1. Isolate the Compromised Device
If a scammer gained remote access, immediately disconnect the device from the internet. Do not simply close the software; disable the Wi-Fi hardware or unplug the Ethernet cable to terminate all active sessions.
Incident Response & Recovery
A systematic technical framework for neutralizing active fraud threats and restoring financial integrity after a security breach.
Immediate Post-Breach Protocol
2. Verify Identity of Callers
Scammers often follow up a successful breach by posing as "fraud investigators." Never trust an incoming call after an incident. Always hang up and call the official number on the back of your bank card.
3. Document the Timeline
Record the exact time of the call, the number displayed on caller ID, and any names or "badge numbers" provided. This data is critical for the CRA and Government Impersonation reporting process.
Financial Containment
Rapid response prevents secondary unauthorized transfers and allows for the immediate freezing of credit facilities before permanent loss occurs.
Legal Documentation
Following a structured recovery plan ensures all necessary police and CAFC reports are filed, which is often a prerequisite for bank reimbursements.
Digital Sanitization
Systematic restoration removes hidden backdoors, keyloggers, and remote access trojans (RATs) that scammers may have installed during the breach.
Banking Security Reset
The evolution of banking security in Canada has transitioned from simple password protection to complex multi-factor authentication (MFA). Historically, a single compromise was manageable, but modern vishing attacks often target the entire digital identity. When a breach is confirmed, the first priority is contacting the financial institution's fraud department.
Request a "Security Freeze" on all accounts. This is more restrictive than a temporary lock and prevents any new credit applications or wire transfers. You must also update your Security Questions, as these are often harvested during initial social engineering phases.
⚠ CRITICAL WARNING
Do not use the same device that was compromised to change your passwords. Scammers may have installed keyloggers that transmit your new credentials in real-time.
Reporting Hierarchy
In Canada, incident reporting follows a specific three-tier hierarchy designed to alert both law enforcement and financial regulators. For decades, the process was fragmented, but today it is centralized through the Canadian Anti-Fraud Centre (CAFC).
- 01. Local Police: File an official report to obtain a file number, which is essential for insurance and bank claims.
- 02. CAFC: Report online or via phone to contribute to the national database of fraud trends and suspect numbers.
- 03. Credit Bureaus: Contact Equifax and TransUnion to place a fraud alert on your credit profile.
For more details on specific schemes, refer to the Grandparent and Emergency Schemes documentation to understand how these reports are categorized by authorities.
System Restoration Checklist
- 1
Software Audit
Open the Control Panel or Applications folder. Sort by "Date Installed" and remove any software added on the day of the incident (e.g., AnyDesk, TeamViewer, Zoho Assist).
- 2
Browser Sanitization
Clear all cookies, cache, and saved passwords. Scammers often use "Session Hijacking" to stay logged into your accounts even after you change your password.
- 3
OS Reinstallation (Optional but Recommended)
In cases of deep system compromise, a full "Factory Reset" is the only way to ensure 100% removal of persistent malware. Backup personal files to an external drive first.
Need Technical Guidance?
Our technical shielding manual provides step-by-step instructions on securing your hardware against future attempts.
View Protection ManualThe information provided in this recovery manual is synthesized from public security advisories, historical fraud data, and general technical best practices. These materials are intended for educational purposes only and do not constitute formal legal or financial advice. We recommend consulting with your specific financial institution and local law enforcement for personalized incident response.