Resource note

Resources / Incident Readiness

Build a One-Page Panic Sheet for Account Takeover

Prepare a short checklist of who to contact, which accounts to recover first, and what evidence to preserve during an account takeover.

Incident Readiness Published by Velocity Ops Updated

Resource note

Resources / Incident Readiness

A panic sheet is a short reference for the first steps after an account takeover. Keep it somewhere you can reach without signing in to the account that may be compromised. Do not write passwords, authentication codes, or recovery keys on the sheet.

One-page outline

  1. **First checks:** which email, phone, or identity account appears affected, and how to reach the provider's official recovery page from a separate device.
  2. **Account order:** list the accounts that depend on the affected email or phone, with the official recovery link for each.
  3. **Trusted contacts:** write the provider's fraud/support channel, a personal contact who can help, and a bank number from the back of a card or account statement.
  4. **Containment:** note how to sign out other sessions, revoke app access, or lock a payment method where the provider supports it.
  5. **Evidence:** preserve timestamps, provider case numbers, suspicious messages, and unauthorized transactions without forwarding passwords or private records.
  6. **After recovery:** update recovery methods, check forwarding rules and connected apps, and monitor accounts for changes.

Read the plan once with a trusted person and replace links or phone numbers that become outdated. If the event is active, follow the affected provider's incident instructions and seek qualified help where needed.

Sources and further reading