What to Do If You Responded to a Lottery Scam Message

Stop contact and identify what you shared

If you responded to a suspected lottery scam, stop replying and do not send any more money or information. You do not need to convince the sender that you know it is a scam. Focus on limiting further exposure.

If you have just sent money, contact your bank or payment provider immediately. If someone has remote access to your device, disconnect that device from the internet and use another trusted device to seek help.

Otherwise, work through this checklist. More than one row may apply.

Do not return to the suspicious page to investigate. If you are still unsure about the message, use How to check an unexpected lottery win message safely, but do not delay urgent protective steps while trying to confirm every detail.

Choose the steps that match what you shared or did; more than one branch may apply. — AI-generated editorial illustration

If you clicked a link but entered nothing

Close the page and do not accept further prompts, notifications or downloads. A click is not the same as giving someone your password or installing their software, so do not assume that clicking alone means your account was taken over.

Check your browser's downloads and site permissions without reopening the link. Remove any notification permission you granted to the suspicious site. If a file downloaded, do not open it. If you opened or ran it, follow the installed-software steps below.

Update your browser, operating system and trusted security software. Run a security scan if you suspect an unwanted download or notice unusual device behaviour. Avoid security tools advertised by the suspicious page itself.

If you only replied to the message, be alert for further contact: the sender now knows you may engage. You do not need to keep replying to request deletion of your details.

If you entered a password or installed software

Open the affected service independently, using its official app or a known website address—not a link supplied by the sender. If you installed suspicious software, use a different trusted device for these steps.

1. Change the exposed password. Choose a unique password and change it on any other accounts where you reused it.
2. Review active sessions and signed-in devices. Sign out unfamiliar sessions, or all other sessions if that option is available.
3. Check recovery email addresses, telephone numbers and security settings for changes you did not make.
4. Enable multifactor authentication where available. Never share verification codes or approve unexpected sign-in requests.
5. Review recent activity for unfamiliar purchases, messages or account changes.

If your email account was exposed, prioritise securing it because it may be used to reset passwords elsewhere. Check for unfamiliar forwarding rules too. If you cannot sign in, use the service's official account-recovery process.

If you entered a one-time code or approved a login prompt, tell the provider: that action may have authorised access even if you did not reveal your password.

For installed software or remote access, disconnect the affected device from the internet and seek help from the device manufacturer, your workplace IT team where applicable, or a trusted security professional. Do not accept technical assistance offered by the scammer. Uninstalling an app alone may not resolve every change it made.

If you sent money or payment details

Contact your bank or payment provider promptly, using its official app, an independently verified website or the number on your card. Do not use a supposed fraud-support number from the lottery message.

Explain accurately what happened, including whether you authorised a payment because you were deceived. Give the transaction date, amount, recipient details and reference if available. Ask:

• Can the payment be stopped, recalled or disputed?
• Should the card or account be restricted or replaced?
• Are there pending payments or newly added payees to check?
• What evidence should you submit, and through which secure channel?

If you disclosed card details but have not seen a charge, still contact the issuer. It can advise on protective steps rather than waiting for a transaction to appear.

For a transfer service, gift card or cryptocurrency payment, contact the relevant provider promptly and keep receipts or transaction identifiers. The available options depend on the payment method and circumstances. Reimbursement is not guaranteed, and some transfers may be difficult or impossible to reverse.

The US Federal Trade Commission's guidance for people who have paid a scammer describes actions by payment type. Outside the US, use your provider and local consumer-protection authority for applicable procedures.

If you shared personal information

Make a private list of exactly what you disclosed: your name, address, date of birth, telephone number, bank information, identity-document image or government identification number. This helps institutions give relevant advice. Do not post that list publicly or send more documents to the suspected scammer.

Contact the institution responsible for the exposed information through a trusted channel. For example, ask the document issuer what to do after sharing a copy of an identity document, or ask your bank about exposed account details.

Monitor affected accounts and statements for unfamiliar activity. Treat follow-up calls with caution, even if the caller knows personal details you supplied. That knowledge does not prove they represent a bank, regulator or lottery operator.

Identity-protection services, fraud alerts, credit restrictions and reporting procedures vary by country. Check your local consumer-protection authority or official identity-theft service rather than assuming another country's process applies. US readers can consult IdentityTheft.gov for recovery guidance.

Lottery laws also differ by country. If you need to check an operator's status or participation rules, consult the relevant local regulator independently; the sender's claim of legality is not evidence.

Preserve evidence and avoid recovery scams

Save evidence already available to you without reopening suspicious attachments or revisiting the website. Useful records include:

• Messages and screenshots showing the requests made.
• Sender addresses, account handles and telephone numbers.
• Dates, transaction references and receipts.
• A short timeline of what you clicked, shared, installed or paid.

Report the message through the messaging platform and notify any affected account or payment provider. Use your country's official fraud-reporting or police channel where appropriate. Preserve the evidence before blocking the sender, but do not delay contacting your bank while assembling a perfect record.

Be wary of anyone who later promises to recover your money for an upfront fee, requests account credentials or asks for remote access. They may claim to be an investigator, lawyer or recovery specialist. Verify any organisation independently. The FTC's refund and recovery scam guidance explains this follow-up risk.

Your next step: address the highest-risk exposure first

You do not have to solve everything at once. Contact the payment provider if money or payment details were involved, secure exposed accounts, and get trusted device support if software was installed. Then preserve records, report and block.

Keep any case references and follow the institution's instructions for monitoring or follow-up. Do not send another fee to release a prize or undo the earlier payment. Winning is never guaranteed, and a lottery claim is not a reason to bypass ordinary account-security checks.

For future messages, keep this guide to checking an unexpected lottery win message safely handy. Responding once does not oblige you to continue: ending contact now is a useful protective step.

Sources

• Federal Trade Commission: What To Do if You Were Scammed — Official US consumer guidance on payments, exposed information, account credentials and device access after a scam.
• IdentityTheft.gov — Official US identity-theft recovery resource; identified as US-specific rather than a universal reporting process.
• Federal Trade Commission: Refund and Recovery Scams — Supports the warning about follow-up offers to recover losses in exchange for fees or sensitive information.