Your Legal Options After a Mega Millions Imposter Scam

If a message says you won Mega Millions and you did not buy a ticket or otherwise enter a lawful lottery game, stop there. There is no prize to claim. Mega Millions tells consumers that no one can win a prize for a drawing they did not enter, and the FTC gives the same basic fake-prize rule: if you have to pay to receive a prize, it is not a prize.[1][2]

The same answer applies if the contact came out of the blue, if the person demands “taxes,” “processing,” “insurance,” “customs,” or “delivery” fees, or if they ask for a bank account, card number, Social Security number, driver’s license image, or online-banking code. Those are not administrative details. They are the point of the fraud.

Decision-flow graphic showing lottery ticket, phone, fee, and bank-card warning signs leading to a scam stop sign

Mega Millions officials issued a specific warning in December 2025 about scammers using the Mega Millions logo in fake social-media “special drawing” promotions. The lottery’s warning is blunt on the most important point for a frightened recipient: Mega Millions representatives do not call, text, or email winners unsolicited.[3]

This article is consumer-protection information, not legal advice for a particular case. The useful legal question in the first hour is narrower than “Can I sue?” It is: how do you stop more money or identity data from leaving, preserve evidence, report to the right channel, and then decide whether a private claim is realistic.

The First Minutes Matter More Than the Script

Do not argue with the sender. Do not try to catch them in a lie. Do not send “one last” screenshot of your ID to prove who you are. Once any of the verification gates has failed, continued contact mostly gives the scammer time to pressure you, harvest more data, or move you to a harder-to-trace payment method.

Stop responding on every channel: text, email, social media, phone, and messaging apps.
Do not delete messages, call logs, payment receipts, envelopes, tracking numbers, or social-media profiles.
If you paid by bank transfer, wire, card, or payment app, contact the financial institution immediately and use the words “fraudulent prize scam.”
If you gave a Social Security number, account login, card image, driver’s license, or identity document, treat it as identity-theft exposure, not merely a bad conversation.
Make a short timeline while details are fresh: first contact, names used, phone numbers, email addresses, URLs, amounts requested, amounts paid, and where the money went.

For wires, bank transfers, and payment-app transfers, the practical recovery window can be very short. FTC consumer guidance stresses contacting the company or bank right away; in many cases, a 24-to-48-hour delay can make reversal or recall much harder.[2] That does not mean a bank can always pull the money back. It means waiting while you collect perfect paperwork may cost you the only useful window.

Preserve Evidence Before It Disappears

A useful fraud report is not a dramatic narrative. It is evidence that lets a bank, platform, investigator, or lawyer connect the contact method to the payment path. Screenshots are helpful, but they should not be the only copy if the original message still exists.

Evidence	Why it matters
Original texts, emails, direct messages, and voicemail	Shows the exact promise, fee demand, sender account, phone number, timing, and language used.
Payment receipts, wire confirmations, app transaction IDs, crypto wallet addresses, gift-card numbers, or bank records	Connects the scam demand to the movement of money and helps financial institutions attempt a reversal or trace.
URLs, profile links, usernames, ads, and screenshots of social-media pages	Helps platforms and enforcement agencies identify the impersonation account before it is renamed or deleted.
Letters, envelopes, tracking labels, and forged official documents	May matter for postal-inspection reports and for showing impersonation of agencies or financial institutions.
A written timeline	Prevents later confusion about when contact began, when payment was made, and when the victim notified banks or agencies.

Do not alter images to make them easier to read. If you need clearer copies, save the original and then make a separate annotated copy for your own use. If you later speak with a lawyer, the original message metadata, phone logs, and payment records may matter more than a cropped screenshot.

Why This Can Be a Federal Fraud Matter

A Mega Millions imposter scam can implicate federal wire-fraud law when someone uses interstate wires, including phone, text, email, online platforms, or electronic payments, as part of a scheme to defraud. The federal wire-fraud statute, 18 U.S.C. § 1343, covers schemes using wire communications to obtain money or property by false or fraudulent pretenses.[4]

That does not mean a victim controls whether federal prosecutors open a case. It means the conduct belongs in a category law enforcement recognizes: impersonation, false prize claims, and electronic payment fraud are not private embarrassment. They are reportable fraud patterns.

The FTC also has a Government and Business Impersonation Rule, effective April 2024, aimed at scams that pretend to be government agencies or well-known businesses. In April 2025, the FTC said the rule allows civil penalties up to $53,088 per violation and highlighted 12 enforcement actions recovering more than $70 million.[5] Those figures describe the FTC’s enforcement authority and record; they are not a promise that an individual victim will receive a refund.

Where to Report, and What Each Report Does

“Report it” is incomplete advice. Different reports serve different purposes. Some help enforcement agencies spot patterns. Some create a local incident record. Some are necessary for banks, insurers, credit bureaus, or later civil claims. None is a guaranteed refund request.

Where to report	Use it when	What it is for
FTC at ReportFraud.ftc.gov	Any fake prize, lottery, business impersonation, or payment-demand scam	Consumer-fraud reporting, pattern detection, and FTC enforcement referrals.
FBI Internet Crime Complaint Center at IC3.gov	The scam used email, websites, texts, social media, online payment systems, or other internet-enabled contact	Federal cybercrime and internet-fraud intake; useful for schemes crossing state or national lines.
Local police or sheriff	You paid money, gave identity documents, need an incident number, or your bank requests a police report	Local recordkeeping, possible investigation, and documentation for financial institutions or identity-theft files.
State attorney general or consumer-protection office	The scammer impersonated a business, used a local address, targeted state residents, or you want state consumer-protection intake	State-level consumer enforcement and complaint tracking.
U.S. Postal Inspection Service	Letters, checks, money orders, packages, or mailed forged documents were involved	Mail-fraud and postal-system investigation.
Your bank, card issuer, wire service, payment app, or crypto platform	Any money moved or credentials were exposed	Account freeze, dispute, recall attempt, chargeback review, or fraud hold.

