Bank fraud
Fake adviser and approval under pressure
The victim receives a convincing call. The caller talks about fraud in progress and pushes them to approve a transaction or hand over information, on the pretext of protecting them.
To preserve
- Call and text history.
- Bank notifications.
- Exchanges with the bank.
- Timeline of approvals.
What was done
- Reconstructing the timeline.
- Checking the exposed accounts.
- Securing email and bank.
- A summary that can be used for a claim.
Honest outcome: the report does not guarantee a refund; it clarifies the case and makes it usable.
Fake support
Remote access after a fake alert
A frightening alert shows a number to call. A third party gets a remote control tool installed and can access accounts, browsers or payment methods.
To preserve
- Name of the tool installed.
- Time of the call.
- Invoices or payments requested.
- Screenshots of the alert if available.
What was done
- Removing the unwanted tools.
- Checking browsers and sessions.
- Securing the accounts used.
- Checking for useful traces.
Honest outcome: the presence of a tool does not, on its own, prove every action the scammer took.
Hacked account
Email changed by a third party
The mailbox shows signs of compromise: unknown sessions, changed recovery details, forwarding rules, filters, or messages sent without your knowledge.
To preserve
- Security alerts.
- Unknown sessions and devices.
- Forwarding rules.
- Suspicious messages sent or received.
What was done
- Signing out of sessions.
- Changing the recovery options.
- Turning MFA on or restoring it.
- Checking linked accounts.
Honest outcome: regaining the account is not always enough to know how the access happened.
Impersonation
Identity used to deceive family and friends
An account or an identity is used to contact other people, ask for money, spread messages or create confusion about who is really behind them.
To preserve
- Timestamped screenshots.
- Links to the profiles or accounts.
- Messages received by family and friends.
- Recovery requests to the platform.
What was done
- Checking the source account.
- Preparing the reports.
- Securing email and phone.
- A warning message to contacts if needed.
Honest outcome: the intervention helps document and secure access, not identify the culprit for legal purposes.
Blackmail
Extortion message after a data leak
The person receives a threatening message claiming a device has been compromised. Some details often come from old data leaks rather than an active infection.
To preserve
- Full message, and headers if it is an email.
- Sender address.
- Wallet or link requested.
- References to old leaks if known.
What was done
- Checking critical accounts.
- Looking for signs of compromise.
- Strengthening passwords and MFA.
- Careful wording of the conclusions.
Honest outcome: data exposure does not automatically mean the device is infected.
Phone
Suspected phone surveillance or exposed account
The victim notices worrying behaviour: calls, notifications, unknown sign-ins, suspicious apps or a feeling of being followed online.
To preserve
- Timestamped screenshots.
- List of apps.
- iCloud, Google or WhatsApp sessions.
- Specific events observed.
What was done
- Checking linked devices.
- Checking cloud accounts.
- Recovery settings and MFA.
- Separating facts, assumptions and limits.
Honest outcome: not every unusual behaviour proves active surveillance.
