Contain
Stop communication and payments. If remote access is active, disconnect the device from networks and contact the relevant support team from another device.
Protect
Prioritise email, financial accounts and the phone number used for recovery. Revoke sessions, remove unknown recovery methods and use unique credentials.
Report and document
Contact the payment provider, platform and appropriate authority. Build a timeline with original messages, transaction references, account changes and case numbers.
Recover carefully
Expect follow-up recovery scams. Legitimate organisations do not need another payment, seed phrase or one-time code to release recovered funds.
If an attacker may control an account already, follow the first-hour account takeover guide before changing unrelated passwords at random.
2026-10-08. See our corrections policy if something is unclear or wrong.