Family Cyber Security Plan Template: Accounts, Recovery, Backups and Scam Response

When a household account is hacked or a family member is scammed, the damage is usually made worse by not knowing who controls which account, where the recovery codes are and who to call first. This template gives a family a short written plan to fill in once and keep up to date: an account and device register, recovery contacts, backup arrangements, house rules for devices, and a step-by-step response for hacked accounts, lost phones and scams. It follows the structure of an incident response plan, simplified for a home, and uses UK guidance from the NCSC with reporting routes for the UK and US. It is written for whoever acts as the household's informal IT lead, and for anyone helping an older relative. For the everyday basics behind it, see the Cyber Hygiene Checklist Guide.

How to use this template

• Replace text in square brackets, such as [Family name], [Plan owner] and [Bank fraud line], with your own details.
• Fill in sections 1 and 2 together in one sitting; most families need about an hour. The response sections (3 to 8) can be used as they are.
• Never write passwords in this plan. Record where things are kept (for example "recovery codes: envelope in the document box"), not the secrets themselves.
• Keep one printed copy somewhere safe at home and give a second to a trusted person outside the household. A plan stored only on the phone that was just stolen does not help.
• Review it every six months and whenever someone gets a new phone, opens a bank account or leaves home.

1. Scope and triggers

1.1 This plan covers the people, accounts and devices of the [Family name] household: [list names].

1.2 It covers personal email, phone and cloud accounts, banking and payment apps, social media, shopping and gaming accounts, home devices (computers, tablets, phones, router, smart devices) and the backups of family photos and documents.

1.3 Use the response sections when any of the following happens:

• Someone cannot sign in, or an account's security settings have changed without their action.
• Messages were sent from someone's account that they did not send, or there are sign-ins from unfamiliar places or at odd times.
• Money was spent or transferred without permission, or a family member has sent money or card details to someone who may be a scammer.
• A phone, laptop or tablet is lost or stolen, or a phone suddenly loses signal and cannot make calls (a possible SIM swap).
• A device shows a ransom message, a fake virus warning with a phone number, or someone has given a stranger remote access to a computer.
• A child reports something online that worried or frightened them.

1.4 Baseline rules every member follows (based on the NCSC Cyber Aware actions):

• A strong, separate password for email, because email can reset every other account. Three random words is a good method.
• Two-step verification (2SV) on email, banking, social media and shopping accounts.
• A password manager, or for younger children a parent-managed one.
• Automatic updates on every phone, computer, tablet and the router.
• Backups of photos and important documents, as set out in 2.4.

2. Roles and contacts

2.1 Plan owner: [Name], who keeps this plan current and leads the response. Deputy: [Name], who acts when the plan owner is unavailable or is the person affected.

2.2 Trusted outside contact: [Name, phone], who holds the second copy of the plan and can be phoned if the household is locked out of its own accounts.

2.3 Account register. List every important account. Record who owns it, how 2SV is set up and where its recovery details are kept.

2.4 Backups. [Family photos and documents] are backed up to [cloud service] automatically and copied to [external drive] every [month]. The drive is unplugged between backups, because the NCSC warns that ransomware can spread to attached drives. Irreplaceable items, such as family photos, are kept in both places. The cloud account holding backups has a strong password and 2SV, since anyone who gets into it gets the backups too. See the Backing Up Personal Data Guide.

2.5 Device register and house rules.

House rules: [no sharing of passwords outside the family; children ask before installing apps or entering card details; nobody gives remote access to a caller; any request for money by message is checked by phoning the person on a known number].

2.6 Emergency numbers (fill in and keep on the printed copy):

3. Detection and triage

3.1 Anyone who notices a trigger in 1.3 tells the plan owner straight away. Nobody should be embarrassed: scams are designed to fool people, and speed matters more than blame.

3.2 The plan owner asks four questions:

1. Has money left, or is it about to leave? If yes, go to 4.1 now.
2. Is the main email account affected? If yes, treat it as the highest priority after money, because it can reset everything else.
3. Does a stranger still have access, for example remote access software on a computer or a signed-in session?
4. Is anyone at risk of harm, such as a child being threatened or blackmailed? If yes, call 999 or 911 if in immediate danger and see section 7.

3.3 Note what happened, when, and what was clicked, said or paid. Take screenshots of messages, usernames and payment details before anything is deleted.

