Something looks wrong and you’re about to pick up the phone.

Seven notes

1. Who: your name, your role, and the name of anyone else who used the computer or account.
2. What you saw: the exact words on the screen, and a phone photo of it taken before you close anything.
3. When: the date and time you first noticed it, and the last time everything looked normal.
4. Which computer: right-click Start, choose Settings, then System, then About. Write down the device name and the Windows version listed there.
5. Which account: the email address, and any other account that signs in on that computer.
6. What you did: every click, every password typed, every restart, in order, including what you did before you noticed anything.
7. What else: how many other people or computers show the same thing, and whether any money moved or was requested.

Take a photo before you close anything

A message that disappears can’t be read to anyone later. A photo of the screen with your phone keeps the wording, the number to call, and the time showing in the corner.

FTC guidance on responding to a breach says to document your investigation and not to destroy evidence. At this stage that means not deleting the email and not emptying the trash.

For an email account, add the sign-in list

If the problem is in a work or school email account, Microsoft’s My Sign-ins page lists recent activity with the date, location, device, browser, and app for each sign-in. Open it, select Recent Activity, and screenshot what you see. Microsoft notes that location is estimated from the internet address and that mobile networks can show distant places, so the screenshot is a record, not a verdict.

If you see a sign-in you don’t recognize, Microsoft says to change the password and then update your security information. Do that from a computer you trust, and write down the time you did it.

Order matters more than neatness

A timeline of three or four lines is enough. For example, with an invented date: “Oct 20, 9:40 a.m., opened an attachment from a customer. 9:45, a window asked me to sign in again; I did. 10:05, the screen showed a number to call.” The person helping you reads the order first, because the step where something changed is usually the step that points to the cause. Add times as you remember them and mark the ones you’re unsure of with a question mark.

Have three names ready

• The person who can approve work. In most small offices, the owner. Whoever helps will ask who decides.
• Your current IT contact. Even if you’re also calling someone else, they should hear about it from you.
• Your insurance agent. If money moved or a computer is locked, the agent is one of the first calls. Have the policy number and the agent’s phone number written next to your notes.

What stays out of the notes

Keep everything in one document, named with the date, and save it somewhere other than the affected computer, such as your phone or a different computer. Add to it as things happen instead of rewriting it later.

• Passwords and sign-in codes. Write “I typed my password,” never the password.
• Screenshots that show other people’s private information. Crop them or describe them.
• Guesses stated as facts. “It looks like a virus” belongs in the notes only as “I think.”

What these notes can and can’t tell anyone

Notes don’t show whether anything is wrong. They give whoever looks a starting point, with dates. When we look at it with you, a person reads the result and reports what turned up and what didn’t.

The first call goes better when the facts are already on the page.

Related

• How to Bring a Security Concern to the Owner
• Keeping Evidence Before You Clean Up a Computer
• Who to Tell After a Security Incident, and in What Order
• What a Compromise Check Can and Cannot Show You

Sources

• Microsoft Support: Which version of Windows operating system am I running?
• Microsoft Support: View your work or school account sign-in activity from My Sign-ins
• FTC: Data Breach Response, A Guide for Business