Reporting A Hacker

The Early-Warning Radar is a simple way to watch four areas: account access, device behavior, business or household records, and messages that pressure you to act. One odd event may have an innocent explanation. Several related events deserve immediate attention. Ask yourself: “Did I cause this change, and can I verify it through a trusted source?” If the answer is no, treat the event as suspicious until you confirm it.

1. Check account access. Review sign-in alerts, active sessions, password changes, recovery email addresses, and phone numbers. An unfamiliar device or location does not always prove a break-in; travel, a virtual private network, or a mobile carrier can affect location results. However, an unfamiliar device combined with a new recovery address requires action because the intruder may be trying to keep control.

2. Check device behavior. Watch for new programs, disabled security tools, unexpected camera or microphone activity, repeated pop-ups, new browser extensions, or a computer that sends data or connects to the internet while you are not using it. A slow device alone may indicate age or a failing drive. Slow performance plus unknown software or disabled protection carries more weight.

3. Check records and money movement. Look for changed invoices, new payees, altered shipping addresses, unfamiliar purchases, deleted files, changed employee permissions, or customer messages sent from your account. These signs matter because an intruder may not announce access; they may quietly change information that causes a payment, shipment, or privacy problem.

4. Check pressure messages. Treat urgent requests for passwords, gift cards, wire transfers, verification codes, or remote access as warning signs, especially when the request arrives through a new number or address. Attackers often use a real conversation, copied logo, or familiar name to make an unauthorized request seem normal.

5. Record the pattern. Write down the date, time, account or device, exact wording, and action you took. Save screenshots and original messages. A clear timeline helps you compare events and gives an internet service provider, bank, platform, or law enforcement agency something specific to review.

Use more than one trusted path when you verify an alert. If an email says your bank account needs attention, do not click its link. Open the bank’s known app or type the bank’s address yourself. If a manager sends a payment request by text, call the manager using the number already stored in your records. This prevents an attacker from confirming one lie with another.

Do not rely on a single clue. A sign-in from a nearby city may result from a service provider’s routing. A changed password, unfamiliar recovery phone number, and deleted security alert form a stronger pattern. The Early-Warning Radar works by connecting clues that affect the same account, device, or transaction.

Your practical takeaway: check access, behavior, records, and pressure messages, then write down what you find before you reset or delete anything.

Apply the Radar to a Suspicious Morning

A small fitness business notices three events before opening: the owner receives a password-reset email at 6:12 a.m., the payment dashboard shows a new bank account ending in 4421, and two customers report unusual messages sent from the business email address. The owner did not request a reset, approve the bank change, or send those messages. The events affect the same business identity, so the owner should treat them as a possible intrusion rather than separate technical problems.

Follow these steps:

1. Stop new changes at 6:20 a.m. The owner tells staff not to process refunds, change payment details, or answer unusual account requests. This reduces the chance that someone sends money or gives the intruder more information while the owner checks the accounts.

2. Use a trusted device at 6:25 a.m. The owner uses a phone that does not show unusual behavior and opens the payment provider through its saved app. The owner does not use links in the reset email. This avoids giving credentials to a fake login page.

3. Capture the evidence at 6:30 a.m. The owner takes screenshots of the reset message, the payment account ending in 4421, the customer reports, and the account’s active-session page. The owner saves the email in its original form when the provider allows it and records exact times. The expected outcome is a basic evidence set that shows what changed and when.

4. Secure the email account at 6:40 a.m. The owner changes the password from the trusted device, signs out unknown sessions, removes an unfamiliar recovery address, and turns on multifactor authentication, which requires a second proof such as an app code or security key. The owner checks forwarding rules because an intruder may forward incoming mail while the account appears normal.

5. Contact the payment provider at 6:50 a.m. The owner uses the phone number from the provider’s official website or account statement, not the suspicious email. The owner reports an unauthorized bank-detail change, asks the provider to freeze payouts and review access logs, and requests a case number. The expected outcome is a documented provider response and a chance to stop funds from moving.

6. Check connected accounts at 7:10 a.m. The owner reviews the business email, payment system, scheduling system, social media, cloud storage, and payroll account. The owner looks for the same unfamiliar email address, phone number, device, or session. This matters because attackers often reuse a stolen password across services.

7. Preserve the timeline at 7:30 a.m. The owner creates a file named 2026-09-17_intrusion-notes and records each event in local time. The owner lists the account, action, source of the information, screenshot name, and response. The expected outcome is a record that another person can understand without guessing.

8. Report the suspected crime. After securing urgent accounts and contacting affected providers, the owner reports the unauthorized access and payment change to the appropriate platform, bank, and law enforcement channel. The owner provides facts, not guesses: “A bank account ending in 4421 appeared at 6:25 a.m.; I did not add it; these screenshots show the change.” Specific facts make the report easier to review.

A useful timeline may look like this:

| Time | Observation | Action | Expected result | |---|---|---|---| | 6:12 a.m. | Unrequested password reset | Saved the message | Evidence preserved | | 6:25 a.m. | New payout account ending in 4421 | Captured screenshot | Unauthorized change documented | | 6:40 a.m. | Unknown email session | Changed password and signed out sessions | Access reduced | | 6:50 a.m. | Payment details altered | Called provider from official number | Case opened and payouts reviewed |

Quick checklist

• Confirm the event through an official app, website, or known phone number. - Stop payments, refunds, and account changes until you understand the warning. - Capture screenshots showing dates, times, account names, and changed details. - Save original emails and messages when possible. - Change passwords from a trusted device. - Sign out unknown sessions and review recovery settings. - Turn on multifactor authentication. - Check forwarding rules and connected applications. - Request case numbers from providers. - Record facts without claiming an identity you cannot prove.

The outcome you want at this stage is not a dramatic confrontation. You want controlled access, preserved records, and a timeline that shows the first warning through your response.

Avoid Mistakes That Hide the Warning

Resetting everything before saving evidence

A rushed password reset can remove active-session details, delete suspicious forwarding rules, or change timestamps that help explain what happened. Secure the account, but preserve what you can first.

Do this: Capture the alert, account page, device list, recovery settings, and changed transaction details. Record the time before you sign out sessions or remove access.

Not this: Delete every suspicious email, wipe the computer, or close the account before saving records.

If a device continues to behave dangerously, disconnect it from the internet after documenting the visible signs and contact a qualified technician or appropriate authority. Do not repeatedly experiment on it; each action can change evidence.

Treating one unusual location as proof

Location information can mislead you. A mobile provider may route traffic through another city, and a legitimate service may show a shared data-center address. A location becomes more concerning when it appears with an unknown device, a password change, or a new recovery method.

Do this: Compare the location with your travel, devices, sign-in time, and account changes. Mark the event as “unconfirmed” unless other facts support it.

Not this: Accuse a neighbor, employee, customer, or specific person because a sign-in screen shows a nearby city.

A report based on guesses can distract from the evidence and create legal problems. Report the unauthorized activity and provide the records that investigators can verify.

Trusting the message that reports the problem

A fake security alert may direct you to a convincing login page or a phone number controlled by the attacker. The message may include your name, business logo, or a real transaction reference copied from another source.

Do this: Open the known app, type the official website yourself, or use a phone number from a prior statement. Ask the provider to confirm whether the alert exists in its system.

Not this: Click the link, call the number in the message, install remote-control software, or read a verification code to an unsolicited caller.

A warning only helps when you verify it safely. Keep using the Early-Warning Radar: compare access, device behavior, records, and pressure messages; preserve the facts; then act through trusted channels. Those first careful observations can become the foundation for a complete report and a stronger legal response.

End of chapter one. 39 more chapters in the full book.