What to Do After a Social Engineering Incident
A recovery path for exposed accounts, devices, identity data and payments.
Start with what was exposed. A clicked link, shared password, installed remote-access tool and completed payment create different priorities. Stop contact first, then work through the relevant track below using a device and route the other party did not control.
If you shared a password or one-time code
- Open the real service through a saved app or typed address.
- Change the password from a clean device; change reused passwords elsewhere.
- Review active sessions, recovery email, phone number, forwarding rules and connected apps.
- Enable a stronger second factor where available and save recovery codes offline.
If you installed remote-access software
- Disconnect the device from the internet and end the remote session.
- From another device, secure email, banking and other high-value accounts.
- Record the software name, time of access and what was visible or entered.
- Seek qualified device support before trusting the affected system with new credentials.
If you sent money
- Contact the bank, card issuer, payment app, wire service or exchange immediately.
- Ask for the fraud team and whether a transfer can be recalled, reversed or frozen.
- Keep transaction IDs, destination details and all messages.
- Report through the relevant national fraud or law-enforcement channel.
If you shared identity documents
- Document exactly which files and data fields were sent.
- Use the official identity-theft guidance for your country.
- Monitor financial and government accounts; add alerts or freezes where available.
- Expect follow-up impersonation that refers to the first incident.