Social Security or Medicare number: See I gave a scammer my Social Security number or Medicare number.
• A password or a code they asked for: Change the password now from a trusted device. A code is a key; assume they used it.
• You clicked a link or opened an attachment in their reply: See I clicked on a phishing link.
• You paid something: See scammed out of money? The first hour.

What to expect next

Scammers often switch tactics once they know someone is reading. Watch for these over the next few weeks:

• A friendlier follow-up: "Sorry for the confusion, here is the correct invoice."
• A threat: "Your account will be closed" or "Legal action will be taken." Real companies don't work this way.
• A phone call from someone claiming to be the company, your bank, or a "fraud department."
• A "recovery" offer if money was mentioned. Anyone who wants a fee to get money back is a scammer.

Common emails people reply to

• Fake renewal or invoice from a known brand. See the Geek Squad email scam, Norton renewal scam, and PayPal invoice scam.
• A message from a "friend" or "pastor" asking for a favor, often gift cards. The account may be hacked or spoofed. Check by calling them on a number you already have.
• A prize or sweepstakes notice. See the sweepstakes and lottery scam.
• A "romance" or new-friend message that started as a wrong number or a kind note.

If your mom or dad replied

Replying is the most natural thing in the world, especially to an email that looks like it's from a company or a friend. Ask what they wrote, not why they wrote it. If it was just a reply, help them report and block the sender, and agree that next time, they'll forward odd emails to you first.

If your parent uses Gmail, OwlGuardian can do that checking automatically. Suspicious emails go to quarantine before they're read, and you get a summary and decide in two taps.

Questions people ask