If you think someone else has access to your work account, act quickly, but calmly. This article covers the warning signs and the steps to take straight away.
Warning signs
- MFA prompts you didn't trigger.
- Sent emails you didn't write.
- New inbox rules or forwarding you didn't set up.
- Contacts telling you they've received strange messages from you.
- You typed your password into a page that turned out to be fake.
What to do now
- Stop interacting with anything suspicious. Don't click further links, open attachments or approve MFA prompts you didn't start.
- Call synfo on 1300 079 636. Tell us what happened and when. We can sign you out of all sessions, reset your credentials and MFA, and check your mailbox for rules or forwarding an attacker may have added.
- If you can do so safely, change your password from a device you trust. If you reused that password anywhere else, change it there too.
- Don't delete the evidence. Leave the suspicious email where it is so we can investigate it.
- If money or bank details are involved, contact your bank immediately and let us know.
- Follow up with an email to support@synfo.com.au with P1 in the subject so there's a written record.
A suspected security incident is a phone call, not only an email. Call 1300 079 636 first, then send the P1 email.
After the call
We may ask you to sign in again on your devices, set up MFA again, or check whether anything unusual was sent from your mailbox. If emails were sent from your account, your manager may want to warn the people who received them.
If you're a synfo managed security client, our Security Operations Centre may already be looking into it by the time you call.
Reporting to the authorities
For individuals and businesses, the Australian Cyber Security Centre offers reporting and recovery guidance at cyber.gov.au. If money has been lost, your bank may also ask you to report it.
Still stuck?
If anything looks wrong after the first steps, don't wait: call 1300 079 636 again.