If your account was taken over: a timeline and an evidence list to make before you consult the police
What to keep before a police consultation after an account takeover. Copy-ready timeline and evidence-list templates. In Japan: how a victim report, a consultation, and the online desk differ.
De artikeltekst is niet beschikbaar in deze taal; de Engelse versie wordt getoond.
This article is not legal advice. It does not promise recovery or freezing of funds, accounts, or data, or identification of the other party. It is not a substitute for the police, a financial institution, a card company, or the company that operates the service. Do not paste government ID, face photos, PINs, passwords, seed phrases, private keys, or API keys into any AI tool. Mithril will not help you enter someone else's account or system without permission, or take their credentials.
In Japan: Parts that include text from the National Police Agency (Japan) are summarized and rearranged by the editors (created by editing and processing). Sources: the National Police Agency (Japan) website "[Countermeasures against unauthorized access](https://www.npa.go.jp/bureau/cyber/countermeasures/unauthorized-access.html)" and "[Consultation desks for cyber incidents](https://www.npa.go.jp/bureau/cyber/soudan.html)" (both checked 2026-10-02). Terms of use follow the guidance the National Police Agency (Japan) sets out in line with the Public Data License (Version 1.0) (PDL1.0) ([Terms of use](https://www.npa.go.jp/rules/index.html), checked 2026-10-02). The processed text is not presented as if the National Police Agency (Japan) created it.
In Japan: The Tokyo Metropolitan Police Department pages are summarized as guidance for Tokyo. They are not a full reprint. This article has not checked whether other prefectures operate the same way. Check with the prefectural police where you live.
## What to finish after reading
Fill 1 timeline and 1 evidence list with only the rows you know today. In Japan: call a police station or a cybercrime consultation desk, and say when, on which service, what happened, and that you will bring these 2 sheets. The shape of the tables is the editors' suggestion. In Japan: the National Police Agency (Japan) pages guide you as far as the order of contact, saving and printing the login screen, and keeping a record of the correspondence. They do not set out the columns of a table to bring (those pages were checked on 2026-10-02).
## What to do first
In Japan: The National Police Agency (Japan) page "Countermeasures against unauthorized access" gives the following order for harm from unauthorized access (checked 2026-10-02. The following is the editors' summary).
1. Promptly contact and consult the company that provides the internet service.
2. If you registered credit-card information with that service, promptly contact the credit-card company. If you use internet banking, check whether there was an unauthorized transfer, and if there was, promptly contact the financial institution.
3. Change the password. If an attacker changed it and you cannot log in, contact the company that provides the service. If you can log in, change the password immediately. If you use the same password on other services, change those immediately as well.
4. If you can check the login history, save and print the login screen and preserve the evidence. Save and record emails and other correspondence so that the course of contact with the company is clear.
5. In Japan: take the saved login history and similar materials to the nearest police station or a cybercrime consultation desk and make a report or consult. It says that calling ahead to arrange, with the person in charge, the date and time and the materials you will bring makes the response proceed more smoothly.
Reading the page's order to mean that, when money may have moved, you do not put the calls to the card company and the financial institution after the password change, is the editors' reading along the sequence on the page. In Japan: it is not the National Police Agency (Japan)'s own wording. This article is limited to what to keep after you notice the harm, and to how the desks differ.
## What to keep before you delete anything
In Japan: the National Police Agency (Japan) guides you to save and print the login-history screen, and to save and record correspondence with the operating company. As the editors' suggestion, before you save those, do not delete history, notifications, or posts, and do not factory-reset the device. In Japan: the National Police Agency (Japan) page does not say "do not delete." It says save and print.
Examples of what to keep. The numbers match the E-001 format in the evidence list below. In Japan: which of these are required is not written on the National Police Agency (Japan) page, so this is the editors' suggestion.
- Login history. The whole screen, in a form that shows the date and time and which screen of which service. In Japan: in the National Police Agency (Japan)'s words: save and print the login screen.
- Notification emails, and notices that settings changed. So that the subject, the sender, and the date and time received are on the screen.
- Correspondence with the operating company. The reference number and the reply email.
- Posts or messages you did not send. Left as they appeared to the other person.
