It's 11:40 on a Tuesday when three password reset emails land in a row. Then your bank app refuses your login. Somewhere between the second and third notification you realise this isn't a glitch.
The worst moment to design a recovery plan is while you're living through the breach. Under stress, working memory collapses, and you will click things you shouldn't. A one-page personal incident response plan isn't a security program — it's the card taped inside the kitchen cabinet that tells you where the shut-off valve is. It says who to call, what to do first, and what to save, before you have to think about it.
The whole thing fits on one side of a sheet of paper and takes about an hour to build. Two or three times a year, you spend five minutes updating it.
Why one page beats a long playbook
A thirty-page security document will not be read at midnight with your heart rate up. A single page will, because there's nothing to search through. Committing to one page also forces the hard editorial decision: what actually matters?
The real value is in the decisions you make in advance. "I should probably change my passwords" is not a decision. "Log into email from my partner's laptop, never from any device I don't recognise" is. Write the second kind.
Step 1: List the accounts that can actually hurt you
Write down names, not passwords. Aim for five to eight entries, ranked by how much damage a lockout would cause.
- Your primary email. Everything else resets through it, which makes it the crown jewel.
- Banking, cards and payment apps. Money leaves fast and is slow to come back.
- Your mobile carrier account. Whoever controls your number can intercept your text codes.
- Your password manager and the email address tied to it.
- Cloud storage holding documents, photos or client work.
- Work accounts if your employer's data sits behind your login.
- Anything tied to your name publicly — social profiles a scammer could use to message your contacts.
If an account doesn't fit on that list, leave it off. This page is a triage tool, not an inventory of your digital life.
Step 2: Fill in the routes back in
Now add the information that actually gets you unstuck. Two categories: people and paths.
Contacts
For each account, note the fastest route to a human. Your bank's fraud line is usually printed on the back of your card — copy that number down. Your carrier has a dedicated account-security number. Your employer has an IT or security contact. And name one or two people who can hand you a clean phone and laptop at short notice; a partner, a parent, a neighbour you trust. Two names is better than one, because the first person may be travelling or asleep.
Recovery paths, not secrets
The sheet should map where things are, never what they are. Write "recovery codes: sealed envelope in the filing cabinet, second copy with my brother" — not the codes themselves. Include the recovery email address and phone number on file for your main accounts, and where your password manager's emergency kit lives. If the page fell out of your bag at a café, it should help you and be close to useless to a stranger.
Step 3: Script the first ten minutes
Write these steps in the order you'd genuinely follow them. Ours, which you should adapt:
- Get to a clean device. Borrow one. Do not click links in the alert emails, and do not log in from a device you don't trust.
- Freeze the money. Call the bank or card issuer and your carrier if your phone number may be involved. A frozen card is an inconvenience; an emptied account is not.
- Take back the email. Whoever holds your inbox can reset everything else, so reset that password first, then work outward through the list.
- Turn on two-factor authentication using an authenticator app rather than text messages where the option exists.
- Kick the attacker out. Sign out all other sessions, revoke connected apps and tokens, and check for new forwarding rules, changed recovery addresses and altered backup phone numbers.
- Tell your two named people. They can watch for messages sent in your name while you work.
If the plan doesn't fit on one page, it isn't finished — it's just longer.
Step 4: Decide what evidence to gather
Banks, platforms and, in some cases, police or insurers will ask for details you won't remember a week later. Collect them as you go.
Keep ready beforehand
Store a recent statement from your main account, the last four digits of relevant cards, and a copy of your ID somewhere you can reach without your phone. Take a screenshot of the "devices signed in" page for your two most important accounts so you have a baseline of what normal looks like.
Capture during the incident
- The exact time you first noticed something was wrong.
- Screenshots of every odd email or message, including the sender's full address where you can see it.
- Confirmation numbers, transaction IDs and the names of anyone you spoke to.
- Any device, location or login time you don't recognise.
- A short running note of what you changed and when.
Keep this in one folder or envelope, separate from the plan itself. If identity theft or business liability is involved, it's worth speaking to a lawyer, and your country's consumer protection body may have a reporting route — that's beyond what a one-page plan can cover.
Step 5: Store it offline and rehearse it
Print two copies. One goes in a drawer at home, one with the person named on it. A plan that lives only in the cloud account you're trying to recover is not a plan.
Then run a two-minute drill every few months: without touching your phone, can you find the paper, name your bank's fraud number, and say where your recovery codes are? Every time you change banks, phones or jobs, spend five minutes updating the sheet. Stale phone numbers are worse than none, because they cost you time you don't have.
The five-minute version
If you do nothing else today, take an index card and write: your primary email address, your bank's fraud line, your carrier's security number, two trusted names, and one line saying where your recovery codes are kept. Sign and date it, then put it somewhere you'd actually look.
That card covers most of the damage in most account takeovers. Build the full page when you have an hour — and keep it short enough that you'd still read it at 11:40 on a Tuesday.
Photo: 3844328 / Pixabay
