If you or someone else is in immediate physical danger, move toward safety and contact local emergency services or a trusted person who can help now.
GET HELP NOW
Pause. Get safe. Preserve your options.
A first-response guide for account takeovers, doxxing, harassment, leaked content, platform action and other creator emergencies.
THE FIRST 10 MINUTES
Do these three things before you improvise.
01 · STABILIZE
Get yourself safer
Move to a safer place if needed. Put distance between you and a threatening person. Ask one trusted person to stay with you—physically or by phone.
02 · DOCUMENT
Save what happened
Capture screenshots, URLs, usernames, dates, messages, alerts and transaction IDs. Preserve originals when possible; store a copy somewhere the affected account cannot erase.
03 · CONTAIN
Limit further access
From a trusted device, secure the email account that controls your other logins. Change exposed passwords, end unknown sessions and turn on multi-factor authentication.
CHOOSE THE SITUATION
Go directly to the problem in front of you.
Threat, stalking or immediate physical concern
- Move to a public, staffed or otherwise safer location if you can do so safely.
- Tell a trusted person what is happening and share your location or check-in plan.
- Do not meet, confront or negotiate with a threatening person alone.
- Save threats, identifying details, vehicle information and the time and place of each incident.
- Contact local emergency services when danger is immediate. For emotional crisis support in the U.S. and its territories, call or text 988.
Account takeover or suspicious access
- Start with the email account connected to your platforms, banking and password resets.
- Use a trusted device and type the service address yourself; avoid recovery links sent in unexpected messages.
- Change the password to a new, unique one; end unknown sessions and remove unfamiliar recovery methods.
- Turn on multi-factor authentication and save backup codes somewhere separate.
- Check payment methods, scheduled payouts, profile links, connected apps and recent posts or messages.
- Use the platform’s official recovery process and record every case number.
Doxxing, impersonation or coordinated harassment
- Capture the full post, profile, URL, username, date and surrounding context before reporting.
- Ask a trusted person to help monitor and document so you do not have to absorb every message.
- Hide public location clues, review old posts and remove exposed address, phone or workplace details where possible.
- Alert household members or a workplace only with the information they need to respond safely.
- Report through the platform’s impersonation, privacy or harassment channel; keep confirmation emails and ticket numbers.
- Avoid public back-and-forth that reveals more information or changes the evidence trail.
Intimate images shared without consent
- This is not your fault. Ask a trusted person to assist if viewing or documenting the material is overwhelming.
- Record URLs, accounts, dates and screenshots without redistributing the images.
- Use each platform’s non-consensual intimate imagery reporting route.
- StopNCII.org can help eligible adults create a digital fingerprint on their device so participating platforms can look for matching images.
- For confidential support related to sexual violence in the U.S., visit RAINN.
- Consider qualified legal support when threats, extortion, stalking or repeated distribution are involved.
Platform strike, suspension or payment hold
- Read the exact notice before changing or deleting anything.
- Save the notice, policy cited, affected content, balance, payout date, account status and case number.
- Download available account, sales, subscriber and tax records.
- Appeal through the official process with a short timeline and direct evidence; avoid sending repeated conflicting appeals.
- Notify customers only after you know what changed and what action they need to take.
- Move urgent operations to a backup channel you already control—such as your website or email list—without evading a platform restriction.
Make a clean incident record.
Create one folder. Add a short timeline, screenshots, URLs, messages, names, case numbers, financial impact and every action already taken. Keep an untouched copy and a working copy.
After the first hour
- Write down what remains unresolved and assign one next action to each item.
- Replace reused passwords and review account recovery details across critical services.
- Tell collaborators only what they need to know to prevent additional harm.
- Eat, hydrate, rest and hand off monitoring when possible. Exhaustion makes decisions harder.
- Schedule a follow-up check for 24 hours and one week later.
Scope: Tripn.work provides general educational information, not emergency, legal, medical, mental-health or cybersecurity services. Procedures and platform policies can change. Use official support channels and qualified professionals for your circumstances. Last reviewed September 20, 2026.
Hero photograph by mdreza jalali via Unsplash.