What do we actually know?
Keep the URL, date, apparent author, context and a readable copy. A screenshot can be useful, but it does not by itself prove a source or integrity. Separate what has been observed from what has been inferred.
Resource centre
Reference points for decisions with fewer blind spots.
This library provides practical method notes for before, during and after a sensitive digital situation. It does not replace legal advice or an emergency response from the appropriate authorities; it helps distinguish a signal to monitor from a fact to document or a situation requiring immediate action.
Quick read
Three questions before responding.
What harm is plausible?
Consider concrete consequences: financial loss, privacy, personal safety, business continuity, fraud, reputation or proceedings. The intensity of a message is not always proportional to its actual impact.
What cannot wait?
A compromised account, targeted threat, fraudulent payment, sensitive-data disclosure or active impersonation may require immediate steps. In other cases, a hasty response can destroy evidence or amplify a marginal item.
First-hours checklist
Respond without losing what matters.
A digital situation can evolve quickly. These first steps help contain risk without turning an alert into a public spectacle or accidentally removing what may need to be reviewed later.
Contain exposure
Change access that may be compromised, enable multi-factor authentication where possible and remove unnecessary sharing. For a suspicious payment, use official channels for your bank or provider.
Fix the facts
Record the time of discovery, concerned people and what was observed. Retain exact addresses, identifiers, complete messages and relevant attachments.
Limit exchanges
Avoid public accusations, contacting a suspected author or sharing screenshots before context is understood. A quick response can amplify a marginal item or disclose useful information.
Alert usefully
Tell the appropriate internal or external contacts using a factual summary, urgency level and verifiable material rather than a final interpretation.
Keep originals
Preserve original emails, files and captures where relevant. Do not overwrite or edit a file without keeping an intact copy.
Use the right channel
Open-source analysis can clarify facts, but personal emergencies, technical compromise and legal steps also require the appropriate professionals and authorities.
Source reliability
Read online information with care.
Online information is not reliable merely because it is easy to find, repeated or confidently presented. Its value depends on the identifiable author, date, proximity to the original source, possible interests and independent corroboration.
Context also changes meaning. A register reflects an administrative position at a given time; a social account may be operated by several people; a web archive demonstrates that content was visible, not necessarily who created it or why.
Likewise, the absence of a trace does not automatically demonstrate the absence of a fact. A useful report makes room for uncertainty and outstanding verification.
Prioritisation
Assess a signal without panic.
LevelObservable signalsHelpful first response
Monitor
An isolated mention, minor inconsistency, inactive profile or uncorroborated information.
Record the source, check the date, seek independent evidence and avoid relaying it.
Assess
Several converging traces, a lookalike domain, a spreading narrative or a doubtful commercial contact.
Preserve relevant material, cross-check identifiers and assess affected people and assets.
Respond
Active impersonation, data exposure, identifiable campaign, fraud or an ongoing loss.
Protect access, document a timeline, alert competent contacts and prepare reports.
Urgent
A threat to a person, confirmed compromise, extortion, fraudulent payment or ongoing sensitive disclosure.
Follow the emergency plan and contact the appropriate services without delay; preserve material without negotiating or sharing more data.
Preserve material
Build a usable case file.
Before reporting, removing or replying, note what will allow the content to be found again: exact address, date and time, relevant account or site, transaction identifier, received files and discovery context. Keep originals where relevant and avoid modifying them without retaining an intact copy.
Write a simple timeline: what was observed, what action was taken and what response was received. Clearly distinguish certain information from recollection or interpretation. This makes conversations with counsel, insurers, platforms and technical specialists more effective.
Never send passwords, one-time codes, banking details or unnecessarily sensitive documents in a first message. A factual summary and urgency level are enough to start a professional scoping discussion.
Confidential scoping