Salvage — ShieldScan

Read this first. Almost everyone who arrives here has not been hacked. They have been frightened, or they have been scammed, which is a different problem with a different fix. Start with the two lists below and be honest about which side you are on — the wrong repair wastes a day you may need.

If you have been hacked, the order below matters more than the speed. People lose more by cleaning the device first than by taking twenty minutes to do it in sequence.

Are you actually compromised?

The difference is whether something is happening in your accounts, or only on your screen.

These are real signs

You can't sign in, and the recovery email or phone on the account has changed
People are getting messages from you that you didn't send
Charges, transfers or new accounts you didn't make
A device or session you don't recognise in your account's device list
A profile, device-admin app or VPN on your phone that you never installed
Mail rules or forwarding you didn't set up
A threat notification inside your actual account — on the Apple or Google account page, and by email — not in a browser tab

One of these is enough. Go to the phases below.

These are usually not

A page said so. Pages always say so.
Battery draining faster, or the phone running warm
Ads appearing everywhere in the browser — usually an ad-heavy site or an extension
An email claiming to have camera footage of you, with an old password quoted. The password came from a public breach. There is no footage.
Someone knowing your name, address or a family member's name. That is sold openly by data brokers.
Getting a two-factor code you didn't request — that means someone has a password, not your device. Change that password; the code held.

None of these means your device was entered. Run Bulkhead and get on with your day.

The sequence

Six phases. Do them in order. The one people skip is the first one, and it is the only one that can't be done later.

Preserve

Cleaning destroys the record — this is the only step that expires

Screenshot everything before you change anything.The message, the page, the charge, the unfamiliar device in your account list, the changed recovery email. Once you delete a message or sign out a session, it is gone from your side.
Do not delete the messages.Move them to a folder if you need them out of sight. Deleting is the one action you cannot undo.
Write down times.When you first noticed, when each thing happened, and what you did. Do it now while it's clear. Weeks later this is the difference between a claim that holds and one that doesn't.
Build the file below.It stamps each item with a fingerprint and a time, so that later nobody can argue the file was altered after the fact.

Evidence file

Add your screenshots and documents. Each one gets a SHA-256 fingerprint and a timestamp. Nothing is uploaded — the files stay on your device and only the list is produced. Keep the exported list with the files, in the same folder.

Why a fingerprint: if the same file is ever produced again — for an insurer, a bank dispute, or a court — the fingerprint proves it is the same file, unchanged. If a single pixel changes, the fingerprint changes completely.

This file is yours, kept by you. It is not filed with a desk or an organisation, and this page does not send it anywhere.

If someone may be watching this device Do the rest from a different device, and talk about it on a channel the intruder can't read. If you are in a situation where the person who has access to your accounts is someone you live with or know, do not change passwords yet — a sudden lockout can escalate things. Reach a domestic violence advocate first; they deal with exactly this and can help you sequence it safely.

Stop the bleeding

Money and access — the two things that get worse by the minute

If money moved, call your bank now.Use the number on your card or statement. Ask them to stop or recall the transfer and flag the account. The first hours matter more than anything else on this page.
If a card was used, have it replaced.Not just frozen — replaced. And check for small test charges from the same period.
If the device may still be under someone's control, take it off the network.Turn off Wi-Fi and mobile data. This ends any live session immediately.
Do not send anything else, to anyone, for any reason.Including to someone now offering to recover what you lost. That offer is the next stage of the same operation.

Take the accounts back

Email first — it is the master key that resets everything else

Work from a device you trust, not the one in question.A different phone, a family member's laptop, a library computer.
Email first. Always email first.Whoever holds your email can reset every other account you own. Change the password, then turn on two-factor if it isn't on.
Then sign out every other session.Every major account has "sign out all devices" or a device list in its security settings. A changed password does not always end sessions already open.
Fix the recovery details.Check the recovery email and phone number on each account. If they were changed, change them back — this is the first thing an intruder alters, because it locks you out of your own recovery.
Check mail rules and forwarding.A common trick is a quiet rule that forwards or auto-deletes anything containing the word "bank" or "security". Look in your mail settings for filters, rules and forwarding addresses.
Then work outward: banking, then anything holding money or identity, then everything else.Any account that used the same password as a breached one, change it too.

