Use another trusted phone or computer. Do not type new passwords on the device that already looks wrong. This does not replace the bank, your employer or the authorities.
Write down (2 minutes)
- Time and date (with timezone if you travel)
- What you noticed: mail “from you”, a sign-in notice, a strange device on the list, a password change you did not make
- Which account (mail / bank / social / work)
- Whether anyone already clicked links or dictated codes
Do not do this now
- Do not click “recover account” links from SMS / email — open the address typed by hand or from a bookmark
- Do not send BLIK / SMS / app codes “to prove it is you”
- Do not “clean reboot” the only computer with evidence
- Do not paste passwords and disk dumps into a chat with a friend
When the bank
- Suspected transfer, BLIK, card, bank login → bank on an official number (app / card / site, not from an SMS)
- After a code or password already given: first minutes after a code
When the role map and account card
- Unsure whether to call the bank, CERT, police, DPA: who does what
- Mail / social / work account taken over or highly suspect: account-takeover card
When the IR form
- Company, many accounts, unclear scope, need external triage → SOC / IR contact or consultation
- tomek.st phone is temporarily unavailable; form usually 1 business day — not a 24/7 SOC roster
Narrative teaching example: account recovery case.