PRIVATE INCIDENT NOTE — keep the completed copy locally

Do urgent recovery first. This note is not a safety assessment. For work incidents use your employer's reporting process. Share only the minimum requested through a known official channel. Do not post the completed note on GitHub or another public service.

Do not include passwords, recovery codes, full card/account numbers, identity documents or sensitive screenshots. Do not reopen a suspicious link just to complete this note.

Approximate date/time and timezone:
Affected service (name only):
Device/context (for example work laptop or personal phone):

What I observed (yes / no / unsure for each):
- Opened a suspicious page:
- Entered a password or other information (type only, not the value):
- Approved an unexpected MFA/sign-in prompt:
- Downloaded a file:
- Opened/ran a file or installed software:
- Shared payment details or sent money:

Facts in my own words:
What I am unsure about:

Actions already taken, with approximate times:
Official provider/IT channel contacted (no private contact details):
Instructions received / next check-in:

New facts discovered later (append with time; keep earlier uncertainty clear):

Source checklist and educational limits: phishing-response-checklist.md in this resource.