When a cyber incident is unfolding, the first actions matter. Take the immediate steps for your situation below, then call or text Countervail at (509) 393-0896. If you lost money or cryptocurrency, start a Fraud & Scam Recovery intake; for other incidents, submit a client intake. Countervail Watch members, call your investigator directly.
Business hours are Monday to Friday, 9 to 5 Pacific, excluding holidays. Requests received during business hours get a response the same business day; requests received evenings, weekends, or holidays are handled the next business day. The first steps below can’t wait, so take them right away.
Ransomware or suspected malware
First action: Isolate the affected machine from the network. Do not power it off.
Disconnect Wi-Fi, unplug the network cable, and stop the device from communicating with other systems. Do not restart, shut down, or attempt cleanup before evidence is preserved.
Wire fraud, business email compromise, or payment diversion
First action: Contact the bank immediately.
Ask for the fraud department and request a wire recall or fraud recall. Then file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov as soon as possible. Fast reports give the FBI and banks the best chance to freeze funds. The recovery window can close quickly, and technical support cannot recover funds once the money moves beyond reach.
Account compromise
First action: Revoke active sessions.
A password reset alone may not remove an attacker who already has an active session. Sign out all devices, revoke sessions, remove unknown recovery methods, check forwarding rules, and enable multi-factor authentication where available.
Identity theft, retirement-account fraud, or unauthorized transfers
First action: Contact the financial institution’s fraud department and preserve records.
Request written confirmation of the fraud report and preserve transaction details, emails, texts, portal messages, account notices, screenshots, call logs, and any names or reference numbers provided.
Impersonation, harassment, stalking, or doxing
First action: Preserve evidence before engaging.
Capture screenshots, URLs, usernames, timestamps, phone numbers, email headers when available, and the full content of messages or posts. If there is immediate physical danger, call 911 first.
Suspicious message, link, invoice, or request
First action: Stop and verify through a separate trusted channel.
Do not click the link, open the attachment, approve payment, change account access, or reply in the same thread until the request is verified through a known phone number, known email address, or established contact method.