By the end of this lesson you will be able to
- List common signs that a device or an account has been compromised.
- Explain why staying calm and acting in the right order matters.
- Follow the response steps: disconnect, use a clean device, change passwords, check and restore, report.
- Use a decision tree to choose what to do for a given problem.
- Describe how to reduce the damage if you clicked a link or entered a password.
Sooner or later almost everyone clicks something they should not have. What happens next matters far more than the mistake. People who act calmly and in the right order usually lose little, and people who panic, or hide it, can lose a great deal. This lesson gives you a plan to follow when you are worried, so you are not working it out under stress.
Signs that something is wrong
A problem may be with the device or with an account. They look different. A device problem is something you can see on the machine. An account problem often shows up somewhere else, such as a message from a friend or an email from the service.
| Device signs | Account signs |
|---|---|
| Sudden slowness or the fan running hard for no reason | A password-reset email or code you did not ask for |
| Pop-ups, new toolbars or a changed home page | Friends say you sent them odd messages or links |
| Programmes you did not install | A login alert from a place or device you do not recognise |
| Files renamed, missing, or a note demanding payment | Settings changed: a new recovery phone number or forwarding rule |
| Security software switched off and cannot be turned on | Purchases or transfers you did not make |
Hello Amina, a new sign-in to your account came from an unknown device in another country.
Time: 03:12 (when you were asleep).
If this was not you, open the mail service yourself and change your password. Do not rely on links in this message.
- Marker 1: Unfamiliar device and place
- Marker 2: Time that does not fit your day
- Marker 3: Go to the service yourself
- Marker 4: Be careful: go to the real site instead
Read this figure as text
A simulated email window showing a new sign-in alert with numbered markers on the place, the time and the safe button.
A simulated security alert from a fictional mail service. Marker 1 points at the line saying a new sign-in happened from an unfamiliar device in a country Amina does not live in. Marker 2 points at the time, which was when she was asleep. Marker 3 points at the advice: if this was not you, go to the service by typing its address yourself or using its app, and do not use any link in the alert if you doubt it. Marker 4 points at the button Secure my account, which in a real alert should be treated with care: go to the official site yourself. All names and addresses are fictional.
Stay calm and go in the right order
The order of response matters because some steps undo others. For example, changing your password on a device that has a keylogger gives the new password to the attacker too. So the principle is: stop the damage, then fix things from a device you trust.
- Step 1: StopNo more clicking, paying or replying
- Step 2: DisconnectWi-Fi off or cable out
- Step 3: Clean deviceUse a phone or computer you trust
- Step 4: Change passwordsEmail first, then bank, then the rest
- Step 5: Check and restoreScan, restore from backup, reinstall if needed
- Step 6: ReportBank, service, authority, friends
Read this figure as text
A flow of six steps: stop, disconnect, use a clean device, change passwords, restore and check, report.
Step 1, Stop: do not click, pay or reply any further. Step 2, Disconnect: turn off Wi-Fi or unplug the network cable so the device cannot send or receive more. Step 3, Use a clean device: switch to a phone or computer you trust. Step 4, Change passwords: start with email, then banking, then others, and sign out other sessions. Step 5, Check and restore: scan the affected device, and if files are damaged, restore from your backup or reinstall. Step 6, Report: tell the bank, the service and the proper authority, and warn people who may have been messaged.
The steps in detail
Stop and disconnect. Do not pay a ransom or phone any number on the screen. Disconnecting stops stolen data leaving and stops malware spreading to other devices in the house. On a laptop, turn Wi-Fi off from the system menu, or unplug the network cable. Do not switch the computer off if a note says files are being encrypted and you are watching; disconnecting first is the priority, and a shutdown is then reasonable.
Use a clean device to change passwords. A clean device is one you have good reason to trust, such as your phone if the problem is on the laptop. Change the password for your email first, because it is the key to resetting everything else. Then change banking and any account that uses the same password. Choose a new password that you have never used before. Where the service offers it, choose Sign out of all devices and review recovery phone numbers and forwarding rules, as attackers add their own.
Check and restore. Run a full scan with your security software (on Windows, Windows Security then Virus & threat protection then Scan options). If files are locked or you cannot be sure the system is clean, the most reliable fix is to restore from backup: reinstall the operating system if necessary, then copy your files back from a backup made before the problem. This is why the backup lesson matters.
