Record the first sign of compromise, login alerts, account changes and suspicious messages. For a work account, notify the responsible IT or security team; consider evidence preservation before wiping a device or performing a broad reset.
Use a secure device and the service’s official recovery process, reviewing unknown sessions and connected applications and strengthening credentials and authentication. If financial information is involved, promptly tell the bank what actually happened and which transactions are affected.
Submit an official police or cyber incident report through the appropriate channel. Ownership of your account does not authorise hacking someone else’s system in retaliation; keep any technical investigation within the access permissions you genuinely hold.
A practical next step
Create an incident folder with times, alerts and changes, secure the account through the official recovery route, and retain records for reporting.
Official sources
Adapted from a photo post shared on Dr. Bahrami’s Instagram and checked against official sources. This page provides the updated guidance.
Original Instagram post