Think you've been hacked but not sure? Start here

1. Stop. Breathe. The single biggest mistake in this moment is panic-clicking — changing every password from the device that might itself be compromised, or replying to the suspicious email to confirm whether it's real. Slow is fast here.

2. Question 1 — Is money moving right now? (Pending wire/e-Transfer/large charge you didn't authorize, an unfamiliar trade or withdrawal, a vendor saying they sent money to a stranger, a crypto outflow.) If yes: this is the highest-clock-pressure scenario on the site — go to the Bank, BEC, Brokerage, or Crypto playbook.

3. Question 2 — Are you locked out, or is someone else logged in? (Can't sign into email/social, 'password changed' notification you didn't trigger, phone says No Service, friends got messages from you, computer behaving oddly.) Go to Email, Social, SIM Swap, Device, or Cloud Storage playbooks.

4. Question 3 — Is someone using your information without permission? (Credit card you didn't apply for, debt collector for a debt that isn't yours, tax return rejected as 'already filed', medical bills you didn't incur, intimate or fake images of you, info posted online.) Go to Identity, Tax, Medical, Doxxing, Sextortion, Deepfake, or Deceased playbooks.

1. If you're still not sure, three quick decisions: what did the bad actor get (money, access, or information — pick the strongest), how urgent (money is hours, access is days, information is weeks), and what's your next safe device (don't take recovery steps on a device you suspect is compromised — borrow a phone).

2. Five rules that hold regardless: don't pay scammers; don't reply to confirm; don't delete the evidence; tell one person; beware of 'recovery' services that call afterwards offering to retrieve your money for an upfront fee — that is always a second scam.

1. Speed matters in the first hour. Patience matters for the rest. Drink water, work one playbook at a time, set a 25-minute timer, take 5-minute breaks.

Related situations