Chapter 6 of 6 / it already went wrong

I typed my password on a copy

The common one, and the one where the first ten minutes matter most. Work through this in order rather than doing the thing that feels most urgent, because the thing that feels most urgent is third on the list.

Right now, in order

1. Get in through an address you have checked yourself. Not the one you were just on, and not one from the same place you got it.
2. Change the password to something used nowhere else, and change it anywhere else the same one was used.
3. Reset the second factor and save the new recovery material before you close the page.
4. Read the message log. Before the balance. See below for why.
5. Then look at the balance and move anything sitting there out.

Why the message log comes before the balance

A taken account is worth more as a way to talk to people who already trust it than as a balance to empty. The most productive use of one is a plausible request sent to its contacts, which is why so many requests to pay outside escrow arrive from accounts with genuine history. Reading the log tells you whether that has already started.

What a copy collected

• The password, in the clear, because you typed it into their field.
• The code, if you supplied one, replayed against the real site inside the window it is valid for.
• The session, in versions that pass your input through so the login appears to work, which removes the only symptom you had.
• Everything visible inside, if the session ran, including your message history and your order list.

What is not worth doing

1. Do not try to work out which page it was. It changes nothing about what you do next.
2. Do not warn people by posting the fake address publicly. It gets traffic either way and you have marked yourself as somebody in trouble.
3. Do not answer a message offering to help you recover. Arriving now is not a coincidence.
4. Do not skip changing the password elsewhere. Reuse is what turns one bad evening into several.

Afterwards

Work out which channel put the address in front of you, because that is the part that repeats. Almost always it arrived somewhere that cannot prove anything about itself, and almost always it was believed because of where it was found rather than because of anything it demonstrated. Fixing the source is worth more than tightening anything else.