← Back to the checklist · Use your browser's Print command to print this page.

First-Hour Checklist

Think a computer was taken over? Do these first.

1. Unplug the network — pull the cable or switch Wi-Fi off. Don't shut down yet unless money is moving right now.
2. Use a different, clean device (your phone) for everything below.
3. Change your email password first, then banking, then everything else, and turn on 2-step sign-in. Do it from the clean device.
4. Call your bank or card company if any money account was used on that PC.
5. Freeze your credit — it's free. A freeze stops anyone opening new credit in your name and doesn't hurt your score. Do all three, from your clean device:
   • Equifax: https://www.equifax.com/personal/credit-report-services/credit-freeze/
   • Experian: https://www.experian.com/freeze/center.html
   • TransUnion: https://www.transunion.com/credit-freeze
   Then check your credit reports for accounts you don't recognize. They're free every week at the only official site, AnnualCreditReport.com — type it yourself, because look-alike sites exist. If you find fraud, report it at IdentityTheft.gov for a recovery plan.
6. Write down what you saw — times, pop-ups, programs, phone calls from "support". Photos with your phone are fine.
7. Don't wipe or reinstall yet — you'll lose the record of what happened.
8. Report it: ic3.gov (US) and, for identity theft, identitytheft.gov.
9. Ignore anyone offering to "recover" your money for a fee.
10. When you're ready to find out what happened → Bonzentu Trace Field Guide.