Preparing for Your Digital Security Incident Appointment

Security incidents can be frightening and confusing. You do not need to determine exactly what
happened before your appointment. Our job is to help reconstruct the incident, examine the
affected devices and accounts within the authorized scope of service, remove identified threats,
assess the remaining risk, and explain the safest next steps.

What to Do Now

• Stop communicating with the suspicious caller, sender, or organization.

• Do not send additional money, gift cards, cryptocurrency, verification codes,
  passwords, or personal information.

• If an unauthorized or suspicious financial transaction is pending or has already occurred,
  contact the financial institution immediately using the number on the back of the card, the
  official mobile application, or the institution’s official website using another device that is
  not compromised.

• Do not approve a sign-in, password-reset, account-recovery, or other security prompt you did
  not initiate.

• If a caller claims to represent a trusted organization, end the call and call back using the
  number on your card, statement, official application, or a website address you already know is
  genuine.

• Do not rely on a sponsored search result or advertisement for financial, technical-support, or
  account-recovery contact information.

• If your phone unexpectedly loses cellular service, stops receiving calls or text messages, or
  reports a SIM or eSIM change, contact your cellular provider immediately from another
  telephone.

• Disconnect the device from the internet and stop using it. Unless we have already
  instructed you to leave the device on but disconnected, shut it down and leave it off until the
  appointment. Do not use it for email, banking, shopping, password changes, or other sensitive
  activities.

• Do not factory-reset, erase, reinstall, or perform additional cleanup on the
  device unless instructed.

• Do not delete suspicious emails, text messages, call logs, downloaded files,
  remote-access programs, receipts, or account-security notifications.

• Preserve records such as screenshots, text messages, emails, telephone numbers, call
  logs, transaction records, gift-card receipts, cryptocurrency information, and any other
  evidence.

Document What Happened

Please write down the incident in the order it occurred. Include as much of the following
information as possible:

• The date and approximate time of each event

• How the contact began: telephone call, email, text message, website, pop-up, social media
  message, or account notification

• Every telephone number that called you and every number you called

• The name and organization the person claimed to represent

• Email addresses, usernames, websites, and links involved

• What the caller, message, or warning told you

• What you clicked, downloaded, installed, entered, or shared

• Whether remote access was allowed

• Whether a password, verification code, payment-card number, financial information, or identity
  information was provided

• Any money sent and the payment method used

• Devices and accounts used during or after the incident

• Contacts with banks, account providers, law enforcement, or government agencies

• Case, claim, ticket, or confirmation numbers received

Privacy Warning: Do not include passwords, device PINs or passcodes, complete or partial Social
Security numbers, complete payment-card numbers, or complete financial-account numbers in an
emailed timeline.

What to Bring

Desktop Computer:

• The desktop or all-in-one computer

• Its power cord

A monitor, keyboard, mouse, printer, speakers, or networking equipment are not ordinarily needed
unless you believe they are directly involved.

Laptop Computer:

• The laptop

• Its charger

Phone or Tablet:

• The device

• Its charger

• Be prepared to unlock the device during the appointment. Do not send the passcode through
  ordinary email.

Also bring or have securely available:

• Relevant usernames and email addresses

• Necessary Microsoft, Apple, Google, or email-account credentials

• Printed screenshots, suspicious messages, call logs, receipts, or bank notices

• Any instructions or documentation provided by a financial institution

Credentials are requested only when necessary for authorized services. Do not email passwords,
authentication codes, or recovery codes. Bring credentials securely or be prepared to enter them
yourself during the appointment. Planned password or account-security changes will be discussed
with you.

Service Options and Pricing

Device Security Inspection and Cleanup — $150 per device

This service examines the device for malware, unwanted software, remote-access applications,
suspicious browser activity, startup items, security settings, and other indicators of
compromise. Identified threats are removed when appropriate, and the device is reviewed for safe
return to normal use.

Online Identity and Account Security Review — $250 per user

This service is a broader investigation of the user’s primary digital identity—not merely a check
of an email account. It examines email accounts, saved credentials, password reuse, sign-in and
account activity, connected devices, recovery information, authentication methods, and related
accounts where a compromise may have spread.

A security incident may require one service or both. A clean device does not necessarily mean
that passwords, email accounts, financial accounts, or other online services are secure. For
example, a client who allowed remote access to one computer but did not knowingly enter or
provide account credentials may initially need only the Device Security Inspection and Cleanup.
The appropriate scope also depends on what the remote operator could see or access, whether
accounts were already signed in, and whether credentials were stored or synchronized on the
device. A client who allowed remote access and also entered or provided email, financial, or
other account credentials may reasonably need both services.

The “BYT2L Digital Security Incident Response & Recovery Guide” explains BYT2L’s full
investigative method. Your appointment includes only the services you authorize. Initial digital
security incident-response work generally requires device drop-off, pickup, or on-site handling.
Remote assistance is considered only after BYT2L determines that it can be performed safely.

What May Affect the Final Cost

Additional time or services may be required when an incident involves:

• Multiple devices or users

• Multiple affected email or online accounts

• Extensive password or account recovery

• Operating-system reinstallation

• Data backup or recovery

• Hardware problems

• Router or network-security concerns

• On-site work or coordination with outside organizations

No additional work will be performed without your authorization.

Why We Do Not Immediately Erase the Device

Factory-resetting or reinstalling a device may remove software-based threats, but it can also
destroy information that helps explain what happened. We first examine the available evidence and
will recommend a reset or reinstallation if it becomes the safest option.

What You Will Receive

After the authorized services are completed, you will receive:

• A summary of the work performed and relevant findings

• Clear recommendations for remaining recovery and security steps

• Documentation that may help satisfy a financial institution’s request, including a separate
  verification letter when requested, appropriate, and within the authorized service scope

• The Bringing Your Tech to Life Digital Security Incident Response & Recovery Guide, which
  explains how modern incidents happen, how recovery works, and how to reduce the risk of
  becoming a victim again. Your individual Service Report will identify the chapters, sections,
  or pages most relevant to your incident.

Every incident is different, and not every action taken by a criminal can be proven. Our goal is
to provide the clearest assessment possible, restore control where possible, and help you move
forward with practical information rather than fear.