What to Do in the First Hour After a Security Alert

A security alert arrives — a login from a place you have never been, a password change you did not make, a withdrawal request you did not send — and the first thing most people do is nothing, or the wrong thing. They close the message and hope it goes away, or they rush through five settings pages at once and change things they cannot undo. Neither helps. The first hour after an alert is not the time for a full investigation. It is the time for triage: stop the bleeding, confirm what happened, and write down what you see.

Think of it the way a clinic treats a new patient. Nobody starts with the long-term treatment plan. They check breathing first, then bleeding, then the story of what happened. Your account deserves the same order. In the first sixty minutes you have three jobs: keep whoever should not be inside from getting further in, find out what they did if they got in, and leave yourself a record you can act on later. Everything else — the full password overhaul, the support ticket, the policy changes — comes after the hour, not during it.

This guide walks through that hour in order, minute by minute in spirit if not on a stopwatch. It assumes the alert is real, because treating a real alert as a false alarm is the expensive mistake. A false alarm costs you an hour of caution. A real alert treated as a false alarm can cost you the account.

Start by reading the alert itself, slowly, twice. A good alert tells you four things: what happened, when it happened, where it came from, and what triggered it. A login alert should name the device or browser, the approximate location, and the time. A settings alert should name the exact setting that changed. If any of those details are missing, that absence is itself information — either the platform does not log that detail, or the message you are reading is not from the platform at all.

Check where the alert came from before you act on it. Alerts that arrive inside the platform's own app or dashboard, under its security or activity section, are the most trustworthy. Alerts that arrive by email or text message deserve a second look: open the platform yourself, in a browser or app you trust, and see whether the same alert is waiting there. Never follow a link inside an alert message to sign in. Type the address yourself or use a bookmark. A convincing fake alert is one of the oldest ways to steal an account, and it works precisely because the victim is in a hurry.

Compare the alert against what you actually did. Did you sign in from a new device this morning? Did you travel? Did a colleague use the account? A surprising number of alerts have a boring explanation, and finding it in the first five minutes saves an hour of panic. If you cannot explain the alert, treat it as real and move on to the next step. Do not spend the hour trying to prove it was nothing.

The first action is the simplest: change the password, from a device you trust, and make the new one genuinely new — not a variation of the old one with a digit added. If you use a password manager, let it generate the replacement. If you do not, this is the week to start, but not in this hour: in this hour, write the new password down on paper and store it somewhere only you can reach until you have a manager in place.

Changing the password is only half the lock. Most platforms also let you sign out of all sessions, or review the list of devices still signed in. Use it. A password change does not always end sessions that are already open, and an intruder with an open session does not need your new password. End every session except the one you are using right now, then watch for the platform to ask the other devices to sign in again.

Then check your two-factor authentication. If it is on, confirm the method is still yours — the right authenticator app, the right phone number, the right security key. If it is off, turn it on now, with an authenticator app rather than text messages where the platform offers the choice. The guide to setting up two-factor authentication on this site, at /blog/two-factor-everything-setting-up-2fa-before-your-first-transaction, walks through the setup step by step, and the first hour after an alert is a good moment to read it. If your second factor was an email code, remember that the security of the account is only as strong as the security of that inbox — which is why the recovery email deserves its own check later in this hour.

With the door locked, look for damage. Open the account's recent activity or history page and read it like a ledger. Look for logins you do not recognise, password or email changes, new devices, new withdrawal addresses, new linked payment methods, and any transactions you did not make. Note the times. If something happened at 3 a.m. while you were asleep, that is the shape of the incident, and it matters for anything you report later.

Check the settings that an intruder would want to change, not just the ones that generate alerts. The email address on the account, the phone number, the withdrawal whitelist, the notification preferences — a quiet change to notification settings is a classic move, because it stops future alerts from reaching you. If alerts were turned off, turn them back on and treat that as evidence the alert you received was real and the intruder was trying to go quiet.

Do not undo damage you do not understand yet. If a withdrawal address was added that you do not recognise, remove it — that is safe. But if you find a transaction you did not make, do not try to reverse it yourself or move funds around in a panic. Note the details, take screenshots, and leave the money where it is until you have spoken to support or worked out what happened. Moving funds in a hurry is how a small incident becomes a large one.

Most accounts are only as secure as the email address attached to them, because that address receives the password resets. Open your recovery email account and check it the same way you checked the main account: recent logins, forwarding rules you did not set, filters that send security messages straight to trash, and a recovery phone number you still control. An intruder who controls the inbox controls the reset process, so a forwarding rule you never created is a red flag worth acting on immediately.

If the recovery email is shared with other accounts — and for most people it is — change its password too, and turn on its own two-factor authentication if it is not already on. The guide on recovery email hygiene at /blog/recovery-email-hygiene-the-inbox-behind-the-account-matters explains why the inbox behind the account matters as much as the account itself. Do this check even if the alert was about a different account: the inbox is the common thread, and an alert about one account is a prompt to check the thread.

Not every alert needs a support ticket. If the alert has a boring explanation, if nothing changed, and if the password and sessions are now clean, a ticket may add nothing. But contact support when any of these are true: something changed that you did not change, money moved that you did not move, you cannot sign in, or the alert keeps coming back after you have secured the account. When in doubt, report it. A support team would rather hear about a false alarm than learn about a real breach a week later.

Before you write, gather the facts in one place: the exact time of the alert, the device and location it named, what you found in the activity log, what you changed, and the times of each step. Support teams work from timelines, and a clear one gets a faster answer than a long description of how worried you are. Attach screenshots of the activity log, not of the alert message alone. Keep your own copy of everything you send.

Expect the support process to be slower than the hour you have just spent. Platforms may ask for identity documents, may freeze withdrawals while they check, and may take a day or more to reply. That is normal, and it is not a reason to keep using the account as though nothing happened. Until support confirms the account is clean, treat it as under observation: small transactions only, no new linked payment methods, no sharing of access with the team.

The mistakes in the first hour are almost always the same, and they are all made in a hurry. Do not click a link in an alert email or message to sign in — go to the platform yourself. Do not share a verification code with anyone, including someone who claims to be support: real support never asks for your code. Do not delete the alert or the activity entries; they are your evidence. And do not announce the incident publicly or in a group chat while you are still working out what happened — a public post can attract exactly the wrong kind of help.

Do not change everything at once and hope for the best. Changing the password, the email, the phone number, the payment methods and the API keys in one frantic sweep can lock you out of your own account and destroy the trail that shows what the intruder did. One careful change at a time, written down as you go, keeps you in control. The longer recovery — the full incident response plan at /blog/incident-response-plan-compromised-business-account — is there for the days after the alert, not for the first hour.

When the hour is up, take stock. The account should have a new password, clean sessions, working two-factor authentication, no unexplained changes, and a recovery email you have checked. Write a short note — a paragraph is enough — recording the alert, the times, what you found and what you changed. Keep it with your other account records, in the register the guide on this site recommends building for your portfolio. That note is what turns a scare into a lesson, and it is what you will reach for if the alert ever comes back.

Then make the changes the hour revealed. If you found that your passwords were reused across accounts, start replacing them, one account a day. If you found that alerts go to an inbox you rarely read, change the notification address. If the alert exposed a gap — no second factor, no recovery plan, no record of who holds the keys — close it this week, while the lesson is fresh. A security alert is an unwelcome message, but it is also a free audit, and the accounts that survive the next alert are usually the ones whose owners listened to the last one.

This article is educational and does not constitute financial, legal or tax advice. Platform rules and security features change, so always check the current guidance on the platform you use, and take professional advice where a decision affects your business, your money or your legal obligations.