After a scam, the hard part is knowing what to fix first. Start with your primary email, then banking and payment apps, WhatsApp, cloud backups, social accounts, and work accounts. Change passwords from a trusted device, revoke active sessions, enable two-factor authentication, and contact your bank if money or payment details were exposed.
The exact cleanup depends on what happened, so first write down what the scammer actually got.
Step 1: Write down what was shared
Make a quick list. It does not need to be neat:
- OTP
- Password
- UPI PIN
- Card number, CVV, or PIN
- Net banking details
- Aadhaar, PAN, passport, or other ID
- Email access
- WhatsApp access
- Remote access to phone or computer
- APK or unknown app installed
- Payment sent
- Photos, documents, or contact list exposed
That list decides the order of cleanup.
Step 2: Secure your main email first
Your email account is the recovery key for many other accounts.
From a trusted device:
- Change the email password.
- Sign out of all other sessions.
- Review recovery phone and recovery email.
- Turn on two-factor authentication.
- Check forwarding rules and filters.
- Review recent security activity.
- Remove unknown connected apps.
If the scammer controls your email, they can reset many other accounts.
Step 3: Secure banking, wallets, and UPI
Contact your bank or payment app immediately if:
- You shared OTP, UPI PIN, card details, or net banking details
- You installed a remote access app
- Money moved
- You see unknown beneficiaries or transactions
- The scammer saw your screen while a banking app was open
Ask the provider to block risky access, review transactions, and guide the next steps.
Step 4: Secure WhatsApp
If the scam involved WhatsApp:
- Check linked devices
- Remove unknown linked devices
- Enable two-step verification
- Warn close contacts if impersonation is possible
- Do not share the 6-digit registration code
- Watch for messages asking contacts for money
WhatsApp takeover scams often target your contacts next.
Step 5: Remove risky apps and permissions
If you installed an APK, remote access app, screen sharing app, or loan app:
- Disconnect any active session.
- Uninstall the app.
- Review accessibility permissions.
- Review notification access.
- Review SMS, contacts, files, and screen recording permissions.
- Run a security scan if available.
- Change important passwords from another trusted device.
If the device still behaves strangely, get professional help or consider a full reset after backing up important data.
Step 6: Change reused passwords
If you typed a password into a suspicious page, change it everywhere it was reused.
Prioritize:
- Banking and wallets
- Social media
- Cloud storage
- Work accounts
- Shopping accounts with saved cards
- Telecom and SIM-related accounts
Use unique passwords for each account.
Step 7: Preserve evidence
Save:
- Phone numbers
- URLs
- Screenshots
- App names
- UPI IDs
- Bank account details
- Transaction IDs
- Chat logs
- Emails
- APK file names
- Remote access codes if visible
Evidence helps banks, platforms, and cybercrime reporting teams understand what happened.
Step 8: Expect follow-up scams
After a scam, victims are often targeted again. The next message may pretend to be a refund, recovery agent, police officer, lawyer, or platform support team.
Watch for:
- Recovery agents asking for fees
- Fake police or lawyer threats
- Refund messages
- More OTP requests
- Calls claiming your complaint can be fast-tracked
- People asking you to move money to a safe account
Do not pay anyone who promises to recover money through a private channel.
What to send to Kaval
Send the message, link, payment screenshot, app name, or situation summary to Kaval.
The cleanup plan should depend on what was exposed:
- OTP shared
- Link clicked
- Password entered
- Remote access installed
- Payment made
- WhatsApp compromised
- Data leaked
For a specific link-click incident, read I clicked a phishing link. What should I do now?.
The short version
Secure email first, then money accounts, WhatsApp, cloud, social, and work accounts. Change passwords from a trusted device, revoke sessions, enable two-factor authentication, remove suspicious apps, preserve evidence, and contact your bank immediately if payment details or money were involved.