I gave a password or a code
Someone may have it now. These steps lock them out, most urgent first.
Was it a code from your bank?
Call your bank now, on the number on your card. A code can approve a payment.
Change that password now.
Go to the real website or app yourself; don't use a link from the message. Gave a code? Change the password of the account it was for. Use the same password anywhere else? Change it there too, your email first.
Work account or work device?
Tell IT now: they can lock it and check what was reached.
Already locked out?
Use the site's own “Forgot password” or account recovery page, typed in yourself, and tell them the account was taken over.
Look for changes you didn't make.
In the account's settings: a new recovery email or phone number, new devices, email forwarding, payments or payees. Undo them, so they can't use them to get back in. Was it your email? Warn your contacts not to act on odd requests sent from it.
Sign out of all other devices.
In the same settings, usually under Security or Devices. This signs out other phones and computers.
Turn on two-step sign-in.
A code or an approval on your phone each time someone signs in. It's in the same settings, usually under Security or Sign-in.
Report it.
Report it to your police or your country's fraud reporting service, even if you lost nothing. Reports help stop the same scam reaching others. Add your screenshot of the message, if you took one.
From now on
Watch for the next message or call.
Scammers often come back with a more convincing one, sometimes pretending to be your bank or the police. Check it here before you act.