Incident help

Then check

• Did you enter data or open a file? If not, there is usually no harm
• Check for updates and run a scan with the built-in protection

Secure evidence

• Don't delete the message before reporting it; screenshot including sender

Change credentials

• Only needed if you entered data – then see 'Entered a password'

Contact provider, bank or platform

• Report the message to the impersonated provider's abuse address if one exists

Keep watching

• Watch for unusual sign-ins or messages over the next days

When outside help makes sense

If a file was opened and the device behaves oddly, an IT repair service or consumer advice centre can help.

Then check

• Is the password used elsewhere? Change it there too
• Are recovery email and phone number still correct?

Secure evidence

• Note the phishing message and the fake site's address

Change credentials

• Turn on MFA or a passkey
• New unique password from your password manager

Contact provider, bank or platform

• For bank or payment data, also contact the bank directly via its known number

Keep watching

• Watch the account's sign-in history and notifications for a few weeks

When outside help makes sense

If you can no longer sign in, use the provider's official recovery route.

Then check

• Check forwarding, filter rules and auto-replies
• Check recovery details and connected apps

Secure evidence

• Screenshots of suspicious rules and sent messages

Change credentials

• Turn on MFA
• Change passwords of other accounts that can be reset via this address

Contact provider, bank or platform

• Warn contacts if messages were sent in your name

Keep watching

• Watch for password-reset emails from other services

When outside help makes sense

If money was demanded or others were defrauded in your name, reporting to the police can make sense.

Then check

• Check linked email and phone number
• Remove third-party apps with access

Secure evidence

• Screenshots of posts or messages that are not from you

Change credentials

• Turn on MFA
• Check the linked email account's password

Contact provider, bank or platform

• Warn friends via another channel – requests for money in your name often follow

Keep watching

• Check profile and messages for further changes

When outside help makes sense

With extortion or identity misuse, a police report can make sense.

Then check

• Check transactions for unknown payments
• Was a new approval app or device registered?

Secure evidence

• Keep messages, call times and statements

Change credentials

• Reset banking PIN and password after speaking to the bank

Contact provider, bank or platform

• Clarify chargeback or refund options with the bank

Keep watching

• Watch transactions closely for several weeks

When outside help makes sense

With unauthorised debits a police report often makes sense; some banks ask for one.

Then check

• Check statements and saved payment methods in online accounts

Secure evidence

• Keep records of unknown transactions

Change credentials

• Change passwords of accounts where the card is saved

Contact provider, bank or platform

• Dispute unauthorised charges with the card issuer or payment service

Keep watching

• Check the new card before saving it again

When outside help makes sense

With misuse, a police report can support your dispute.

Then check

• What data is out there? ID, address, bank details?
• Request a free report from credit agencies

Secure evidence

• Collect letters, reminders, order confirmations and correspondence

Change credentials

• Check passwords and MFA on key accounts

Contact provider, bank or platform

• Dispute incorrect credit agency entries
• Tell creditors in writing that you did not order anything

Keep watching

• Watch post, transactions and credit reports for several months

When outside help makes sense

A police report usually makes sense here; the reference number helps with retailers and debt collectors.

Then check

• How did you pay? That decides what can be recovered

Secure evidence

• Keep order, payment receipt, shop address and chats

Change credentials

• Change your password if you created a shop account with a known password

Contact provider, bank or platform

• Ask the seller in writing to deliver or refund

Keep watching

• Watch for further debits and follow-up phishing

When outside help makes sense

With fraud, a police report makes sense. Consumer advice centres advise on online purchase rights.

Then check

• Was the device locked with PIN or biometrics?

Secure evidence

• Find the device number (IMEI) and receipt

Change credentials

• Change your platform account password
• Have banking and payment apps signed out via your bank

Contact provider, bank or platform

• Inform your bank if banking or payment apps were installed

Keep watching

• Watch for sign-ins and password resets

When outside help makes sense

With theft, a police report is often required by insurers and mobile providers. Only wipe remotely once recovery is unlikely.

Then check

• Do you have backups that are not connected?
• Which accounts were used on the device?

Secure evidence

• Photograph the ransom note, note the time

Change credentials

• From a clean device, change passwords of key accounts

Contact provider, bank or platform

• If banking was used on the device: inform your bank

Keep watching

• Keep monitoring accounts and devices after clean-up

When outside help makes sense

An IT repair service can help with clean-up and data recovery. With extortion, a police report makes sense.

Then check

• Is there a backup, cloud copy or recycle bin with older versions?

Secure evidence

• Note what existed when

Change credentials

• Only needed if outside access is suspected

Contact provider, bank or platform

• For cloud services, ask support about recovery options

Keep watching

• After recovery, set up automatic backups

When outside help makes sense

With faulty hardware a professional data recovery service can help – your own repair attempts may destroy data for good.

Then check

• Where is it happening? Class, group, platform?

Secure evidence

• Save screenshots with date, profile names and links

Change credentials

• Tighten privacy settings, protect the account if needed

Contact provider, bank or platform

• Report and block content and profiles on the platform
• For pupils, involve the school

Keep watching

• Notice changes in behaviour, check in regularly

When outside help makes sense

Advice services such as klicksafe can help. With threats, extortion or sharing of intimate images, a police report can make sense.