Take a pause.
Check the source.
A message or caller may impersonate an organisation you know. A familiar name or logo is not enough to establish who sent it.
Prepare step by step
Look at what they ask you to do
Pressure about an account being closed, an urgent transfer or a request for codes are warning signs. Do not share a PIN, password or OTP, or install software at a caller’s request.
End the contact and check independently
Do not verify a message using the link or number it supplies. Use an independently verified channel for the organisation. For a SACCO enquiry, start with the Contact page.
Keep a record of what happened
Keep the message, date and sender details. If money was transferred, retain the transaction confirmation. Remove confidential information from copies you prepare to share.
If you have already acted
Only opened a link? Close it and stop entering information. Shared a code or sent money? Contact the provider responsible for the affected account or service promptly through a verified channel and ask how to secure it.
In your record, describe what you did and when, without repeating the code or password. Reporting an incident does not guarantee recovery of money.
My checklist
Check each item as you prepare it.
Checks are not saved when you leave this page. You can print the checklist before closing it.
Put your preparation to use.
If an account may be at risk, do not wait to finish this checklist. Contact the relevant provider through its verified channel first.
Find SACCO contact informationRead the supporting guidance: I&M Bank Rwanda · General security guidance