Incident guide
E-mail or social media account taken over
You cannot sign in, the password or recovery details were changed, or other people report messages you did not send.
Work through the steps in order. Tick a step when it is done; ticks stay in this browser. If a step does not apply to you, skip it.
Is this your situation?
- You are locked out, or the service says the password or e-mail address was changed.
- Your contacts receive messages or posts you did not write.
- You see sign-ins from places or devices you do not know.
- Mail is being forwarded or deleted by rules you did not create.
Steps
First 15 minutes
The same day
The following days
Do not
- Do not reuse the old password with a small change.
- Do not pay anyone who offers to get the account back for a fee.
- Do not delete messages or the account before you have saved the evidence.
- Do not follow recovery links that arrive by message; type the address yourself.
Keep as evidence
- Screenshots of sign-in alerts and security notices, with the times.
- The security e-mails you received, saved with their full headers.
- A list of the settings that were changed, and the messages sent in your name.
- The reference number from the service's recovery process.
Where to report
Anywhere
The platform or service concerned
When: Right away.
How: Use the platform's own account recovery or report form, reached by typing its address yourself. Keep the reference number it gives you.
Your bank or card issuer
When: Today, if cards, payment details or money are involved.
How: Call the number on the back of your card or on the bank's official site, say what happened and ask for a reference number.
In Turkey
Police station, public prosecutor's office or the Cybercrime Branch Directorate (EGM)
When: If the account was used to defraud others or you want the matter investigated.
How: Apply with a signed petition handed in person; the EGM FAQ says petitions are not accepted by e-mail. For offences that depend on a complaint, the person affected has to apply. Take the evidence you kept.
Reading from outside Turkey: contact your national CERT or the cybercrime unit of your local police. The Turkish channels above are for people in Turkey.
Incident log
Notes stay in this browser on this device and are never sent to ZEKASTRA or anyone else. Anyone who uses this browser profile can read them, so clear the log when you are done.
Sources
This guide is general information, not legal advice. It cannot recover an account or money. Follow the instructions of your bank, your employer and the authorities.