Step-by-step recovery
Choose your recovery playbook
Search for what happened, then follow the actions in order. Start with the risk that needs attention now.
4 guides available
Recover from account compromise
Take back control of email, social media and other accounts. Secure the recovery routes an attacker could use to return.
Recover from ransomware
Contain affected devices, preserve evidence and plan a controlled restoration. Use trusted support before reconnecting systems.
Recover from a scam
Stop further loss, contact the right provider and keep the evidence needed to dispute a payment or report fraud.
Recover from identity theft
Respond when someone misuses your personal details. Secure affected services, dispute false records and keep a clear recovery trail.
Act on the most urgent risk first
You do not need to understand the whole incident before taking the first protective step. If money is moving, call your bank or mobile-money provider now using a number from its official app, your card or a known website. If work systems are affected, alert your IT or security team through a trusted channel.
Use a trusted device. If your phone or computer may be compromised, use another device you control to contact providers and secure accounts. Do not enter new passwords on the suspect device.
Stop further exposure. End contact with a suspected scammer. Disconnect an infected personal device from the network. For workplace equipment, involve the response team and follow its containment instructions.
Keep a simple record. Note what happened, the date and time, affected accounts, transaction references and the actions already taken. Save original messages and security alerts privately.
Choose the right recovery playbook
Account compromise covers unfamiliar sign-ins, changed recovery details and stolen email or social accounts. Ransomware covers encrypted files, ransom notes and threats to publish data.
Use Scams if you sent money, shared a code or installed something at another person's request. Use Identity theft when someone uses your name, identity documents or personal details to impersonate you. More than one playbook may apply.
Get help without giving away more information
Use NC4 incident reporting guidance to prepare a report and current NC4 contact details for available channels. Read the intake notice before submitting: a preview form does not lodge an operational report. A provider fraud report, a police report and an NC4 report serve different purposes; keep each reference.
Never put passwords, PINs, one-time codes, recovery codes or full card numbers into a report. Do not publish identity documents, private messages or stolen data as evidence. Preserve originals and share only what the verified recipient needs through its secure process.
Know when to bring in specialist support
Escalate promptly if several accounts are affected, systems keep being reinfected, a business cannot operate, or sensitive records may have been taken. Organisations should involve their incident lead, IT provider and privacy or legal lead. If someone is threatening your physical safety, prioritise a safe place and local police support.
Confirm recovery, then reduce repeat risk
Getting back into an account or restoring a file is a milestone, not the final check. Confirm that unauthorised access has ended, your recovery methods work and payments or records have been reviewed. Keep monitoring for fresh alerts and follow-up scams. These playbooks guide your next actions; they cannot guarantee recovered money, restored files or a provider's response time.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.