Account Takeover Recovery for Sydney Individuals: Get Your Hijacked Email, Social, and Banking Logins Back After a Phishing Scam
You clicked a link in a text that looked like it was from Australia Post, or a “security alert” that looked like it was from your bank, and you typed your password into a page that was not really theirs. Within hours your email is forwarding to someone you do not know, your Instagram is posting crypto ads, your bank app is asking you to re-verify a device that is not yours, and you are watching your accounts fall over one by one because most of them recover through the email account that is no longer really yours. Account Takeover Recovery from Cyber by Exegesis is the fixed-scope engagement designed to walk a Sydney individual through getting control back — in the right order, without making it worse.
The problem
ACCC Scamwatch reports phishing as one of the most-reported scam categories in Australia, and the mechanics that follow a successful phish are predictable. The attacker logs into your email first, because email is the recovery channel for almost every other account you own. They add a forwarding rule or a filter so password-reset emails skip your inbox. They reset your social media, your retail accounts, and — if they have enough — they pivot to your banking and BNPL accounts. By the time you notice, recovery is no longer a single conversation with one provider; it is a sequenced reset across a chain of accounts, with each provider’s own identity-verification process to navigate.
The ACSC guidance for individuals and families is clear that the first move matters: secure the email account before anything downstream. Most people do the opposite — they panic-reset Instagram first, while the attacker still owns the inbox the reset email lands in.
What Account Takeover Recovery does
Cyber by Exegesis runs a fixed-scope recovery engagement for the individual whose accounts have been taken over after a phishing scam:
- A triage call to map which accounts are confirmed compromised, which are suspected, and which are still clean — and in what order they need to be addressed.
- Coordinated recovery with the affected provider (Google, Microsoft, Meta, your bank’s fraud line, retail accounts), following each provider’s documented account-recovery process.
- A sweep of the recovered email account for attacker persistence — forwarding rules, filters, connected apps, app passwords, recovery phone numbers and addresses that are not yours.
- A downstream reset across the accounts that recover through email: password change, MFA re-enrolment on an authenticator app (not SMS where avoidable), session revocation on every device.
- A device check on the phone and laptop you log in from, because if the attacker harvested credentials via malware rather than a phishing page, the new passwords are compromised the moment you type them.
- A short written record of what was changed, what to watch for in the next 30 days, and whether the incident meets the threshold to be reported to Scamwatch or — if your data sat with an organisation that had it breached — to engage with the OAIC notifiable data breaches process.
Cyber by Exegesis is the cyber consultancy line of Exegesis, the same parent company behind DRMO. Our scope here is recovery and hardening for one individual. We are not your bank’s fraud team and we cannot reverse transactions — but we can sequence the reset so the fraud team has something to work with.
How it works
- You book a triage call. We confirm scope, ask which accounts you have noticed problems with, and agree what is in and out of the engagement.
- We start with the email account that anchors your identity online and work outward from there, on a screen-share, with you doing the clicks and us guiding each step.
- We sweep the recovered email for forwarding rules, filters, connected apps, and recovery contacts the attacker added — these are the persistence mechanisms most individuals miss.
- We sequence the downstream resets — social, retail, banking, BNPL — and re-enrol MFA on an authenticator app where the provider supports it.
- We finish with a device check and a short written record, including whether to lodge a Scamwatch report and any next steps with your bank.
Why this matters in Sydney
Sydney is Australia’s largest concentration of high-value consumer accounts — banking, brokerage, superannuation, property-related identity records — and the highest density of phishing targets to match. ACCC Scamwatch data consistently shows NSW reporting the largest share of scam losses by volume in the country. For a Sydney individual, a single successful phish rarely stays contained to one account; the recovery work is in untangling the chain. Getting the sequence right in the first 24–72 hours is what separates a clean recovery from weeks of cascading fraud.
Sources
- ACCC Scamwatch (National Anti-Scam Centre): https://www.scamwatch.gov.au/
- ACSC guidance for individuals and families: https://www.cyber.gov.au/protect-yourself
- OAIC Notifiable Data Breaches scheme (where your data was held by an organisation that suffered an eligible breach): https://www.oaic.gov.au/privacy/notifiable-data-breaches
- eSafety Commissioner (where the takeover involves image-based abuse, impersonation, or harm via a social account): https://www.esafety.gov.au/
- Cyber by Exegesis — Account Takeover Recovery (waitlist)
Join the waitlist
We are sequencing engagements by urgency and by the email provider that anchors your identity (Google and Microsoft first, then the major Australian ISPs). Join the waitlist with a short note on which accounts you believe are affected — we will tell you when we can take your engagement.