Incident guide
Clicked a phishing link or typed a password or code
You opened a suspicious link, or typed a password, card details or a one-time code into a page that was not genuine.
Work through the steps in order. Tick a step when it is done; ticks stay in this browser. If a step does not apply to you, skip it.
Is this your situation?
- You opened a link in a message and then realised it was not from who it said.
- You typed a password, card number or one-time code into a page you reached from a message.
- You opened or installed a file because a message asked you to.
- You approved a sign-in request that you did not start.
Steps
First 15 minutes
The same day
The following days
Do not
- Do not open the link again to take a look.
- Do not reply to the message or call a number it contains.
- Do not do nothing because nothing seems to have happened. Codes and passwords can be used later.
- Do not delete the message before you have saved it.
Keep as evidence
- The message, saved with its full headers.
- The link as plain text, and a screenshot of the page if you captured one.
- What you typed, to which page, and at what time.
- Bank statement lines and any alert the bank sent.
Where to report
Anywhere
Your bank or card issuer
When: Right away, if you entered card details or a banking code.
How: Call the number on the back of your card or on the bank's official site, say what happened and ask for a reference number.
The platform or service concerned
When: Today, for every account whose password you entered.
How: Use the platform's own account recovery or report form, reached by typing its address yourself. Keep the reference number it gives you.
In Turkey
Siber Güvenlik Başkanlığı (USOM services)
When: When you can, with the address of the fake page.
How: Use the cyber incident report and malicious link services on siberguvenlik.gov.tr.
Police station, public prosecutor's office or the Cybercrime Branch Directorate (EGM)
When: If money was lost or you want the matter investigated.
How: Apply with a signed petition handed in person; the EGM FAQ says petitions are not accepted by e-mail. For offences that depend on a complaint, the person affected has to apply. Take the evidence you kept.
Reading from outside Turkey: contact your national CERT or the cybercrime unit of your local police. The Turkish channels above are for people in Turkey.
Incident log
Notes stay in this browser on this device and are never sent to ZEKASTRA or anyone else. Anyone who uses this browser profile can read them, so clear the log when you are done.
Sources
This guide is general information, not legal advice. It cannot recover an account or money. Follow the instructions of your bank, your employer and the authorities.