Scammed by a CSR2 Modder? What to Do Next, Step by Step

If you're reading this, something has probably just gone wrong. Maybe you paid a CSR2 modder who went quiet. Maybe you handed over your login and now it doesn't work. Maybe the gold arrived and then the account disappeared.

Whatever kind of CSR2 mods scam it was, the order you do things in matters. Lock down the account first, because that's the thing that can get worse by the hour. Then chase the money. Then report it. This guide goes through each step.

Step 1: Work out what was taken

Take a minute to sort out which situation you're in, because the next steps depend on it:

• Money only. You paid, nothing was delivered, and you never shared your login. Your account is safe. Skip to step 3.
• Login shared, still working. You shared your Apple or Google login and you can still sign in. Act now, before that changes.
• Locked out. Your password no longer works, or the recovery email or phone has been changed. This is the urgent one.
• App installed. You downloaded a “mod” app or APK. Deal with the phone as well as the account.

Step 2: Secure your account

Your CSR2 progress lives on the platform account the game is linked to: your Apple Account through Game Center on iPhone, or your Google Account through Google Play Games on Android. That's what you need to protect.

If you can still sign in

1. Change the password to something new that you don't use anywhere else.
2. Check the recovery details. Make sure the recovery email and phone number are yours. Scammers change these first, so that they can take the account back later.
3. Sign out devices you don't recognise. In your Apple Account settings, remove any devices that aren't yours. In your Google Account, open the security page and sign out of unknown devices.
4. Turn on two-factor authentication with your own phone, if it isn't on already.

If you're locked out

Use the official recovery routes only. For an Apple Account, that's Apple's account recovery at iforgot.apple.com. Apple may ask you to wait while it verifies you, and contacting support can't shorten that wait. For a Google Account, use Google's account recovery page at g.co/recover. Both are free. Answer with as much accurate detail as you can, such as old passwords, when you created the account and devices you've used.

If you installed an app or APK

Uninstall it, then run a scan with Google Play Protect on Android. Change the passwords of any accounts you signed in to on that phone afterwards, not just your game login. Our mod APK guide explains what these files can do and how to clean up.

Step 3: Go after the money

How you paid decides your options. Move quickly, because every route has a deadline.

You paid with	What to do
PayPal (goods and services)	Open a dispute in PayPal's Resolution Center. You have 180 days from the payment, and if it isn't settled with the seller, escalate it to a claim within 20 days.
PayPal “friends and family”	Still contact PayPal and report it, but these payments usually have no purchase protection.
Debit or credit card	Call your bank or card issuer and ask about a chargeback for goods not received.
Gift card	Contact the gift card company immediately with the card number and receipt. Unspent balances can sometimes be frozen.
Crypto	Usually irreversible. If you sent it from an exchange, report the address to the exchange anyway.

Whichever route you use, gather your evidence first: screenshots of the conversation, the listing or offer, the payment receipt and the seller's username or profile link. Do this before the seller deletes anything.

Step 4: Report it

• To the game. Contact CSR2's official support through the help option in the game and explain what happened, especially if your account was taken.
• Where you met them. Report the account on Discord, Reddit, Instagram or wherever the offer came from. Reports are how scam accounts get removed.
• To the community, carefully. A short, factual warning (what was offered, the username, what happened) helps the next player. Stick to facts and leave out anything you can't show.

Talking to the scammer: what not to do

It's tempting to fire off angry messages. A calmer approach protects you better and helps your dispute.

• Ask once, in writing, for a refund or delivery. A single clear message (“I paid on this date for this item and nothing was delivered. Please refund me.”) becomes evidence that you tried to settle it.
• Don't send anything else. No more payments, no codes from your phone, no new login details, whatever reason they give.
• Don't threaten them. It rarely helps, and it can muddy a dispute that would otherwise be straightforward.
• Don't delete the conversation. Even if it's embarrassing, it's your best evidence.

How long each step takes

Knowing what to expect stops you from panicking or giving up too early.

Step	Realistic time
Changing your password and signing out devices	A few minutes
Apple account recovery when you're locked out	Can take several days, because Apple adds a waiting period to protect the account
Google account recovery	Often quick, longer if Google needs to verify you
A PayPal dispute	Open it within 180 days; settling can take a few weeks if it goes to a claim
A card chargeback	Usually a few weeks, depending on your bank

Start the account steps today and the money steps this week. The account is what can get worse by the hour; the dispute deadlines are measured in months.

Step 5: Don't get scammed twice

Right after a scam is when people are most at risk of a second one. Watch for these:

• “Recovery experts” who message you offering to get your account or money back for a fee. They can't, and they're targeting victims on purpose.
• The scammer coming back with “one more payment and it'll go through”. It won't.
• Fake support accounts pretending to be Apple, Google, PayPal or the game, asking for your password or a code. Real support never asks for your password.

How to avoid a CSR2 mods scam next time

Most CSR2 scams follow the same few patterns, and the same handful of checks catch them. A legit service asks only for your platform sign-in, takes payment with a dispute process, has written refund terms and is still reachable after the sale. Our guide on whether CSR2 mods are legit has the full checklist, including how to read Reddit threads and Discord servers before you pay.

If you were caught out by a cheap account listing, our explainer on buying a CSR2 account for sale covers why those deals go wrong so often.

If something goes wrong with an order from us

We'd rather sort it out than have you go through any of the above. Message us in the site chat or email support with your order number. If an order isn't delivered, or what arrives isn't what you paid for, our refund policy sets out exactly what happens, and you can see how a normal order runs in our CSR2 mod service walkthrough.

Your recovery checklist

Secure the platform account first: password, recovery details, unknown devices and two-factor authentication. Then dispute the payment through whatever you paid with, with your evidence saved. Report the scammer where you found them, ignore anyone offering paid recovery, and use the CSR2 mods legit checklist before you trust the next seller.