Targeted by a Lottery Scam? What to Do, and Where to Report

If you think you have been targeted, the immediate priority depends on one question: has money moved?

If it has not, the whole matter is a two-minute report and a block. If it has, act today — recovery odds fall sharply with time, and several of the steps below are time-limited by the payment provider rather than by law.

If no money has moved

1. Stop responding. Do not reply, do not call the number, do not click anything. Mega Millions notes a specific reason: "If you engage them in conversation, your name and contact information could end up on a list that's shared with other scammers" (Mega Millions).
2. Do not use their verification. Any number, link or "claims agent" they supplied is part of the same operation.
3. Keep the evidence. Screenshot the message with the sender address visible, keep the envelope and postmark, note the phone number and time. This is what a report needs.
4. Report it — routes below. It is free and takes minutes.
5. Block and delete.
6. Tell someone. The FTC's own advice ends with "tell your friends and family to help them avoid a prize scam", and the people most heavily targeted are older adults, who are also least likely to have seen this pattern described.

If money has already moved

Act in this order.

1. Contact your bank or payment provider immediately. Say the words "I have been the victim of a fraud" and ask them to attempt recall and to secure the account. Speed genuinely matters; some rails can be stopped within hours and not after.

2. Stop all further payments. There is no next fee that releases the prize. The escalation pattern is designed to run until the money is gone.

3. If a cheque was deposited, tell the bank now. The FTC's fake check guidance explains that funds are made available before a cheque is verified, and that when it bounces the account holder is liable for the full amount.

4. If you forwarded money for someone else, stop and get advice. Moving funds on behalf of a stranger makes you a money mule, and the US Department of Justice warns that knowingly doing so can lead to criminal charges (DOJ Money Mule Initiative). Reporting promptly is the right move, not a risk to avoid.

5. If you gave identity details, treat it as identity theft. In the US that means IdentityTheft.gov, which produces a personalised recovery plan. Elsewhere, notify your bank and credit reference agencies and consider a fraud marker.

6. Report it, then expect a second approach. Victims are routinely contacted later by someone offering to recover the lost funds for a fee. That is the same fraud, recycled, targeting people already known to pay.

Where to report, by country

Report to your own country's agency, not the one named in the message. If the message impersonated a specific lottery, also tell that operator — Mega Millions asks people to "contact your local lottery if you have any questions or have received a suspicious email or phone call", and operators use these reports to issue public advisories.

Where the approach came through a platform — a social account, a marketplace, a messaging app — report it there as well. Platform reports and regulator reports do different jobs: one can remove the account, the other feeds enforcement.

Why report when the money is gone

Reporting rarely recovers funds. It is still worth the five minutes, for three reasons.

It is the dataset. The FTC's Consumer Sentinel Network recorded 97,350 prize, sweepstakes and lottery fraud reports in calendar year 2024, with $351 million in reported losses. Those figures exist only because people filed reports, and they are what justifies enforcement resource, blocking orders and public warnings.

Under-reporting is the biggest weakness in the numbers. Prize fraud carries embarrassment, and embarrassment suppresses reporting more than it does for other frauds. Every unfiled report makes the problem look smaller than it is.

Reports drive concrete action. The ACMA publishes ongoing blocking of illegal gambling sites by Australian internet service providers, triggered by investigation and complaint. The Gambling Commission's regulatory actions register records enforcement against licensees. Aggregate reporting is what starts those processes.

What not to do

• Do not pay "one more fee". There is no fee that ends it.
• Do not use a recovery service that approached you. Legitimate help does not cold-call victims.
• Do not send documents to "prove identity" to anyone who contacted you unsolicited. That is a second harvest.
• Do not stay quiet out of embarrassment. These operations are professional, they target hundreds of thousands of people, and — as the FTC data shows — most people who receive one do not lose money precisely because someone described the pattern to them first.

Preventing the next one

The three checks that stop every version of this are in how lottery scams work: did I enter, am I being asked to pay, and does the organisation exist on a public register. The longer checklist is ten red flags in a win notification, and the single most useful background fact is that no real lottery contacts winners at all.

This is general information, not legal advice. If a substantial sum has been lost, or if you may have moved money for someone else, take local professional advice as well as reporting.