Get help
Who to contact, and in what order
Most people can work out roughly what to do. What is hard, straight after it happens, is knowing what to do first. Some of these steps have a time limit.
Step 1 · Where are you?
Step 2 · What happened?
- I sent money to someoneA transfer, a card payment, gift cards, or cryptocurrency.
- Someone got into one of my accountsEmail, social media, banking, or anything else you log in to.
- Someone is using my identityAccounts opened in your name, or your documents were taken or leaked.
- Someone is threatening to share private imagesSextortion, or images shared without your consent.
- Someone I met online is asking for moneyA partner, an investment tip, or a friend you have never met in person.
- I clicked a link or installed somethingYou are not sure whether any harm was done.
- I am not sure what happenedSomething feels wrong but you cannot name it yet.
Your next steps
In the next hour
Start with your email account, not the one that was hacked
Email is the master key: whoever controls it can reset everything else. Secure it first, even if it is not the account you noticed.
Change the password from a different device
If the device you normally use might have something on it, a new password typed into it is just handing over the new one too.
Sign out every other session
Most services have a "log out of all devices" option in security settings. A password change alone does not always kick someone out.
Do not delete anything yet
The messages, emails and receipts are evidence. People often clear them out of embarrassment, and then cannot prove what happened. Screenshot everything before you change any passwords.
Today
Turn on two-factor authentication
An app or a security key, rather than SMS where you have the choice.
Check what they changed while they were in
Recovery email, recovery phone, forwarding rules and linked apps. A forwarding rule left behind means they keep reading your mail after you have locked them out.
Report it to CERT NZ
The national reporting point for cyber security incidents.
You are not the only one
A fake PS1 game download installed malware and cost me my Steam account
“I got hacked! A couple of weeks ago, I was trying to download a PS1 game to play through an emulator. I've been doing…”
These organizations are independent of us. We list them because they are the right people to speak to, not because we are connected to them. If you are in immediate danger, call your local emergency number first.
The full directory
Everything we know about, including international options.
Report a crime
Police and government agencies by country.
Identity and accounts
Help with stolen identity and compromised accounts.
Still stuck?
Send us a message and a person will read it. We cannot recover money or investigate, but we can point you at the right place.