- Stop what is happening first — call the bank, end sessions. Do not investigate the cause.
- Recover the email first: everything else is restored through it.
- End sessions, then change the password — in exactly that order.
Working out the right order of actions while messages are already going out from your account and alerts are arriving from the bank is a poor plan. Under stress people make predictable mistakes: they start with the wrong thing, spend time working out how it happened, and lose the hours in which something could still be stopped.
The first hour: the general order
-
Stop what is happening right now
Money leaving — call the bank and block the card. Messages going out — end all sessions. This comes before everything else, including changing the password.
-
Get the email back
It is the recovery point for everything else. While it is under someone else's control, changing passwords elsewhere is pointless: the reset letters will not reach you.
-
End all sessions, then change the password
In exactly that order: signing out everywhere closes the windows already open, and the new password closes the way back in.
-
Check what was left behind
Mail forwarding rules, recovery contacts, app passwords, third-party access. This is the most commonly skipped step — and without it access survives the password change.
-
Warn whoever is affected
Friends who may have been messaged in your name. Colleagues, if work access is involved.
-
Record it, and only then investigate
Screenshots, times, addresses. A police report if money was lost. Working out the cause comes last, not first.
The order depends on what happened
| What happened | First action | Why that one |
|---|---|---|
| Money left the card | Call the bank, block it | Some transactions can be stopped in the first minutes |
| The email is compromised | Change the password and sign out everywhere | Everything else is recovered through it |
| A messenger is compromised | End sessions, warn your contacts | Money is being asked of your friends in your name |
| The phone lost signal | Call the operator from another number | Possible SIM swap |
| A password was typed on a fake page | Change it on the real site | The count runs in minutes before the first login |
| The phone is lost | Block the SIM, wipe the device | Confirmation codes arrive on it |
| Files are encrypted | Disconnect the computer from the network | Encryption continues and will reach network drives |
What to prepare in advance
The plan only works if the things it needs are at hand and not inside the compromised account.
How to tell a break-in has happened at all, and what traces to look for, is in signs of a break-in. What to do specifically after a password leak is step by step here.