The first hour after a household incident

When a device is lost, an account is suspected to be compromised or an unusual payment request arrives, the first hour should reduce decisions, not add them. Contact the named incident lead, preserve the message and relevant logs, pause sensitive transactions and use a known channel to confirm what happened. Do not immediately wipe the device or continue the conversation with the requester; both can destroy evidence. A short written record of time, people and actions gives advisers something reliable to work from while the facts are still changing.