I've been scammed! What should I do?

Background

Scams come in many forms but one of the most common is via social media platforms such as Twitter, Telegram and Discord. Here are couple of examples:

Notice how they all direct you to Google form and when you click on it, they all ask for the account secret (secret numbers, family seed, mnemonic)?

If you gave your account secret away or if it has been comprised in any way, this article discusses your options.

Someone has stolen my funds

If you are the victim of a crime, you should report it to your local police department immediately.

Xumm is not part of any governmental law enforcement agency and as such, we do not have the authority to conduct a criminal investigation. Some countries have a special "cyber crime" or "financial crime" unit that you can report crimes to as well. Your local police should be able to provide you with all of your options.

My police department doesn't know anything about crypto scams

In most countries around the world, the local police departments are getting better and better when it come to investigating cyber crimes. Investigating criminal matters, which now includes crypto and blockchain, is one of the primary responsibilities of law enforcement.  If there is any chance in recovering your funds, the police will need to be involved.

Why can't Xumm just reverse the transactions and get my funds back?

The XRP Ledger does not have any administrative functions built into it, so there is no way for Xumm or anyone else to modify or change a transaction.  

For more information about this, please refer to this article:

Can Xumm reverse or undo a transaction?

What else should I do?

After you have contacted the police, you should consider doing the following:

1. Submit a fraudulent account report to XRPforensics. They track accounts involved in criminal activity.  -> https://xrplorer.com/contact
   
   Their main contact page looks like this:
   
   
   
   
   
2. Consider re-keying your account. If you do this, it will prevent the scammers from accessing your account again.
   
   Here is the link to the article that explains how to re-key.
   
   How to add a regular key / rekey your XRP Ledger account
   
   
3. If re-keying looks too complicated, you can alternatively create a new account, then move your remaining funds over to your new account then delete your compromised account.
   
   Here is the link to the articles that explain how to do this:
   
   How to create a new XRP Ledger account using Xumm
   
   How to delete your XRP Ledger account

Why can't I just change my 6 digit passcode or my signing password?

The 6 digit passcode is used to access the Xumm app and in some cases, sign transactions in Xumm. It is not used to access your XRPL account. (That's what the secret numbers are for.) Changing your passcode has no effect on your secret numbers. 

The same applies to your signing password. Both the passcode and the sign password are LOCAL security measures to protect your secret numbers locally on your phone. They do not prevent someone from accessing your account if they have your secret numbers.

Summary

• Never give your account secret (secret numbers, Family Seed, Mnemonic) to anyone for any reason.
• Contact your local police immediately if you are the victim of a crime.
• Either re-key the account
• Or create a new account and move your assets over to the new account
  • Be advised, trustlines will have to be duplicated (temporarily) in the new account until they can be removed from the old account requiring enough XRP to cover reserves for two sets of trustlines until the move is complete.

Additional reading

• Where are your funds stored? (Explainer video 2/5)
• KYC and Xumm
• Can Xumm reverse, freeze or undo a transaction?

Notes

We understand that you might have additional questions regarding this topic so you are welcome to contact us any time via the XUMM Support xApp in XUMM or you can simply scan this QR code with XUMM and be directed there automatically.