What should I do if my money has been stolen from an e-banking system?

Unfortunately victims discover they’ve been robbed only after the fact. At this point, the way victims respond to the incident becomes extremely important. Before you follow our recommendations, make sure that the theft occurred as a direct result of a virus. For this purpose, it's enough to briefly interview the employees who have access to the e-banking system. If you or they did not perform an operation that you consider suspicious, a virus or an attacker is likely involved.

Your actions must be swift and decisive:

1. Immediately contact your bank; it may still be possible to cancel the transaction. Even if the payment has already been transferred, request that the bank block all transactions within the compromised account before issuing you new access authentication credentials (login and password, etoken, etc.).
2. Notify your bank (the one that sent the payment) by fax. Print out the request in TRIPLICATE, and submit all three copies to the bank. Ask for the registration numbers to be included on two of the copies: one will remain with you, and the other will be attached to your statement for the police. Your application should contain the date and serial reference number of the document accepted by the secretary.
3. Fax a notification to the beneficiary, the bank that received the funds from your account. Similarly, make THREE copies and register them.
4. Submit a statement to the police and attach the notifications to the two banks to it (recipient and sender of the payment). To do this, visit the nearest police department.

   Caution!

   We strongly recommend that you go to the police. A criminal offence has been committed against you. Law enforcement authorities need your formal complaint (i.e., a legal reason) to initiate a criminal case against the intruders.

   Be prepared to have your computer temporarily removed for examination.

   If your request for assistance is refused, obtain a written waiver and forward your complaint to a higher police authority—the chief of police in your place of residence.

   Confirmation that an incident of theft has occurred is sufficient grounds for a criminal investigation.

5. Notify your provider in writing, asking them to provide logs of network connections for the period when the theft occurred.

   Caution!

   ISPs keep logs of network connections for no longer than two days, so you don’t have much time!

All of the above must be completed within 1-2 days after the theft has been discovered!