Dealing with a compromised device
Having a compromised device can be deeply unsettling. You may feel vulnerable knowing that someone could be accessing your personal information, reading your messages, monitoring your activities, or even accessing your camera or microphone. Whether the compromise is caused by malware, a cybercriminal, or someone known to you, you have the right to feel safe and in control of your own devices.
This guide will help you recognise the signs of a compromised device and take practical steps to regain control.
In South Africa, unauthorised access to a device, unlawful interference with data or computer systems, malware-related offences, cyber extortion and certain other cyber offences may constitute offences under the Cybercrimes Act 19 of 2020, as well as other applicable legislation depending on the circumstances.
This information is general guidance and is not legal advice.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
Important safety information for stalking, domestic abuse and coercive control
If you believe someone known to you may be monitoring or controlling your device or accounts, consider your immediate safety before changing passwords, signing out other sessions, disconnecting the device, removing applications or making other security changes.
Some changes can alert the person who is monitoring you or cause their behaviour to escalate.
If you are experiencing stalking, domestic abuse or coercive control:
Prioritise your immediate physical safety.
Do not treat password changes, blocking, disconnection or other security actions as mandatory where they could increase your risk.
Consider using a safer device or seeking specialist support where appropriate.
Use appropriate South African emergency pathways where immediate danger or other urgent safeguarding concerns exist.
Do not carry out intrusive technical checks or investigation if doing so could increase your risk.
What “compromised” means
A compromised device is a phone, tablet or computer that is being accessed or controlled without your permission.
This can happen when:
Malware has been installed on your device.
A virus or spyware is stealing your information.
Someone can remotely control your screen, camera or microphone.
A keylogger is recording everything you type, including passwords.
Someone has gained unauthorised access to your device or accounts.
Compromised devices are commonly used for:
Financial fraud.
Identity theft.
Cyberstalking.
Harassment.
Blackmail or extortion.
Collecting personal information.
How do I know if my device is compromised?
These are signs that may indicate your device has been compromised. If you notice multiple signs together, take action immediately.
| Possible sign | What it may mean |
|---|---|
| You see apps or programs you don't remember installing | Someone or something added them. |
| Pop-ups, adverts, or messages appear that are not expected | Could be fake alerts or scams. |
| Webpages or searches look different than usual | Your settings might have been changed. |
| You get login alerts for accounts you didn't access | Someone else could be signing in. |
| Your camera or microphone light comes on unexpectedly | Possible spying software. |
| You get ransom messages or can't open your files | Possible ransomware. |
| Your friends receive strange messages from you | Your device or account might be used to spread scams. |
Simple steps to check your device
Look for unfamiliar applications
Review the list of installed applications or programs.
Before removing anything suspicious, consider preserving evidence such as screenshots, application names and relevant messages if you believe a crime has occurred.
Do not automatically delete or remove software simply because you do not recognise it. Legitimate software may be unfamiliar, and removing software may also affect evidence.
If you are unsure whether an application is legitimate, seek assistance from a trusted IT professional rather than deleting it immediately.
Check for updates
Update:
Your operating system.
Applications.
Web browser.
Security software.
Security updates often fix vulnerabilities that cybercriminals exploit.
Run a full virus scan
Use reputable antivirus or anti-malware software to perform a full system scan.
Follow the software's instructions to quarantine or remove any threats that are detected.
If criminal activity or a serious compromise is suspected, consider preserving relevant evidence before taking actions that could alter the device or remove information, where this can be done safely.
Restart your device
Restarting your device can stop some malicious processes and allows important security updates to be applied.
Where a crime may have occurred, consider preserving relevant evidence before restarting or otherwise changing the device state, where this can be done safely and practically. Immediate safety takes priority.
Check your accounts
Check important accounts, including:
Email.
Banking.
Social media.
Cloud storage.
Look for:
Unrecognised login alerts.
New devices.
Active sessions.
Security changes.
Sign out of any devices or sessions you do not recognise only where it is safe to do so.
Enable Multi-Factor Authentication (MFA) wherever available.
If stalking, domestic abuse or coercive control is suspected, consider whether changing account settings or signing out sessions could alert or escalate the perpetrator before taking these actions.
What to do if you believe your device is compromised
Consider your immediate safety first
Before disconnecting the device, changing passwords, signing out sessions, removing applications or taking other security actions, consider whether someone known to you may be monitoring the device.
This is particularly important where stalking, domestic abuse or coercive control is involved.
If taking a security action could alert the perpetrator or increase your risk:
Do not treat the action as mandatory.
Prioritise your immediate safety.
Consider using a safer device where appropriate.
Seek appropriate specialist or safeguarding support.
Follow the approved Cyber Helpline safeguarding and escalation pathway.
If you are in immediate physical danger, prioritise emergency assistance over device recovery.
Disconnect from the internet
If it is safe and practical to do so:
Turn off Wi-Fi.
Disable mobile data.
Disconnect any network cables.
This may help prevent further unauthorised access.
Disconnection is particularly relevant where malware, remote-access software or other ongoing device compromise is suspected.
Disconnecting does not guarantee that a compromise has been contained.
If the device is your only way to contact emergency services, access money, communicate with trusted people or leave an unsafe situation, prioritise your immediate safety before disconnecting it.
