Incident guides
If it happened
Pick the situation that matches what is happening. Each guide gives you the first 15 minutes, the rest of the day and the days after, what not to do, what to keep and where to report. Ticks and notes stay in this browser.
Individuals
E-mail or social media account taken over
You cannot sign in, the password or recovery details were changed, or other people report messages you did not send.
Clicked a phishing link or typed a password or code
You opened a suspicious link, or typed a password, card details or a one-time code into a page that was not genuine.
Money left your card or bank account without your consent
A payment or transfer you did not make, or one you made after a call, message or page that turned out to be fraud.
Files encrypted or a screen demands payment
Files will not open, carry a new extension, or a note or lock screen demands payment, including screens that claim to come from the police.
Phone or laptop lost or stolen
A phone, laptop or tablet is gone and may be in someone else's hands, with your accounts and messages on it.
A blackmail or threat message
A message says you were recorded or that private material will be shared unless you pay, often in cryptocurrency.
An account is impersonating you
Someone opened a profile or page with your name or pictures, or a page copies your business.
Organisations and site owners
Website defaced, redirecting or serving malware
Your site shows content you did not publish, sends visitors elsewhere, or is flagged by browsers, search engines or your host.
Suspected personal data breach (data controllers)
Your organisation suspects that personal data was accessed, lost or sent to the wrong people, and the notification clock may be running.
These guides do not recover accounts or money and do not replace your bank, your employer or a lawyer. They help you act in a sensible order and keep what an investigator will ask for. Nothing you tick or write here is sent anywhere.