It’s usually a small thing that tips people off. A pop-up that won’t close, a friend replying “did you mean to send this?”, or a bank text for something you didn’t buy. Then that sinking feeling sets in. I get calls about this fairly often, so I thought it was worth writing down exactly what to do while you’re waiting for help to arrive.

The first thing to do, before anything else

Get the device off the internet. Turn off Wi-Fi, unplug the Ethernet cable, whatever it takes. Don’t shut it down, just disconnect it. Every minute it’s connected is another minute someone could still have access, and a lot of what happens next depends on cutting that off first.

Change your passwords, but not from that device

Grab your phone or another computer and start with your email password. Email is the key that unlocks everything else, so it comes first. Then move on to banking, and anything else you were logged into on the affected device. If you’ve been reusing passwords anywhere, change those too while you’re at it. Turn on multi-factor authentication if you haven’t already, it’s the single biggest thing that stops this happening again.

Run a proper scan, not a quick one

Once your passwords are sorted elsewhere, it’s safe to reconnect the device and run a full antivirus scan. Let it run all the way through. If it turns something up and you’re not confident it’s actually gone, that’s the point to call someone rather than keep clicking around.

Check for anything left behind

Have a look through your email’s sent folder for anything you didn’t send, and check for any new forwarding rules or filters you didn’t set up, scammers love hiding there. Glance at your bank statement for anything odd. If you spot something you don’t recognise installed on the device, remove it.

Tell the people who need to know

If your email or socials were compromised, a quick heads-up to your contacts means they won’t click on anything sent from your account in the meantime. If it’s a work device, let your workplace know too.

Worth reporting, even for smaller incidents

Your bank if any financial details were involved, and the ACSC’s ReportCyber service for the incident itself. It helps them track patterns and disrupt the people doing this, and it only takes a few minutes.

A quick local tip

If any of this feels like more than you want to tackle on your own, or you’re just not sure the device is actually clean, give me a call. I can come to you, run through it properly, and make sure everything’s locked down before you go back to using it normally.