- 01
If money has moved, call your bank now
Ask them to attempt a recall of a suspected fraudulent payment. Have the date, amount and receiving account details ready.
- 02
Call for help early
Call Flare on 1300 027 401. The line is answered 24/7. The first hour decides how much evidence, and sometimes how much money, can be saved.
- 03
Isolate, don't switch off
Disconnect affected computers from the network by unplugging the cable or turning off Wi-Fi. Leave them powered on if you can. Some evidence exists only while a machine is running.
- 04
Don't delete or clean up
Leave suspicious emails, mailbox rules, files and ransom notes where they are. They show how it happened and what was affected.
- 05
Secure accounts carefully
Change passwords and sign out sessions for affected accounts, and turn on multi-factor authentication. Don't delete the accounts.
- 06
Don't contact the attacker
Don't reply to ransom demands or scammers, and don't pay anything, before you have advice.
- 07
Notify your insurer
If you have cyber insurance, call them early. Most policies require prompt notice, and some name the responders you must use.
- 08
Start a simple log
Write down what happened, when, who noticed and what has been done since. Times matter.
- 09
Report it
Report cybercrime via ReportCyber at cyber.gov.au. Your bank and insurer may ask for the report number. For identity misuse, IDCARE offers free support on 1300 432 273.
- 10
Think about notification
If personal information may be involved, you may have obligations under the Notifiable Data Breaches scheme. Speak to your lawyer early.
Specific situations: business email compromise ·
ransomware ·
hacked accounts ·
scams and fraud ·
departing employees
This checklist is general guidance, not legal advice. For notification obligations, speak to your lawyer.