Preserve important evidence
Before resetting, replacing or significantly changing the device, preserve evidence where practical and safe.
This may include:
Screenshots.
Emails.
Messages.
Ransom notes.
Suspicious application names.
Login alerts.
Bank notifications.
Relevant URLs.
Usernames or account details.
Transaction records.
Do not destroy evidence intentionally.
Evidence preservation must not require you to remain in contact with a perpetrator, remain exposed to harmful content or delay an urgent safety measure.
Back up important files
Create secure backups of important:
Documents.
Photographs.
Contacts.
Other personal files.
Use a trusted cloud service or an external storage device that you know is safe.
If you suspect the device contains malware, avoid transferring suspicious files to another device.
Run another full virus scan
Follow the instructions to remove or “quarantine” anything suspicious.
Change your passwords
Using a different trusted device where possible, change the passwords for your important accounts, including:
Email.
Banking.
Social media.
Cloud storage.
Online shopping.
Work accounts.
Use strong, unique passwords for every account.
Secure your email account first where possible, as access to email may allow someone to reset passwords for other accounts.
Enable MFA wherever available.
Ask for expert help
If the problem keeps returning, don’t try to fix it alone, contact The Cyber Helpline or a local trusted IT professional.
Report the crime
Report the incident to the South African Police Service (SAPS) if:
Money has been stolen.
Your identity has been misused.
Someone is stalking, monitoring or threatening you.
The compromise forms part of domestic abuse or harassment.
Malware, ransomware or extortion is involved.
You can report a crime by contacting your nearest police station.
For immediate police emergencies, call 10111.
For emergencies generally from a mobile phone, dial 112.
When reporting the incident, ask for a case/CAS number, where one is issued.
Keep copies of:
Screenshots.
Emails.
Messages.
Bank notifications.
Ransom notes.
Any other relevant evidence.
If appropriate, SAPS may refer the matter to a specialist cybercrime investigation unit.
If financial fraud has occurred
If your banking information or money has been compromised:
Contact your bank immediately using the official contact details provided in your banking app, on your bank card or on the bank's official website.
Ask the bank to:
Block affected cards if necessary.
Secure your banking profile.
Remove unknown devices or sessions.
Investigate unauthorised transactions.
Provide a reference number.
Keep the bank's reference number and records of your communications.
If you remain dissatisfied after completing your bank's complaints process, you may be able to escalate a complaint about the financial service provider to the National Financial Ombud Scheme South Africa (NFO).
The NFO is a complaints and dispute-resolution route concerning participating financial service providers. It is not a substitute for immediately contacting the bank about suspected fraud or reporting suspected criminal activity to SAPS.
How to prevent device compromise from happening
Taking these preventative steps will significantly reduce your risk of device compromise:
Keep your software updated
Enable automatic updates for your operating system, apps, and security software
Install updates promptly - they often fix security holes that attackers exploit
Remove old, unused apps that are no longer supported with security updates
Use strong password practices
Create strong, unique passwords for every account - at least 12 characters with a mix of letters, numbers, and symbols
Never reuse passwords between accounts - if one account is compromised, all accounts with the same password are at risk
Use a password manager to securely store and generate strong passwords
Never share your passwords with anyone or write them down where others can find them
Enable Multi-Factor Authentication (MFA)
Turn on MFA for all important accounts, especially email, banking, and social media
Use an authenticator app (like Google Authenticator or Microsoft Authenticator) rather than SMS when possible, as it's more secure
Be cautious online
Don't click suspicious links or download unexpected email attachments, even if they appear to be from someone you know
Verify before you trust - if you receive an unexpected message asking you to click a link or download something, contact the person directly through another method to verify
Be wary of public Wi-Fi - avoid accessing sensitive accounts or entering passwords on public networks. Use a VPN if you must use public Wi-Fi.
Only install apps from official stores - use Google Play, Apple App Store, or Microsoft Store. Avoid downloading apps from websites or third-party stores.ç
Protect physical access to your devices
Use a strong PIN, password, or biometric lock on all devices
Never leave devices unattended and unlocked in public places or around people you don't fully trust
Be cautious about who you give your device to, even temporarily
Turn off your device or lock it if you need to leave it somewhere
Review your security settings regularly
Check your installed apps monthly and remove anything you don't recognize or no longer use
Review account login activity on your email and social media to spot unauthorized access
Check device permissions and remove unnecessary access to your camera, microphone, location, and files
Review your social media privacy settings to limit what information is publicly visible
Back up your data regularly
Make regular backups of important files, photos, and documents
Store backups securely in the cloud or on an external drive kept separate from your device
Test your backups occasionally to ensure they work
This ensures you can recover if you need to perform a factory reset
Be careful what you share online
Limit personal information on social media - avoid posting your address, phone number, daily routines, or real-time location
Turn off location tagging on photos and posts
Be selective about friend requests - only connect with people you know in real life
Review what others post about you and ask them to remove sensitive information if needed
Get additional support
If you need more help or have concerns about your situation:
Contact The Cyber Helpline - If you've followed this guide and still have issues, get back in touch with us through our chatbot or helpline for further support.
Seek professional IT help - If you're not confident following these steps or the problem persists, ask a trusted IT professional or tech-savvy friend for help. Many local computer repair shops can assist with removing malware.
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.