4. Containment

4.1 Money: phone the bank's fraud line using the number on the card or the official website, not a number from the suspicious message. Ask them to stop or recall the payment and freeze the card. Do the same for any payment app used.

4.2 Remote access: if a caller was given access to a computer, disconnect it from the internet, uninstall the remote access app and do not use it for banking until 5.2 is done.

4.3 Hacked account: follow the provider's recovery process. Once back in, sign out all other devices and sessions so anyone else needs the new password.

4.4 Lost or stolen device: use [Find My or Find My Device] to lock it and, if it will not be recovered, erase it. Ask the mobile provider to block the SIM.

4.5 Possible SIM swap: if a phone loses service unexpectedly, call the mobile provider from another phone and ask whether the number was moved. See the SIM Swap Fraud Guide.

5. Eradication

5.1 Following the NCSC's hacked account guidance, for each affected account:

• Change the password, and change it on any other account where the same password was used.
• Check email forwarding rules and filters and delete any you did not create, because attackers use them to receive copies of password reset emails.
• Check recovery email addresses, phone numbers and connected apps, and remove anything unfamiliar.
• Turn on 2SV if it was off.

5.2 For an affected computer or phone: install all updates, run the built-in security scan, and remove apps nobody recognises. If a ransom message appeared or the device still behaves oddly, back up only personal files and reset it to factory settings.

6. Recovery

6.1 Restore lost files from the backups in 2.4, starting with the newest copy taken before the problem.

6.2 If an account cannot be recovered, create a new one, tell contacts the old account is abandoned, and update banks, utilities and shops with the new details, as the NCSC advises.

6.3 Check bank and shopping accounts weekly for the next three months for further unauthorised activity.

6.4 If personal details such as a passport or National Insurance or Social Security number were handed over, follow the Identity Theft Recovery Guide.

7. Communication and notification

7.1 Tell friends, family or followers that the account was hacked and ask them to ignore recent messages from it, especially any that ask for money.

7.2 Report the crime using the numbers in 2.6. Report Fraud covers England, Wales and Northern Ireland; in Scotland call 101. In the US, report to the FTC and, for internet crime, the FBI's IC3.

7.3 Forward scam emails to [email protected]. The NCSC notes this service is not for reporting a crime, so report losses separately.

7.4 If a child is involved in threats, blackmail or abuse, do not delete the evidence and report it to the police and the relevant child protection service. See Protecting Children Online: A Parent's Guide and the Sextortion guide for parents and carers.

7.5 Be wary of anyone who contacts you afterwards offering to recover the lost money for a fee. This is a common follow-on scam.

8. Post-incident review

8.1 Within two weeks, the household talks through what happened, without blame:

• How did it start, and what would have stopped it earlier?
• Did everyone know who to tell? Was the plan easy to find?
• Were recovery details and backups where the register said they were?

8.2 Update the account register, house rules and emergency numbers, and record the date of the review here: [date].

Implementation guidance

Most of the protection comes from the preparation in sections 1 and 2, not from the response. A practical order of work:

1. Secure the main email accounts first. Strong separate passwords, 2SV, and current recovery phone and email for each adult.
2. Set up recovery that does not depend on one phone. Save backup codes on paper, add a recovery contact where the service offers one, and set up a legacy or inactive account contact. See the Account Recovery Planning Guide.
3. Turn on automatic updates and find-my-device on every device in the register.
4. Set up backups and test a restore of one photo folder, so you know it works before you need it.
5. Agree the house rules with everyone, including a family code word or call-back habit for any message asking for money. See the Spotting Deepfake Scams Guide.
6. Help older relatives separately. Agree how they will check unexpected calls and requests with you. See the Cybersecurity for Seniors Guide.
7. Rehearse once. Pick one scenario, such as a lost phone, and walk through sections 3 to 6 at the kitchen table. Fix whatever was missing.

Signs the plan is working: every adult's email has 2SV, the last restore test is less than six months old, everyone can name the plan owner, and the register was updated after the last new device.

Further reading: NCSC: Cyber Aware · NCSC: Recovering a hacked account · NCSC: Back up your most important data · NCSC: Reporting a scam email

Related NHI Mgmt Group resources: Cyber Hygiene Checklist Guide · What to Do If You Have Been Scammed Guide · Hacked Social Media or Email Account Recovery Guide · Password Managers Explained for Everyone Guide