Report. Tell your bank immediately if money or card details were involved; they can often stop a payment if you act quickly. Tell the service (for example, your email provider) so they can lock the account. If you were scammed, report it to the proper authority in your country (the next module covers this). Warn people who may have received messages from you, using another route than the hacked account.
Choosing what to do
Not every case needs every step. Use the decision tree to find the right path for your situation.
- Are your files locked, or is there a payment demand?
- YesDo thisDisconnect, do not pay, restore from backup.
- NoDid you enter a password or payment details after clicking a link?
- YesDo thisChange the password from a clean device; tell the bank.
- NoIs there unrecognised activity on an account?
- YesDo thisSecure the account: reset, sign out, check recovery.
- NoDid you only click a link, and nothing was asked of you?
- YesDo thisClose it, scan and watch.
- NoDo thisProbably an ordinary fault: use the troubleshooting method.
Read this figure as text
A yes or no decision tree asking about locked files, a clicked link and account changes, leading to the right response.
Start: are your files locked or is there a payment demand? If yes, disconnect from the network, do not pay, and restore from backup after cleaning the device. If no, did you enter a password or payment details after clicking a link? If yes, change that password at once from a clean device and tell your bank if money was involved. If no, are there signs of unrecognised activity on an account? If yes, secure the account: reset the password, sign out other sessions, and check recovery details. If no, did you only click a link and nothing was asked of you? If yes, close the page, run a scan and watch for warning signs. If no, this is probably an ordinary fault, so use the troubleshooting method.
Do not hide it
Scammers rely on embarrassment. Many victims say nothing for days, and in those days the damage grows. Banks, employers and services deal with this every day. Telling them early is the best thing you can do, and it is also how others are protected. Afterwards, ask what the lesson was: which clue did you miss, and which layer from the last lesson would have helped?
Common mistakes
✖ Instead of: Changing passwords on the infected device.
✔ Do this: Use a clean device so the new password is not captured by whatever is on the first one.
✖ Instead of: Staying quiet because of embarrassment.
✔ Do this: Tell the bank, service and anyone who may be affected. Early reports reduce harm, and criminals count on silence.
✖ Instead of: Ringing the number shown in a pop-up to “fix” the problem.
✔ Do this: Pop-up numbers go to scammers. Close the page and use real support routes you find yourself.
If something goes wrong
- I cannot tell whether a slow laptop is infected or just slow.
- Look for the other signs in the table. With no other signs, use the slow-computer troubleshooting lesson first, then run a security scan.
- I have no backup to restore from.
- Scan and clean the system, change passwords from a clean device and, if the system is not trustworthy, reinstall it. Then start a backup routine so this is not a problem next time.
- I cannot sign in to my own account any more.
- Use the service's official account recovery page, typed in yourself. Have your recovery codes ready, and contact the service's help centre if recovery does not work.
Key terms
- Ransomware
- Malware that locks your files and demands money to unlock them.
- Spyware
- Malware that secretly watches what you do and sends the details to someone else.
- Backup
- A separate copy of your files kept so you can get them back if the originals are lost or damaged.
- Multifactor authentication (MFA)
- Signing in with your password plus a second proof, such as a code from your phone.
- Recovery code
- A one-time code, saved safely, that lets you get back into an account if you lose your phone or second step.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Write your own one-page response plan
On paper or in a document, write the six response steps in your own words. Add the real details for you: which phone or computer is your clean device, the number of your bank's fraud line (from your card, not from a message), the name of your email provider and where your backup is. Keep it somewhere you can find it without your laptop.
Challenge: talk through three cases
Without looking at the lesson, say what you would do first, second and third in each case: (1) a message asking you to pay to unlock your files, (2) a friend reports odd messages from your account, (3) you entered your login on a page that you now think was fake. Then check your answers against the decision tree.
Knowledge check
6 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Signs of trouble include unexpected pop-ups, account alerts, changed settings and locked files; several together deserve action.
- Act in order: stop, disconnect, use a clean device, change passwords, restore and check, report.
- Secure your email first because it can reset your other accounts.
- Never pay a ransom and never call a number from a scare pop-up.
- Report early; silence helps only the criminal.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Something wrong? Recovering a hacked account (National Cyber Security Centre (UK))
- Help protect yourself from tech support scams (Microsoft Support)