Establish the starting point
Fictional example: after phishing, Elena has her card blocked and changes her email password. The next morning she lists confirmed blocking, reviewed sessions and a pending bank investigation. She can distinguish actions actually completed from those she has only requested.
Record the date, responsible organisation and case reference. Submitting a report is not equivalent to confirmed blocking. If an essential protection remains uncertain, clarify it immediately through the known provider route rather than waiting until your planned week is over.
Make focused account checks
Open the genuine security pages of affected services. Review unfamiliar sessions, changed recovery details and automatic email forwarding. Look for password resets or approvals you did not request. Address reused passwords at the services where you actually used them.
Complete outstanding tasks in a clear order and carefully check that your own recovery route remains usable. No new suspicious activity is encouraging, but does not prove that information was never copied. Avoid definitive conclusions that the available evidence cannot support.
Combine transaction checks with provider replies
Compare affected transactions with your earlier notes. Has a pending authorisation become a posted charge? Has another unfamiliar amount appeared? Report new concerns through the payment provider’s process, adding existing case references so the events can be connected.
Ask which next steps and deadlines apply to your case. Do not assume one internet deadline covers every bank or country. An ongoing investigation is not a promise of reimbursement. Keep relevant evidence protected and record which documents the provider still needs.
Verify further approaches independently
Additional messages may follow the incident: supposed security checks, recovery offers or support calls. Verify them using an established contact route. Knowing details of the first event does not automatically authorise a new sender to request more information or payments.
Brief affected people on confirmed developments. If your account sent fraudulent messages, targeted warnings can help. Do not publish complete case files while doing so. For a work account, coordinate external communication with the responsible organisation instead of distributing confidential information yourself.
Turn follow-up into a sustainable routine
Elena chooses two suitable review times and records which new signs would require immediate action. This is her personal organisational choice, not a universal security rule. Responsible handling does not require reopening unchanged status pages every hour.
At the end of the period, she separates resolved issues from those still open. Unresolved device concerns, account loss or new damage may require continued professional help. This plan does not replace technical, financial or legal advice for the individual case, nor promise a particular duration or outcome.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Is everything safe after seven days?
No. A week is simply a manageable planning period. New suspicious activity or unresolved cases can require action later as well.
How often must I check the account?
It depends on the incident and provider guidance. Choose a suitable rhythm and respond promptly to concrete warnings. There is no universal daily number of checks here.
Should I keep repeating every protective measure?
Repeat checks when new evidence or provider instructions justify them. Recorded, focused actions are more useful than constant changes without a new reason.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- BACS: Konto gehackt oder Daten abgeflossen – Was nun?Source review date:
- BACS: Finanzieller SchadenSource review date:
- FTC: Refund and Recovery ScamsSource review date:
