Reporting: the FBI, CISA and your state

Reporting is not paperwork for its own sake. A fast report can help freeze stolen money, warns other institutions about the same attack, and connects you with free help.

This lesson gives you the places to report and what to have ready. Write the contacts down today, on the first-hour card from Lesson 7.

Fraud and money: your bank, then the FBI

If money left your accounts, the order is:

1. Your bank, by phone, right away. Ask it to recall the funds.
2. The FBI's Internet Crime Complaint Center at ic3.gov. IC3 asks for a complaint regardless of the amount lost, and its Recovery Asset Team works with banks to try to freeze funds.

For an attack in progress or a serious threat, you can also call your local FBI field office. Find yours at fbi.gov/contact-us/field-offices.

Cyber incidents: CISA

The Cybersecurity and Infrastructure Security Agency takes incident reports from organizations of every size, including state, local, tribal and territorial governments:

• Online: cisa.gov/report
• By phone: CISA Central, 1-844-SAY-CISA (1-844-729-2472)
• By email: central@cisa.dhs.gov for significant incidents

CISA shares what it learns with other defenders, and it can point you to no-cost services for public institutions.

Your state

Many states have their own place for local governments to report cyber incidents: a state cybersecurity office, the state's chief information officer, a fusion center or the state police. Some states require local agencies to report certain incidents.

The rules differ by state, so find yours now. Good places to ask: your state's office of the chief information officer, your state municipal league or association of counties, or your risk pool.

Your attorney, your insurer and the public

Data breach laws. Every state has a data breach notification law. If personal information about residents or staff may have been exposed, your institution may have to notify people within a set time. Whether a law applies is a decision for your attorney or counsel, so tell them early.

Insurance. If you have cyber insurance or belong to a risk pool, report to them as your policy requires. Many policies set deadlines and expect you to use their response team.

Public statements go through the person your institution designates. A short, accurate statement beats a fast, wrong one.

What to have ready

Every report goes faster with:

• the date and time you noticed, and what you saw,
• the log you started in the first hour,
• photos of screens, and the suspicious emails left in place,
• for payments: amounts, dates, and the account and bank the money went to,
• the names and numbers of who you have already called.

Phishing you did not fall for

A phishing email that you spotted still deserves a report. Use your email's "report phishing" button if your institution set one up, or forward it to your IT contact as they prefer. It helps them block it for everyone else.