Home / Commons / Incident log

Tool

Write it down as it happens.

A timestamped log for the day something goes wrong, with account-recovery checklists from official sources and the agency to report to. Print it or download it for your insurer, bank or regulator.

FreeNo sign-upNothing leaves your browserPrints the log and checklists

This log keeps your record; it does not report anything. It is not a substitute for your insurer, IT help, bank or national agency, and Moraph for Good is not an emergency service. If money has gone, call your bank first. Just clicked a phishing link? Read After a phishing click: the next 24 hours.

This tool needs JavaScript, which is turned off. Below is a blank log sheet and the recovery checklists instead: print them with your browser’s Print command and fill them in by hand.

Free, no sign-up. Nothing you type leaves your browser. Your log is saved in this browser only, so it is still here if the page closes. Print or download it for your records, then use Clear everything, especially on a shared computer.

01About this incident

02Add an entry

One entry for each thing that happens or that you do. Times are in this device’s time zone.

Quick add, timed now

03Account recovery checklists

Open the kind of account that was affected, name it, and tick each step as you do it. The time is noted for you.

Email account0 of 11 done
  • Source: NCSC, Get Cyber Safe
  • Source: Microsoft 365, Google Workspace
  • Source: NCSC, FTC, Microsoft 365
  • Source: NCSC, Microsoft 365
  • Source: NCSC, FTC
  • Source: FTC, Google Workspace
  • Source: Microsoft 365, Google Workspace
  • Source: NCSC, NCSC secure your email, Get Cyber Safe
  • Source: FTC, Microsoft 365
  • Source: NCSC, FTC
  • Source: NCSC, NCSC phishing, FTC
Bank and payments0 of 9 done
  • Source: NCSC, NCSC payment fraud
  • Source: IC3
  • Source: NCSC phishing
  • Source: IdentityTheft.gov
  • Source: IdentityTheft.gov
  • Source: NCSC
  • Source: IC3, NCSC
  • Source: IdentityTheft.gov
  • Source: IdentityTheft.gov
Social media0 of 10 done
  • Source: NCSC social media
  • Source: NCSC social media, NCSC, FTC
  • Source: NCSC, FTC
  • Source: NCSC, NCSC social media, FTC
  • Source: NCSC social media, FTC
  • Source: FTC
  • Source: NCSC social media
  • Source: FTC
  • Source: NCSC, FTC
  • Source: NCSC
Cloud storage and online services0 of 9 done
  • Source: NCSC online services
  • Source: Microsoft 365, Google Workspace
  • Source: NCSC
  • Source: Microsoft 365, Google Workspace
  • Source: Microsoft 365
  • Source: Google Workspace, NCSC
  • Source: Microsoft OneDrive
  • Source: Microsoft 365, Google Workspace
  • Source: FTC breach guide

Your log

Fills in as you type.

Incident log

Organization:

Log kept by
Report to
Reference numbers
Time zone

Oldest first. Write what you noticed, when, and what you did. Responders, insurers and regulators will ask for it.

Incident log entries, oldest first
TimeWhat happenedWhat we didWhoEvidence kept atChange

Keep evidence: do not delete suspicious emails or switch off affected devices.

From the free incident log at moraph.org/commons/incident-log. Not a substitute for your insurer, IT help or national agency.

Account recovery checklist

Taking accounts back

Organization

Tick each step and note the time. Steps from the UK NCSC, Get Cyber Safe (Canada), the US FTC and FBI, Microsoft and Google: see moraph.org/commons/incident-log#sources.

Email account

Account:

  • If you are locked out, use the provider’s own recovery pages, and tell the provider the account was compromised.
  • If an administrator runs your email (Microsoft 365, Google Workspace), ask them to suspend the account while you investigate.
  • Check filters, inbox rules and forwarding. Delete any you did not set up, before you change the password.
  • Change the password to a strong, unique one, and change it on every other account that used the same password. Never send a new password by email.
  • Sign the account out of all devices and apps.
  • Check the recovery email addresses and phone numbers are yours.
  • Remove sign-in methods, devices, app passwords and connected apps you do not recognize.
  • Turn on 2-step verification, or passkeys where the provider supports them.
  • Look in Sent and Deleted items for messages the attacker sent, or read and then deleted.
  • Tell your contacts, and ask them to treat recent messages from the account with suspicion, especially requests for payment.
  • Update the device and run a full security scan.