- Money and payment history. A statement PDF, or the whole screen. If you were given a reference number by the bank or the card company, write it on the same row.
When a URL appears in the address bar, keeping the address bar together with the screen makes it easier to explain later which screen it was. This is also the editors' suggestion.
This article does not copy each service's recovery steps. In Japan: the National Police Agency (Japan) page lists links to the help centers for Facebook, Instagram, LINE, TikTok, and X. The ones confirmed to open on 2026-10-04 are the [Facebook Help Center](https://www.facebook.com/help/), the [Instagram Help Center](https://help.instagram.com/), the [LINE Help Center](https://help.line.me/), and [TikTok login and troubleshooting](https://support.tiktok.com/en/log-in-troubleshoot). In Japan: the URL the National Police Agency (Japan) page shows as the X help center returned HTTP 403 when retrieved on 2026-10-02, so the body could not be checked, and this article does not repeat that URL. In Japan: follow it from the National Police Agency (Japan) page. Follow each company's own page for the steps.
### When your phone number suddenly stops receiving calls and messages
If SMS stops arriving, the phone stays out of service, or a notice arrives that the SIM or eSIM was changed, record that on the evidence list with the date. Asking the carrier about the situation is itself the editors' suggestion. In Japan: what written documents a Japanese carrier issues, and what procedure follows, had not been confirmed at the time this article was written. This article does not write a form, or "do this and it comes back." Check with your carrier and, if needed, with the police where you live. In Japan: that is the prefectural police where you live.
## Evidence list (copy and use)
Select the box below, copy it, and paste it into a spreadsheet or a document. 1 row is 1 piece of evidence. The first 1 row is a fictional filled example. It is not a real person, account, or file. Leave cells you do not know blank. Do not fill them by guessing.
```text
Evidence number What the evidence is Saved at (JST) From where (service name / screen) File name Where the original is kept Notes
E-001 (filled example, fictional) Login-history screen 2026-10-02 09:15 (fictional) Example Mail login history E-001-login.png "Incident notes" folder on my own PC Whole screen. The URL and the date and time are visible
E-002
```
The meaning of the columns is the editors' suggestion. Number the evidence in sequence from E-001. Saved at is the date and time you saved the screen (Japan time). When the date and time of the event shown on the screen differs from the date and time you saved it, write both in Notes. "From where" is the service name and the screen name. For the original, write a place that will not disappear (something you exported, a printout). In Japan: the National Police Agency (Japan) guides you to save and print, and does not go as far as specifying a storage place. The suggestion is that it is easier to explain if you avoid leaving the files only inside the account, in a state where that account itself can no longer be opened.
## Timeline (copy and use)
1 row is 1 event. Write the evidence-list number on the matching row. After 3 fictional rows, 1 blank row is attached. This is not a real case of harm.
```text
Date and time (JST) Service Event Evidence number What I did Contact and reference number
2026-10-01 22:40 (filled example, fictional) Example Mail A login notice I do not recognize E-001 Saved the screen. Have not changed the password yet
2026-10-02 08:05 (filled example, fictional) Example Mail Could not log in; the password had been changed E-003 Contacted the operating company's help Reference number (fictional) EX-0000
2026-10-02 08:20 (filled example, fictional) Example Bank A notice of a transfer I do not recognize E-004 Called the bank Reference number (fictional) BK-0000
```
A guide for the order to arrange the rows is the editors' suggestion. The first anomaly, confirmation of an unauthorized login, a change of settings or password, the harm (a post, a transfer, a purchase), then what you did, in that order, makes the explanation easier to follow. Leave a row blank when you do not know the time. Do not fill it with "probably this time."
## In Japan: which desk to take what to
In Japan: From here on is what could be read on pages opened on 2026-10-02. Roles that are not on the pages are not written here.
In Japan: A summary of the National Police Agency (Japan) "Consultation desks for cyber incidents." It says that if you file a victim report, contact the nearest police station or similar. The online intake is a nationwide unified desk for reports, consultations, and information. A report is one accompanied by notice of a concrete fact that you were harmed. A consultation is one that asks for advice. Information provision is providing information about a cyber incident. When you select the police headquarters of the prefecture where you live, or the police station with jurisdiction, the notice goes to the place you selected. For general technical consultations on information security: the Information-technology Promotion Agency, Japan (IPA) Information Security Safety Consultation Desk, telephone 03-5978-7509. For consultations on goods, services, and consumer life in general: a consumer affairs center or 188 (Consumer Hotline). Cases involving human life, such as a bomb threat, a murder threat, or a suicide threat, go to the nearest police station. For what is urgent, call 110, it says.
