Respond in the Right Order
The response depends on what was clicked, installed, shared, or controlled.What you clicked, installed, shared, or allowed guides the response.
1Stop and Verify
Stop using the number or link in the warning. We review what happened and look for signs that someone gained access.Stop using the warning’s number or link. We check what happened and any unauthorized access.
2Clean Up Together
I remove suspicious remote tools, browser notifications, extensions, startup items, and other unwanted changes.I remove suspicious remote tools, notifications, extensions, startup items, and unwanted changes.
3Check Affected Accounts
We change affected passwords from a clean device, review account activity, and enable two-factor authentication on important accounts.We change affected passwords from a clean device, review activity, and enable two-factor authentication.