If you can't rule phishing out within an hour, treat it as confirmed and rotate credentials anyway.
What to do
- Change the bank password and your primary email password from a clean device
- Sign out of all sessions on email, bank app and any account that shares the bank password
- Cancel and reissue the card if you ever entered details on a suspicious page
- Run a malware scan on the device you bank from before logging back in
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers