🎯 In 30 seconds: Work from a device you trust. Secure your email first, then the money accounts, then everything else. If a computer itself may be infected, take it offline before you do anything on it. Call your bank early, because some losses can still be stopped in the first hour. Report and clean up after the doors are shut.
First, which kind of hack is it?
| What you see | Likely problem | Start with |
|---|---|---|
| Can’t sign in; password or recovery details changed; friends get odd messages from you | An account takeover | That provider’s recovery page, from another device |
| Pop-ups, new toolbars, a cursor moving on its own, files you can’t open, a ransom note | An infected computer | Disconnect it from the internet |
| You let a “support agent” connect to your computer, or read them a code | Both: remote access and stolen details | Disconnect, then call your bank |
| Phone suddenly shows no service | Possible SIM swap | Your carrier, from another phone |
The SIM swap case has its own steps in the Security section’s phone safety page.
The first hour for a taken-over account
| Minutes 0 to 10 | Use a different, trusted device. Start the provider’s official account recovery. Type the address yourself rather than using a link from an email. |
| Minutes 10 to 20 | Once in: set a new, unique password, choose “sign out of all devices,” and turn on two-step login. |
| Minutes 20 to 35 | Check recovery phone and email, forwarding, filters, connected apps and delegates. Remove anything you didn’t set up. The email master key page in this section has the full list. |
| Minutes 35 to 50 | If it was your email: change the passwords of your bank, card and brokerage accounts, starting with any that shared the old password. |
| Minutes 50 to 60 | Tell close contacts not to trust money requests or links “from you” in the last few days. |
The first hour for an infected computer or remote-access scam
- Disconnect. Turn off Wi-Fi and unplug the network cable. If a stranger is connected, this ends the session.
- Don’t sign in to anything on that computer until it is cleaned. Assume anything typed there can be captured.
- From your phone or another computer, call your bank and card issuers using the numbers on your cards. Say that someone had remote access, ask them to watch for or block transfers, and ask about new cards.
- Change passwords from a clean device, email first, then money accounts.
- Photograph anything on screen (a ransom note, the scammer’s phone number, a fake invoice) before you clean up.
- Clean the computer: uninstall the remote-access app they had you install, update the system and run a full security scan. If you are unsure it is clean, back up your documents and photos, then reset the computer to factory settings.
Don’t call the number in the pop-up
A browser window that says your computer is infected and shows a phone number is the scam itself. Real security warnings don’t ask you to call anyone. Close the browser (on Windows, Ctrl+Alt+Delete then Task Manager works if it won’t close).
After the first hour: the next three days
- Freeze your credit at Equifax, Experian and TransUnion if your Social Security number, ID or tax files may have been exposed. A freeze is free to place and lift.
- Report identity theft at IdentityTheft.gov, which builds a recovery plan and the letters you may need.
- Report the crime to the FBI’s Internet Crime Complaint Center (ic3.gov), and online fraud to ReportFraud.ftc.gov.
- Dispute charges in writing with card issuers. Clocks and rights are on the Money Theft & Forensics page.
- Watch statements for two or three months; stolen card numbers are sometimes used weeks later.
A worked example: Dan and the “support agent”
Dan, 61, gets a pop-up at 2:10 pm saying his computer is locked. He calls the number. The “technician” connects remotely and charges $299 to Dan’s credit card for a “lifetime support plan.” At 2:45 pm the agent asks Dan to log in to his bank to “receive a refund.” Dan’s daughter calls, hears the story, and tells him to hang up.
- 2:50 pm: Dan unplugs the router, so the remote session ends.
- 2:55 pm: from his phone he calls the bank. Nothing has moved yet. The bank adds a fraud note and blocks outgoing transfers for 48 hours.
- 3:05 pm: he calls his card issuer, disputes the $299 charge and asks for a new card number.
- 3:20 pm: on his phone he changes the email password, signs out all devices, then changes the bank password.
- That evening: his daughter uninstalls the remote-access app, updates Windows and runs a full scan. They file a report at ReportFraud.ftc.gov.
Result: the $299 is disputed under credit card billing rights, and the bank savings (about $18,400) never moved, because Dan cut the connection before he logged in.
Check yourself
- Why use a different device in the first hour? Answer: The original device may be infected or still under a stranger’s control.
- Which account do you secure first? Answer: Email, because it can reset the others.
- A pop-up shows a phone number and says you are infected. What do you do? Answer: Don’t call; close the browser.
- What does a credit freeze cost? Answer: Nothing to place or lift.