Clean the device

Only after the accounts are secured — this step wipes evidence

Remove any profile, device-admin app or VPN you didn't install.iPhone: Settings → General → VPN & Device Management. Android: Settings → Security → Device admin apps, and Special app access. This is where a real problem on a phone actually lives.
Uninstall any remote-access or "support" software.Then restart the device.
Install every pending update.Then turn automatic updates on, so this doesn't recur.
If you gave someone remote control, consider a full reset.Restore from a backup made before the incident, not after. If your only backup is from after, set the device up fresh and re-download apps rather than restoring.
Change passwords again from the clean device if you had to change any while the device was still suspect.

Report

Different places do different jobs — they are not interchangeable

Your bank or card issuer

First, always, if any money moved

On a number from your card or statement.

They are the only party who can actually stop or recall a payment. Ask for a case reference and write it down.

ReportFraud.ftc.gov

Every time — money lost or not

The FTC's general fraud intake.

Feeds enforcement and is shared with law enforcement partners. It won't get an individual reply, and it does not produce the report creditors need — that is IdentityTheft.gov, below.

IdentityTheft.gov

If personal details were taken or used

Social Security number, accounts opened in your name, tax or medical identity. Spanish: RobodeIdentidad.gov. By phone: 877-438-4338.

Produces an official FTC Identity Theft Report plus a personalised recovery plan and pre-filled letters. Creditors and credit bureaus generally require that report before they will remove fraudulent accounts. This is the single most useful document you can hold.

IC3.gov

Any cyber-enabled crime, and always when money moved

The FBI's Internet Crime Complaint Center.

Two things to know before you start: IC3 does not accept attachments, so keep your evidence file yourself; and it does not email you a copy — save or print the report on the confirmation screen, because that is your only chance. Keep the reference number.

The three credit bureaus

If personal details were taken

Place a fraud alert or a freeze. A fraud alert placed at one bureau must be passed to the other two; a freeze has to be placed at each one separately. Free reports at AnnualCreditReport.com.

A freeze is free and reversible, and it stops new accounts being opened in your name. Follow the specific links in your IdentityTheft.gov recovery plan rather than searching — search results for credit freezes are heavily gamed.

Your mobile carrier

If codes stopped arriving, or your phone lost service unexpectedly

Ask for a port-out or number-transfer lock and a PIN on the account.

Losing service for no reason can mean your number was moved to someone else's SIM — after which every texted code goes to them.

The platform being impersonated

If the message pretended to be a specific company

Apple: forward the email, or a screenshot of the text, to reportphishing@apple.com. Other providers publish their own address — find it on their real support site, not from the message.

Helps them take down the infrastructure. You will not usually get a reply.

Local police

For identity theft, or when an insurer or bank asks for a report number

Bring your FTC Identity Theft Report and your evidence list.

Some claims and disputes require a police report number. IC3 itself notes that investigation is at the discretion of the receiving agency, and advises contacting local law enforcement directly if the matter is time-sensitive.

Close it out

Two things that keep it from happening twice

Expect the second approach.People who have lost money are contacted again, sometimes from lists of known victims, by someone offering to recover it for a fee. Some of them impersonate the FTC itself, with a made-up refund department. The real FTC never charges a fee, never asks for a Social Security or bank account number to release a refund, and never asks for remote access.
Then do the boring half.Run Bulkhead and seal the compartments. Most repeat incidents are the same gap, used again.
Tell one person what happened.These operations run on isolation and embarrassment. Being caught by one is not a judgement on your intelligence — they are designed by people who do this full time, against a person having an ordinary day.

Just happened, need triage Harden the device What was it?