The FTC’s ReportFraud portal is the broadest consumer-fraud starting point for fake-prize and impersonation complaints.[6] IC3 is the FBI’s internet-crime intake and is especially relevant when the contact came through email, text, websites, social media, or online payment systems.[7] If the scam used mail, the U.S. Postal Inspection Service has a separate mail-fraud complaint channel.[8]

Local police reports are still worth considering when money or identity documents are gone, even if the officer cannot promise an investigation. Banks, credit bureaus, identity-theft recovery programs, and lawyers may ask for a report number. Ask for a copy or incident number before you leave the station or end the call.

Forged Letterhead Is Pressure, Not Proof

Scammers know that an agency seal can make a victim stop thinking and start complying. A still-relevant FBI Atlanta warning from 2016 described a Mega Millions lottery scam that used forged FBI and FDIC letterhead to make fake “official verification” documents look legitimate.[9] The date matters: that warning is not fresh 2026 news. The pattern remains useful because forged agency branding is a recurring intimidation tool.

A real agency letter does not turn an unsolicited prize claim into a real prize. If the document tells you to pay first, keep the win confidential from your bank, contact only one named “agent,” or provide account credentials to release funds, treat the document as evidence of the scam rather than evidence of a prize.

If You Paid: Work the Payment Channel First

The first recovery attempt usually runs through the payment channel, not through a fraud complaint portal. Enforcement reports matter, but they do not freeze a wire, reverse a card charge, or lock a compromised bank account by themselves.

Bank transfer or wire: call the bank’s fraud department immediately, ask for a recall or hold, and write down the case number, time, and representative name.
Credit or debit card: dispute the charge as fraud, request a new card number, and ask whether related recurring payments or digital-wallet tokens must be disabled.
Payment app: use the app’s fraud-reporting process and also contact the linked bank or card issuer; do not rely only on an in-app chat.
Gift cards: contact the card issuer with the card number and receipt; ask whether the balance has been redeemed and whether a freeze is possible.
Cryptocurrency: contact the exchange or platform used to buy or send funds; reversal is often difficult, but transaction IDs and wallet addresses are still important evidence.

If the scammer has online-banking credentials, change passwords from a clean device, enable multifactor authentication, and ask the bank whether accounts should be closed and reissued. If a Social Security number or identity document was provided, consider placing fraud alerts or credit freezes and using identity-theft reporting tools. The goal is to stop the second injury: account takeover or new-account fraud after the fake prize demand.

When a TCPA Claim May Be Worth Asking About

A private lawsuit is a different path from a criminal report. The most realistic civil route for many recipients is not “suing the Mega Millions scammer” in the abstract. It is asking whether the calls or texts violated the Telephone Consumer Protection Act.

The TCPA, 47 U.S.C. § 227, restricts certain unsolicited calls, prerecorded or artificial-voice calls, autodialed calls, and text-message practices. The statute provides $500 per violation, with possible trebling to $1,500 for willful or knowing violations.[10] Actual recoverability depends on facts such as consent, call technology, sender identity, number ownership, arbitration issues, class-action strategy, and available defendants.

That distinction matters. Reporting to the FTC or IC3 helps enforcement agencies. A TCPA claim is a private civil claim, often evaluated by consumer class-action lawyers when there are repeated texts or calls, a traceable sender, or evidence that a lead generator, marketing platform, or identifiable company was involved. A one-off message from an overseas imposter using a spoofed number may be hard to turn into a collectible civil case, even if it was unquestionably fraudulent.

What to save for a TCPA screening

The full phone number that received the call or text, and whether it is a cell number.
Screenshots showing the sender number, message content, date, and time.
Call logs, voicemails, prerecorded-message recordings, and any “press 1” prompts.
Proof that you asked the sender to stop, if that happened.
Any link clicked, form submitted, company name displayed, or caller ID shown.

Do not assume statutory damages are automatic. The $500-to-$1,500 range is the statutory framework, not a settlement quote. A lawyer still has to identify a viable defendant, prove the contact violated the statute, and evaluate deadlines and defenses.

What Not to Do After Reporting

After a report is filed, expect follow-up scams. Fraud victims are often contacted again by people claiming they can recover the money, unlock the prize, or represent a government office. A demand for an advance recovery fee is another fraud signal, not a service.

Do not pay a “recovery agent” who contacts you first.
Do not give remote access to your phone or computer to someone claiming to help with a refund.
Do not withdraw a complaint because the scammer promises a refund.
Do not send more identity documents to “verify” a prior report unless you initiated contact through an official agency portal or verified phone number.

Keep a single folder for the case: reports filed, confirmation numbers, bank letters, police incident numbers, screenshots, and notes from phone calls. If a bank denies a dispute or a lawyer later evaluates a TCPA or consumer-protection claim, scattered evidence slows the review.

The Practical Legal Boundary

A Mega Millions imposter scam can involve federal fraud, unlawful impersonation, mail fraud, identity theft exposure, and, for some call or text campaigns, TCPA violations. The victim still does not get to command prosecution, and no report portal can promise repayment.

The defensible sequence is simple enough to follow under stress: stop contact, contact the payment provider, preserve originals, file the right reports, lock down identity exposure, and ask a consumer lawyer about TCPA or other civil claims if the calls or texts are documented. Outcomes depend on speed, payment method, documentation, traceable defendants, statutory deadlines, and individualized legal advice.