Guide
The first 6 steps after a hack or fraud
End the exchange with the suspicious person, don’t delete the messages or software involved and, if a payment is involved, contact your bank immediately. The next steps depend on the type of incident.
We will never ask for your codes, passwords or card number.
Do this right away: three steps
1. Stop the exchange: hang up, leave the chat, stop screen sharing or remote access. 2. Don’t delete anything: texts, emails, screenshots and notifications are fragile evidence. 3. If a payment is involved, call your bank using its official contact details, never those given during the scam.
The 6 reflexes, in the right order
These actions avoid wasted time, deleted traces and contradictory steps. They apply to almost every incident.
Each step, explained simply
Take what matches your situation. You don’t have to do everything at once.
01 · Stop the interaction
Hang up, leave the chat, stop screen sharing, close the remote access app or disconnect from the internet if a remote session is still active. As long as contact stays open, the attacker can keep acting.
02 · Don’t delete too soon
Keep the texts, emails, screenshots, call histories, notifications, app names, receipts, IBANs, payees added and transaction references. Deleting too soon weakens the file. We always separate what is observed from what is assumed.
03 · Secure from a trusted device
From a clean device, change your passwords, turn on two-factor authentication, close unknown sessions and check the recovery methods (phone number, backup address). A changed password is not enough if open sessions are not closed.
04 · Notify the organisations exposed
Contact the bank, the phone operator, the email provider, the platform or the insurer, depending on the case. Always use the official contact details, never those given during the scam.
05 · Draw up a timeline
Note the dates, times, amounts, accounts involved, devices used, actions already taken and people contacted. A clear timeline is better than a scattered account: it is what makes your file solid.
06 · Choose the right level of help
Sometimes simple advice is enough. An intervention becomes useful if access is uncertain, if several accounts are affected, or if a report needs to support a step with the bank, the insurer or the courts. You decide.
The right first step depends on the incident
The first actions differ depending on whether it’s bank fraud, fake support or a compromised account.
Fake adviser or disputed transaction
Block your card if necessary, dispute the transactions quickly, keep calls, texts, notifications and amounts.
See the banking situation →Fake tech support (remote access)
End the remote access, identify the tool installed, check accounts, browser, payments and startup programs.
See the fake support situation →Hacked email account
Change the password from a trusted device, check two-factor authentication, sessions, rules and forwarding, and check the linked accounts.
See the hacked account situation →Virus, dubious file or unknown software
Don’t run the file again. Note its name, where it came from, when it was downloaded and the symptoms. Analysis distinguishes a real infection, unwanted software and a mere alert.
See the guides →Impersonation, blackmail or threats
Keep the original messages, screenshots, profiles, links, numbers and dates. Don’t negotiate under pressure. We document before sending out scattered reports.
See the situations →The mistakes that complicate the file later
Panic often pushes people to act too fast. Some actions are useful, but only after noting and keeping what may be needed.
The steps to postpone
- Resetting the computer without noting the tools installed.
- Deleting texts, emails or notifications.
- Changing the password without closing sessions.
- Replying to the fraudster to “understand”.
- Sending an incomplete or contradictory account to the bank.
- Installing several clean-up tools without method.
The useful evidence to keep
- Dates and times of calls or sign-ins.
- Full screenshots showing the sender, number or URL.
- Amounts, payees, IBANs, receipts and references.
- Names of the apps installed or used.
- Security emails, notifications and alerts.
- Steps already taken with the bank or platform.
In all honesty. Galyct Perso checks, secures, documents and advises. We will never ask for your codes or your passwords, and we guarantee neither recovery of funds nor identification of the culprit. Clear commitments, never false promises.
Not sure in what order to act?
The free pre-diagnosis assesses the situation, identifies the exposed accounts, ranks the evidence and helps decide whether you need a technical intervention, a report or simply some support. A single point of contact guides you.
Start with the free diagnosis.
In a few minutes, you’ll know what to do, and then you decide whether you want our help.