In Japan: The Tokyo Metropolitan Police Department "[Desks for reports, consultations, and information on cyber incidents](https://www.keishicho.metro.tokyo.lg.jp/kurashi/cyber/cyber_sodan.html)" is guidance for Tokyo. The page's update date is given as September 24, 2026, and the full text was checked on 2026-10-02. It is written that even if you enter the circumstances of the harm and similar details at the online intake desk and submit them, that cannot be accepted as a victim report. It says a victim report is something you consult about at the police station with jurisdiction over the place where you live (for a corporation, its location). The telephone consultation on cybercrime for people who live in Tokyo and for corporations located in Tokyo is 03-5805-1731, weekdays from 8:30 to 17:15. It is written that a victim report cannot be filed at this telephone consultation desk. For threats to kill, threats of a crime, stalking, violence from a spouse or similar person, posts that hint at suicide, and other crises of life or body, do not use the online desk; call 110, it says. People who live in other prefectures are directed to the National Police Agency (Japan) "[List of prefectural police cybercrime consultation desks and related contacts](https://www.npa.go.jp/bureau/cyber/ichiran.html)" (it was confirmed on 2026-10-02 that the page opens. The contents of each prefecture's intake have not been checked).
In Japan: #9110 was not found, within what this article checked, on the 2 National Police Agency (Japan) pages above. The Japan Virtual and Crypto assets Exchange Association (JVCEA) page "[For people who have been harmed](https://jvcea.or.jp/safetylife/victim001/)" lists #9110 (nationwide) as the dedicated police consultation telephone, and the table says weekdays from 8:30 to 17:15, and that this differs by each prefectural police headquarters (checked 2026-10-02. This is a summary). The consultation contact the National Police Agency (Japan) names for account takeover is the nearest police station or a cybercrime consultation desk. When you use #9110, check the hours for the prefecture where you live, as the JVCEA table says.
In Japan:
| Desk | What this article confirmed | Source |
| --- | --- | --- |
| Victim report | The National Police Agency (Japan) guides you to contact the nearest police station or similar. The Tokyo Metropolitan Police Department guides you that an online submission is not accepted as a victim report, and that you consult the police station with jurisdiction over the place where you live (for a corporation, its location) (Tokyo) | National Police Agency (Japan) consultation-desk page / Tokyo Metropolitan Police Department |
| Cybercrime consultation | Take the saved login history and similar materials to a police station or a cybercrime consultation desk. Arrange the date and time and the materials to bring by calling ahead | National Police Agency (Japan) "Countermeasures against unauthorized access" |
| Online desk | Reports, consultations, and information. Not guided as the place to file a victim report | National Police Agency (Japan). The explicit statement that it is not accepted as a victim report is the Tokyo Metropolitan Police Department (Tokyo) |
| 03-5805-1731 | Tokyo Metropolitan Police Department cybercrime telephone consultation. Weekdays 8:30–17:15. The Tokyo Metropolitan Police Department states that a victim report cannot be filed (Tokyo) | Tokyo Metropolitan Police Department |
| #9110 | JVCEA lists it as a nationwide dedicated police consultation telephone. A note says the hours differ by prefecture | JVCEA |
| 188 | As a contact for consumer-life consultations in general, a consumer affairs center or 188 | National Police Agency (Japan) |
| 03-5978-7509 | General technical consultation on information security (IPA) | National Police Agency (Japan) |
| Operating company | The first place to contact. A password change when you cannot log in also goes here | National Police Agency (Japan) |
| Financial institution / card company | If a card is registered, to the card company. If there is an unauthorized transfer, to the financial institution | National Police Agency (Japan) |
## What to say when you call ahead
In Japan: the National Police Agency (Japan) writes that you call ahead and arrange, with the person in charge, the date and time and the materials you will bring. It does not write the wording to say. The next box is the editors' suggestion. Copy it, fill only the parts you know, and then call.
