Resource · Immediate reflexes
After a hack, the aim is not to erase everything: it is to preserve the evidence that matters. Here are the six reflexes common to almost every incident: bank fraud, fake tech support, hacked email account, virus or suspected compromise.
We will never ask for your codes. First conversation free and with no commitment.
Overview
Stop, preserve, secure, alert, document, then choose the right level of help. This sequence lets you decide quickly without deleting material that may be useful later.
The principle
Panic pushes you to delete, reset, start all over again. That is often the move that costs the most.
After a hack, the natural reaction is to make what happened disappear. Yet badly preserved evidence cannot be recovered: it is precisely this material that will serve your bank, your insurer, your lawyer or a police complaint.
The aim of the first hours is not to do a lot, but to do the right things in the right order: stabilise the situation, keep what may be useful, secure access, then document. The rest (clean-up, reset, remediation) comes afterwards, without haste.
Don’t delete messages or traces, don’t reset the device before noting what happened, and don’t pay any sum under pressure. A legitimate contact (bank, platform, support) will never ask you for your codes, or ask you to approve a transaction in order to cancel it.
These six reflexes do not replace an analysis: they save you time and avoid contradictory steps. The very first action differs depending on the type of incident: here are the most common cases.
Depending on the situation
The first actions differ depending on whether it is bank fraud, fake tech support or a compromised account.
Stop your card or account if necessary, dispute the transactions quickly, and keep calls, text messages, notifications, amounts, IBANs and any payees that were added.
End the session immediately, identify the tool that was installed, then check your accounts, browser, means of payment and the programs launched at start-up.
From a trusted device, change the password, check two-factor authentication, close sessions and review forwarding rules and recovery methods.
Don’t open the file again. Note its name, where it came from and the time it was downloaded, as well as the symptoms you observed. The analysis must then distinguish a real infection, unwanted software and a mere alert: installing several clean-up tools one after another, without method, often muddies the diagnosis.
Keep the original messages, screenshots, profiles, links, numbers and dates. Don’t negotiate under pressure and don’t give in to haste: document first, before sending out scattered reports.
Pointers
Some actions are useful, but only after you have noted and kept what may serve the case file.
Gathered early, it saves you having to reconstruct the facts from memory.
They often come from good intentions, but they erase decisive material.
Describe the situation in a few words. We assess the urgency, the accounts exposed and the first actions not to miss, with no commitment and no sales pitch. We will never ask for your codes and we promise no guaranteed result.