Bank and payments

Account:

  • Call the bank’s fraud line on the number from its official website or your card, not one from a message.
  • If money went to the wrong account, ask the bank to recall or reverse the payment straight away.
  • If card or banking details were typed into a fake page, tell the bank and cancel the cards.
  • Ask the bank to close or freeze any account where fraud happened.
  • Change online banking logins, passwords and PINs.
  • Check statements and payment approvals for anything you do not recognize.
  • If money was lost, report it as a crime: in the United States to the FBI’s IC3, in the United Kingdom to Report Fraud (Police Scotland on 101).
  • If someone’s identity was used to open accounts in the United States, IdentityTheft.gov gives a recovery plan, including fraud alerts.
  • Write down who you spoke to, when, and every reference number.

Social media

Account:

  • Regain control of the account first. Fixing posts the attacker made can wait.
  • Use the platform’s recovery process. If the attacker changed the recovery details, contact the platform.
  • Change the password, and any other account that used it.
  • Sign out of all devices and apps, including social media management tools.
  • Turn on 2-step verification.
  • Check the recovery email address and phone number are yours.
  • Check who has access to publish, and remove anyone who should not, including people who have left.
  • Look for posts, messages and new connections you do not recognize.
  • Tell followers and contacts to ignore recent links or requests for money from the account.
  • If you cannot recover it, open a new account and tell people the old one is abandoned.

Cloud storage and online services

Account:

  • Follow the service’s own recovery steps; Microsoft 365 and Google Workspace publish them for administrators.
  • An administrator can suspend the account, reset the password and revoke its sessions and tokens.
  • Change the password and sign out of every device.
  • Remove connected apps and app passwords you do not recognize.
  • Check the account’s administrator roles and remove any it should not have.
  • Turn on 2-step verification; security keys give administrators stronger protection.
  • Check for files that were deleted, overwritten or encrypted, and restore them from the recycle bin or earlier versions.
  • Ask your administrator to review sign-in and activity logs from before the first sign of trouble.
  • If personal information may have been seen or taken, find out whether you must tell anyone (see privacy duties).

Keep this with the incident log.

From the free incident log at moraph.org/commons/incident-log. General information, not legal advice.

Tip: the text file keeps everything, including the checklists; the spreadsheet file has the log entries only.

Where to report

National agencies that take incident reports.

Choosing a country above puts the agency on your log. Elsewhere, contact your national computer emergency response team (CERT) or the police. If personal information may be involved, you may also have duties to tell a regulator or the people affected: see privacy duties, country by country.

When it is over, hold a short, blameless review. Plan ahead with the incident plan builder. If a payment was redirected, see the payment fraud toolkit.

Sources

Where this comes from.

Official sources only: national cyber security and consumer protection agencies, and the services’ own help pages. Each was opened and checked on 21 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.

Last reviewed October 2026

  1. UK National Cyber Security CentreRecovering a hacked accountwww.ncsc.gov.uk/guidance/recovering-a-hacked-account
  2. Canadian Centre for Cyber Security (Get Cyber Safe)Recovering a hacked accountwww.getcybersafe.gc.ca/en/blogs/recovering-hacked-account
  3. MicrosoftRespond to a compromised email account in Microsoft 365learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account
  4. GoogleIdentify and secure compromised accounts (Google Workspace)knowledge.workspace.google.com/admin/support/troubleshooting/identify-and-secure-compromised-accounts?hl=en
  5. US Federal Trade CommissionHow to recover your hacked email or social media accountconsumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account
  6. UK National Cyber Security CentreSmall organisations guide: secure your emailwww.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-email
  7. UK National Cyber Security CentrePhishing: I’ve received a suspicious messagewww.ncsc.gov.uk/section/respond-recover/phishing
  8. UK National Cyber Security CentreBusiness payment fraudwww.ncsc.gov.uk/section/respond-recover/business-payment-fraud
  9. FBI Internet Crime Complaint Center (IC3)Business Email Compromisewww.ic3.gov/CrimeInfo/BEC
  10. US Federal Trade Commission (IdentityTheft.gov)Identity theft recovery stepswww.identitytheft.gov/Steps
  11. UK National Cyber Security CentreSocial media: protecting what you publishwww.ncsc.gov.uk/guidance/social-media-protect-what-you-publish
  12. UK National Cyber Security CentreUsing online services safely: recovering a hacked account or servicewww.ncsc.gov.uk/collection/using-online-services-safely/recovering-hacked-account-or-service
  13. MicrosoftRestore your OneDrivesupport.microsoft.com/en-us/onedrive/restore-your-onedrive
  14. US Federal Trade CommissionData breach response: a guide for businesswww.ftc.gov/business-guidance/resources/data-breach-response-guide-business

After the incident

Shield can help eligible organizations review what happened and put fixes in place. It is not an emergency service.

Apply for Shield