The 'Help, I Think I've Been Hacked' Checklist for Seniors

This post is the one I want every senior in Portage County to save somewhere they can find it.

Print it. Tape it inside a kitchen cabinet. Email it to yourself. Whatever works. Because the moment you need it, you’re going to be panicked, and panicked people don’t think clearly. Having a list to follow is the difference between losing some money and losing a lot.

I’m Bill Davis. I run Bill’s Home Tech in Atwater, and I’ve helped a lot of folks through the “I think something’s wrong” moment. Here’s the seven steps, in the order I’d want my own mother to do them. None of them require you to be a tech person.

When does this list apply?

Do this checklist if any of these things just happened:

• You clicked a link in a suspicious email and now your computer is acting weird.
• A “Microsoft” person called and walked you through something on your computer, and now you’re not sure what they did.
• You see a charge on your bank or credit card you don’t recognize.
• A friend or family member says they got a strange message from your email or Facebook.
• A pop-up on your computer screamed at you that you have a virus and you called the number on it.
• You typed your password into a website and a few hours later it feels off — slow, weird, “not right.”
• Money is missing from any account.

If any of these are happening, work the list. Don’t skip steps. Don’t do them out of order.

Step 1: Stop. Breathe. Don’t pay anyone right now.

The very first thing to do is stop talking to whoever is currently pressuring you.

If someone is on the phone with you right now telling you to “buy gift cards” or “wire money” or “give them remote access” — hang up. Right now. You don’t have to be polite. You don’t owe them an explanation. Just hang up.

If you’re talking to someone who claims they’re from your bank, the IRS, Medicare, a tech company, or any government agency — they’re lying. Real organizations do not work this way. Hang up.

The rest of this list assumes you’ve stopped giving anyone information.

Step 2: If a stranger had remote control of your computer — unplug it.

If you let a “tech support” person remote into your computer to “fix a virus,” they almost certainly installed something bad and saw any password you have saved.

Take these actions, in this exact order:

1. Unplug the computer’s internet connection. If it’s wired (an ethernet cable), pull the cable out of the back. If it’s Wi-Fi, click the Wi-Fi icon and disconnect — or just turn off your router. Cutting the internet stops them from doing anything else right this second.
2. Don’t shut the computer off if you can help it. Some malware reactivates on shutdown. Just leave it on, but disconnected.
3. Now you’ve got time to do the next steps.

The computer itself we’ll deal with later. Right now we’re protecting your accounts.

Step 3: Call your bank. Now. Right now.

This is the highest-priority step. Call your bank.

Use the number on the back of your debit/credit card — not a number from any email, text, or website. The number on the card is real.

Tell them: “I think I’ve been the target of a scam. I want you to put a temporary freeze on my accounts and review recent transactions.”

They do this every day. They’re not going to think you’re stupid. They’re going to thank you for calling early.

If money has already moved, call the same day. Banks have a much harder time clawing back money after 24-48 hours.

If you have multiple banks, multiple credit cards — call each one. It’s tedious. Do it anyway.

Step 4: Change your passwords — but in the right order.

Pick a different device than the compromised one. Use your phone, a tablet, your spouse’s computer, a library computer — anywhere except the computer that might be infected.

Change passwords in this order:

1. Email password first. Always. Email is the master key. If a bad guy controls your email, they can reset every other password you have.
2. Bank logins.
3. Amazon, PayPal, anything else with your credit card on file.
4. Social media (Facebook, Instagram).
5. Everything else, in roughly the order of “how bad if someone got in?”

Make every new password different. Yes, that’s annoying. This is also the moment to install a password manager — once you have one, this exact crisis is a 4-minute fix instead of a multi-day job.

Step 5: Turn on two-factor authentication on your email and bank.

While you’re changing the email password, look for a setting called two-factor authentication or two-step verification in the settings. Turn it on.

What this does: even if a bad guy gets your password later, they can’t log in without a code that gets texted to your phone. So your phone becomes the second key.

It takes about 60 seconds to set up. It’s the single biggest security upgrade you can do, and most people don’t do it because nobody told them to.

If you can only do this on two accounts, do it on: 1. Your email 2. Your main bank

Those two are the doors that need the deadbolt.

Step 6: Freeze your credit at all three bureaus.

This is free. It takes about 30 minutes total. It is the single biggest defense against identity theft.

A “credit freeze” means nobody — including you — can open new credit in your name without unfreezing it first. So if a scammer has your Social Security number, they still can’t open a credit card or a car loan.

You have to do it at all three credit bureaus:

• Equifax: equifax.com/personal/credit-report-services or 1-888-298-0045
• Experian: experian.com/freeze or 1-888-397-3742
• TransUnion: transunion.com/credit-freeze or 1-800-916-8800

Each one will ask for your name, SSN, address, and date of birth. They’ll give you a PIN. Save the PIN somewhere safe — you’ll need it if you ever want to apply for a new credit card or a mortgage in the future. (Add this to your password manager.)

This step alone has saved several of my clients from major identity theft headaches.

Step 7: Get the computer cleaned (or call me).

Now that your accounts are protected, we deal with the computer itself.

Two options:

Option A: Take it somewhere. A reputable local repair shop, or me. We’ll wipe out anything the scammer installed, run virus scans, and reset Windows or macOS to a known-clean state. About 1-2 hours. Don’t take it to a national chain — they’re either too expensive or don’t do this kind of work properly.

Option B: Wipe it yourself. This is doable but technical. You’re going to “factory reset” the computer. It deletes everything (so your photos and documents would be lost — but if you’ve been backing them up, see the photo backup post, they’re safe). Then you reinstall the apps you actually use.

Most clients call me. Flat $99 covers the cleanup, plus I’ll help you with the rest of the list — I’ll sit with you while you call the bank, walk you through password changes on a clean device, and set up two-factor on your email.

Call (330) 200-8042 or book at billshometech.com.

What you don’t need to do

A few things people think they need to do, that they actually don’t:

• You don’t need to file a police report unless money was lost or someone has your physical identity (passport, driver’s license, etc.). Police can take a report, but they generally can’t do much about the typical computer scam.
• You don’t need to “report it” to the company that was impersonated. Microsoft already knows fake Microsoft calls happen. So does your bank. So does the IRS. Reporting it doesn’t speed up the help you’ll get.
• You don’t need to wipe and replace your phone unless you specifically gave a scammer access to your phone. (If they only got your computer, your phone is fine.)
• You don’t need to feel embarrassed. Smart people fall for these. Doctors, lawyers, retired engineers. The scams work because they’re well-designed, not because the victim is dumb.

What I tell every client after this happens

If you got hit, you got hit. Beating yourself up about it doesn’t undo it. The clock is ticking, and your job is to do the seven steps as fast as you reasonably can.

After it’s over — usually a couple weeks of follow-up — most of my clients tell me the same thing: “I feel safer than I did before this happened, because now I know what to do.”

That’s the real outcome. You don’t get back to neutral. You come out more secure than you were, because the seven steps put protections in place you didn’t have before. Two-factor on your email. A credit freeze. A password manager. A clean computer. Phone numbers saved for your bank, the credit bureaus, and a tech person who’ll pick up.

That last one — saving the phone numbers — matters more than you’d think. If something feels off next year, you don’t go searching the internet (where another scammer is waiting). You pick up the phone and call someone you’ve already vetted.

Tape this list inside a cabinet. Put my number on the fridge. And try not to lose any sleep over the maybe-hack tonight; we’ve got this.