You do not need a complete explanation before asking for help. Unexpected account activity, a suspicious payment or a device behaving unusually may be enough to start an incident record. Your first goal is to coordinate a response and reduce further harm while preserving information that can help establish what happened.
Start a clear incident record
Record when the issue was first noticed and who reported it.
Describe what you observed, separating confirmed facts from assumptions.
List affected accounts, devices or services and any immediate business impact.
Keep relevant messages, screenshots and transaction references securely.
Record actions already taken, including changes made by support staff.
Bring in the right people
Follow your organisation’s incident response plan and contact the person responsible for security or IT support. Agree who is coordinating, who can approve changes and how the team will communicate if normal email cannot be trusted. Keep the discussion to people who need the information. If you are an individual, use a trusted support route and the legitimate service provider’s recovery instructions.
Contain with care
Containment depends on the situation. A compromised account, a suspicious payment and a potentially infected device need different actions. Seek qualified assistance before making broad changes to business-critical systems. Avoid wiping devices or deleting logs as an initial reaction; those actions may remove information needed for investigation. Where there is an immediate safety concern, use established emergency and operational procedures.
Prepare a useful handover
A concise handover helps the next person act. Include the incident timeline, affected services, key observations and a contact who can answer questions. Share sensitive evidence through an agreed secure channel rather than a public post. Do not send passwords, PINs, one-time codes or recovery secrets as evidence. Use NC4’s official reporting contacts for reporting enquiries.
Recover and learn
Before returning a service to normal operation, agree the checks that will show it is ready. Record any temporary measures and who owns their removal. Afterwards, hold a short review: what helped, what delayed the response and which improvement has an owner and a deadline? A small, completed improvement is more useful than an unassigned list.
Further reading
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.