Quick reference · Incident Response Runbooks

Incident Response Card

Fill in your own fraud lines once, then print or save the card — three steps and four numbers, ready before you need them under pressure.
Why this exists: the Recommendations Report describes a "15-minute runbook... taped somewhere" as more useful mid-incident than a document you have to search through. This builds that card from your own numbers instead of leaving it as a paragraph to act on later.
📖 Read the full runbooks in the Playbook →📋 Digital Legacy Worksheet →
Your fraud & support lines
Runbook C in the Playbook covers what to do the moment a SIM swap is suspected.
First 15 minutes (from Runbook A)
  1. 1Change the password on the affected account from a known-clean device. If it's email, do this first — email is the recovery path for everything else.
  2. 2Revoke all active sessions/devices on the account.
  3. 3Check recovery email/phone for tampering before doing anything else.
Completeness
0/4
numbers filled in
Get the card
Companion tool

Who calls on your behalf if you can't is a different question — see the Digital Legacy Worksheet.

Digital Legacy Worksheet →
History

Save a dated checkpoint to compare completeness over time.