What to do if you think you’ve been hacked

• If you think you’ve been hacked, responding quickly can help limit further damage and support recovery.
• Depending on the type of compromise, warning signs may include unfamiliar account activity, suspicious messages, unexpected pop-ups or a sudden loss of phone service.
• Notify relevant authorities and your financial institution immediately to help speed up recovery.
• Account alerts, unique passwords, multi-factor authentication and added phone carrier safeguards can help strengthen your security.
• Added this clause because the warning signs vary by compromise. For example, loss in phone service wouldn't be a result of someone's SSN being stolen.

Discovering that your identity, accounts, devices or personal information may have been compromised can feel overwhelming. Beyond emotional stress, a cyberattack can also cause significant financial harm. Americans lost nearly $21 billion to cyber-enabled crimes in 2025, according to the FBI’s Internet Crime Report.¹

If you think you’ve been hacked, acting quickly and thoroughly can help limit the damage. Here are five common ways your information can be compromised and how to respond.

If your Social Security Number (SSN) is stolen, act as soon as you discover the theft. One warning sign may be an IRS notice that someone else has already filed a tax return using your SSN.

Here are five steps to take if your SSN has been compromised:

1. Report the SSN theft using identitytheft.gov and file a local police report.
2. Freeze your credit at all major bureaus—Equifax, Experian and TransUnion—to prevent fraudsters from establishing new lines of credit with your identity.
3. Keep a record, report all activity to the fraud department of your bank and alert E*TRADE.
4. After reporting, continue monitoring your existing credit lines.
5. Learn more about E*TRADE from Morgan Stanley's Customer Protection Guarantee.

Cybercriminals may gain access to your email if they obtain your password. If your email is hacked, secure the account and check for unauthorized changes. One warning sign is hearing from contacts that your account is sending emails with suspicious links or money requests.

Here are four steps to take if your email was hacked:

1. Change the password immediately using a password manager to create a unique, complex password. If your device is compromised, make the change from a trusted device. Then, update passwords for important accounts linked to the email, as well as any accounts where you reuse the same password.
2. Turn on multi-factor authentication (MFA)—for example, security keys, push notifications, fingerprints or facial recognition—as another layer of protection.
3. Check your account settings and remove any unfamiliar devices, forwarding rules, recovery contacts, connected apps or filters, as these could provide a hacker with continued access to your account and enable them to redirect emails.
4. Alert your contacts, bank and E*TRADE about the attack.

Malware can compromise your computer if you click a phishing link or download content from an untrustworthy site. Warning signs may include unexpected pop-up ads or unusually slow performance from your devices.

Take the following steps to remove the malware and help secure your device:

1. Use a reputable antivirus product to clean up the malware infection.
2. If the problem persists after using antivirus software, contact an IT professional, especially if ransomware has locked your device or encrypted your files and a ransom demand has been made to restore them.
3. From a malware-free device, change the passwords on any accounts you used while your computer was infected.
   
4. Turn on automatic updates for your devices so your operating software is up to date.
5. Report the malware incident to E*TRADE.

If your phone suddenly and unexpectedly loses service and you can’t call, text or receive messages, your number may be compromised. In a phone porting scam, a hacker transfers your number to another device and can intercept one-time passcodes used to access your accounts.

You can take these steps to regain control of your number:

1. Contact your mobile carrier and financial institutions immediately.
2. Ask your phone carrier to add safeguards for number-porting requests, such as an account passcode required before changes can be made.
3. If you were getting one-time passcodes sent via text message to your phone number, consider using a stronger form of authentication like an authenticator app or security key.

A cyberattack can leave you feeling overwhelmed, vulnerable and unsure of what to do next. Your account security is important to us. In addition to the many ways your assets are protected, the E*TRADE from Morgan Stanley Customer Protection Guarantee means you're not liable for unauthorized third-party use of your account through no fault of your own, and we'll never sell your personal information.²

Footnotes:

¹ FBI. 2025 Internet Crimes Report, https://www.fbi.gov/file-repository/2025_ic3report.pdf/view

² For Brokerage Services: Morgan Stanley Smith Barney LLC will investigate claims to determine the applicability of the Customer Protection Guarantee and restore to your account(s) applicable losses based upon an investigation of the facts of your claim. "Loss" does not include any tax consequences.

For Lending Services: "Loss" is defined as an increase in the outstanding account balance at the time of the unauthorized third-party access and any additional interest accrued as a result.

To be eligible for protection under this Customer Protection Guarantee, it is your responsibility to safeguard your account access information. Please do not share your access means, including, but not limited to, your login ID, password, PIN, and transaction codes, with anyone. If you share this information with anyone, we will consider their activities to have been authorized by you, including activities by persons to whom you have intentionally or unintentionally granted authority over your account(s). Report any unauthorized account activities to us immediately at 1-800-387-2331 or upon discovery or suspicion of your account(s), credentials, and/or any of your computer(s) or device(s) having been compromised or if you have been a victim of financial fraud. Morgan Stanley is not liable for any Loss caused directly or indirectly by you. Nothing in this pledge is intended to limit any right conferred or claim or protection provided to any party under Federal Law (such as Regulation E) or state law, as applicable.

CRC# 5918951 (09/2026)