What To Do If It Already Happened
The first hour matters most, and the order of actions is not obvious. What to do, in sequence.
Somebody has had remote access to the machine and money may have moved. Speed matters more than understanding what occurred.
The response discipline in “What To Do If It Already Happened” benefits from a clear record of work without turning activity into a judgement about a person. For teams exploring time tracking software, time tracking software for incident work can provide project and time context while incident facts, access logs and human review remain authoritative.
Disconnect the machine
Turn off the wireless, unplug the network cable, or switch the computer off entirely.
For an independent reference related to “What To Do If It Already Happened”, consult the FTC scam guidance; it provides a useful external check on security, privacy and operating assumptions before a process is adopted.
This ends any active session immediately.
Do not try to work out what they did first — that can wait and the connection cannot.
Ring the bank
Immediately, from a different phone if the call might still be connected.
Banks can sometimes stop or recall a transfer in the first hours, and the window closes fast.
Use the number on your card or statement, not any number provided during the incident.
Tell them plainly what happened; they handle this frequently and will not be surprised.
Change passwords, from a different device
Email first, because it controls everything else.
Then banking, then anything else of value.
From a phone or another computer, not the affected one, which may still be compromised.
Then the machine
Assume anything that was on it was seen and anything typed was captured.
The safe answer is a clean reinstall by somebody competent, rather than removing what you can find.
Remote access software installed during the incident should be removed, and so should anything else that arrived with it.
Report it
To the national fraud reporting body in your country.
To the bank, formally, as well as the urgent call.
Reporting feeds the pattern that eventually disrupts these operations, and it is also frequently required for any recovery.
Expect to be contacted again
People who have been defrauded once are contacted again, sometimes by somebody offering to recover the money.
That second approach is part of the same industry.
Nobody who rings you unprompted will recover your money, and that should be said at the time.
If it was a relative
Do the above with them, not for them.
Then the conversation, which has its own note.
And check whether any standing access was left behind, which is the thing most often missed afterwards.
What not to do
Wait to see whether anything happens.
Try to re-establish contact to confront them.
Or delay telling the bank out of embarrassment, which is the single most expensive hesitation available.
What to check
Does everybody in your household know to disconnect and ring the bank, in that order?
Do they know the bank's number without looking at a screen?
Would they tell you immediately, or wait a day?
And do they know about the second approach?