Phase 1

First 5 minutes playbook

When something feels wrong, these five minutes are about containment, not certainty.

First five minute response flow

Minute 1

  • Stop clicking and close suspicious pages
  • Disconnect risky downloads/sessions
  • Take a screenshot for evidence

Minutes 2-3

  • Change exposed login details from trusted bookmarks
  • Sign out unknown sessions
  • Lock card/payment methods if used

Minutes 4-5

  • Contact bank/support via official numbers
  • Tell your workplace IT team if work account involved
  • Start monitoring alerts

Next up in Phase 2

Interactive account and payment recovery checklists are planned after this Phase 1 rollout.