You think you have been hacked or scammed. What now? The first job is not to work out how it happened. It is to stop it spreading.

The victims are rarely who you expect. Some are highly experienced professionals. Some are younger and extremely comfortable with technology. The common denominator is usually not a lack of intelligence or digital skills. It is that modern scams are becoming remarkably convincing.

A scam creates urgency twice. First, when the criminal pressures you to act. Then again when you realise something may be wrong. That second burst of urgency needs an order.

Stop the money. Secure access. Report what happened.

There will be time to work out exactly what went wrong. Right now, the priority is limiting what happens next. If you suspect a device has been compromised, disconnect it from the internet and stop any further access while you begin the recovery process

1. Call the financial institutions involved

Use a trusted phone number—not one supplied in the suspicious message. Tell the bank, card provider, super fund or financial-services provider what happened, ask them to stop further transactions and review every account and card.

2. Secure key government and email accounts

Change the credentials for myGov and your email account. Treat email as the master key: it can expose identity documents, bills, password resets and correspondence with financial providers.

3. Report what happened

Report the incident to Scamwatch. If identity information may be exposed, contact IDCARE. For compromised email, malware or suspected hacking, follow the recovery guidance at Cyber.gov.au.

4. Check whether your identity is being used

Check your credit report with Equifax, illion or Experian and consider a credit alert. You are looking for applications or debts you do not recognise.

5. Clean the device before changing everything

If you downloaded software, granted remote access or entered information on the device, get professional IT advice before changing passwords. A compromised device may simply capture the new ones.

Once the device is clean, reset every account accessed from it and enable multi-factor authentication where available.

6. Expect a second attempt

Expect a follow-up—especially from someone offering to recover the money. They may know details of the first scam because your information has been shared or sold, not because they are legitimate.

Never provide passwords, security codes or remote access. If someone claims to represent an organisation, end the call and contact it independently using a trusted number.

Our view: Anyone can be scammed. Embarrassment only buys the criminal more time. Act quickly, use trusted channels and tell someone. In the first few hours, calm is urgency with an order.