```text
When: (the date and time you know. If unknown, "unknown")
Which service:
What happened: (cannot log in / a transfer I do not recognize / a post that is not mine, and similar)
Materials to bring: evidence list, timeline, saved screens or printouts
Reference numbers already received:
```
## What not to do
Replying to a stranger and negotiating, sending additional money, and telling another person a password or an authentication code are the editors' caution. In Japan: as guidance limited to the crypto-asset context, JVCEA writes that you do not reply or negotiate, that you keep a record and tell the police or a consultation desk, and that an additional demand claiming recovery or a refund may be a second harm, and that you check with an official consultation desk before a new payment or contract ([For people who have been harmed](https://jvcea.or.jp/safetylife/victim001/), checked 2026-10-02. This is a summary). The editors place the same caution on account takeover: do not hand over additional money or an authentication code on the instructions of a stranger.
Entering the other person's account, device, or system without permission in order to look back into them can be illegal. This article does not explain what is allowed. Consult the police or a lawyer. In Japan: the National Police Agency (Japan) "Countermeasures against unauthorized access" posts a link to e-Gov as a reference for the related law ([the relevant e-Gov page](https://elaws.e-gov.go.jp/document?lawid=411AC0000000128) is listed on the National Police Agency (Japan) page as of 2026-10-02). Mithril will not help with access, without permission, to someone else's account or system.
## When the desk says it is difficult
How a consultation proceeds, and whether a victim report is accepted, is decided by the police case by case. This article does not promise an outcome. On the spot, as the editors' suggestion, ask the following and write it down. What materials are missing. Whether a record of today's consultation, or a reference number, will remain. Which desk to go to next. In Japan: a police station, a cybercrime consultation, or an online report.
## Frequently asked questions
**Q. When your account has been taken over, what should you prepare before you consult the police?**
In Japan: for harm from unauthorized access, the National Police Agency (Japan) guides you to contact the company that provides the service first, to contact the card company or the financial institution if a credit card or a bank account is involved, to save and print the login-history screen, and to record correspondence with the operating company as well. You then call the nearest police station or a cybercrime consultation desk ahead of time and arrange the date and time and the materials to bring (source: National Police Agency (Japan) "Countermeasures against unauthorized access", checked 2026-10-02. The wording is the editors' summary). Putting these into a timeline in date order, and into a numbered evidence list, makes the explanation easier to organize (this is the editors' suggestion).
**Q. Can a victim report be filed at the online desk for cyber incidents?**
In Japan: Under the Tokyo Metropolitan Police Department's guidance, it cannot. Even if you write the circumstances of the harm at the online intake desk and submit them, that is not accepted as a victim report, and a victim report is something you consult about at the police station with jurisdiction over the place where you live (for a corporation, its location) (guidance for Tokyo. Source: Tokyo Metropolitan Police Department; the page's update date is September 24, 2026; the full text was checked on 2026-10-02). The National Police Agency (Japan) also guides you, if you file a victim report, to contact the nearest police station or similar (source: National Police Agency (Japan) "Consultation desks for cyber incidents", checked 2026-10-02). This article has not checked whether the relationship between the online desk and a victim report is the same in other prefectures. Check with each prefectural police force.
## What to do today
Copy the evidence list and the timeline above, and fill only the rows you know today. Leave blanks blank. Do not write the other person's name or address by guessing when they are not on the screen. The filled examples are fictional.
This page is for finishing, inside the page itself, the draft you will bring. In the same series there is a "[remittance table](https://blog.mithril.fund/crypto-fraud-remittance-table)" for crypto-asset and investment fraud, and an English "[worksheet](https://blog.mithril.fund/ic3-complaint-worksheet)" for before you file with IC3 in the United States. This worksheet is for the United States FBI Internet Crime Complaint Center (IC3), for people who are victims with a US nexus or who choose to file there. It is not a general requirement for every victim worldwide.
[Trust Center](https://mithril.fund/trust/), [Terms of use](https://mithril.fund/legal/terms/), and [Privacy](https://mithril.fund/legal/privacy/) were confirmed to open on 2026-10-02. None of them is legal advice.