The people who call me embarrassed are the ones I most want to hear from. Clicking a convincing email isn't stupidity — modern phishing is genuinely good, and it's designed by people who do this full time. What matters is the next hour.

Change the password — from a different device

If you typed your password into a page that turned out to be fake, assume it's been taken. Change it on the real site, and do it from your phone or another computer, in case the first machine has something running on it.

Change it anywhere else you reused that password too. This is the moment people discover how many accounts shared one password.

Turn on two-factor authentication

If it wasn't already on, do it now. A stolen password on its own becomes close to useless once a second factor is required, and this single step prevents most follow-on damage.

Check where your email is going

If an email account was compromised, attackers often add a forwarding rule or a filter that quietly sends copies elsewhere, or hides replies from you. Check your mail rules and forwarding settings, and look at recent sign-in activity for locations that aren't you.

Tell your bank before they tell you

If any bank or payment details were involved, ring the number on the back of your card — not a number from the email. Banks deal with this daily and would far rather hear from you early.

Then, and only then, scan the machine

Everybody starts here, and it's the least urgent step. Malware that's already run isn't going anywhere in the next twenty minutes; a live session with your credentials is the thing actively being exploited. Lock the accounts first, clean the computer second.

If it was a work account, say so immediately

Nobody has ever been fired for reporting this quickly. The damage comes from the hour of silence while someone hopes it'll be fine.

If you're in the middle of this right now and want someone to work through it with you, get in touch. No lecture, I promise.