Helping someone this happened to

The harms land on people who did not take this course

Almost everything in these nine modules affects people who never chose the system, cannot see it, and do not know what to ask. Which means the most useful thing most readers will ever do with this material is help somebody else: a parent who got the phone call, a teenager whose images are circulating, a neighbour whose benefit stopped, a friend whose account was deactivated.

This final lesson is the triage.

The first ten minutes, whatever the harm

Three things, in this order.

Believe them and slow it down. Almost every one of these situations runs on urgency, either because a scam requires it or because panic supplies it. "Nothing has to be decided in the next hour" is usually true and is the most useful sentence you have.

Preserve evidence before anything else. Screenshots including the full screen with date and time, URLs, account names, reference numbers, message headers, the exact wording. Save it outside the account in question. People delete things to make them stop existing, and it destroys their case.

Do not shame them. Fraud victims often do not report because they feel foolish, and the successful ones are engineered by professionals against ordinary people. A person who feels judged stops telling you things, and you need what they have not said yet.

Then, by type

Money has been sent. Contact the bank immediately — the first hours matter and many banks have a fraud line that can attempt recall. Report to the national cybercrime or fraud reporting service. In India that is the national cybercrime portal and the 1930 helpline; the UK has Action Fraud; most countries have an equivalent. Change credentials on anything connected. Expect a follow-up recovery scam, which targets people who have just been defrauded and is the second most common thing that happens.

A voice or video was used to impersonate someone. Verify by an independent channel before anything else. Then warn the person being impersonated, who may be being used against others too.

Intimate images, real or synthetic. Do not have them send you the images. Preserve URLs and account names only. Use the platform's specific non-consensual intimate image reporting route, which is faster than a general report. Hash-based services such as StopNCII let a person register an image so participating platforms can block matching uploads without the image being sent anywhere. Report to police even where the law is unclear, because the record matters later. If a minor is involved, this is a child protection matter and goes to the police and the relevant national reporting line, not to the school's discretion alone.

A decision was made about them. The letter from the fifth module. Find the deadline first. Ask whether the decision was solely automated, request human review by someone uninvolved, ask what data was used and what would have had to be different, and dispute specific facts with evidence. Keep everything in writing.

Their work or account is gone. Data access request, request for human review, screenshots of everything before access is lost, and find whether a collective exists — worker groups have obtained far more than individuals have.

They are relying on a chatbot in distress. Do not remove it and offer nothing. Ask what it gives them — usually availability, no judgement, or the ability to say something out loud. Then find a human route that supplies the same thing, and give the local crisis line. If there is any indication of immediate risk, that is a call to emergency services or a crisis service, now, not a conversation about technology.

What to say when you do not know

You will often not know the answer. Three honest sentences cover most of it:

"I do not know, and here is who would." Name the regulator, the union, the legal aid clinic, the cybercrime portal, the data protection authority.

"Let us write down exactly what happened, with dates, before we do anything else." This is useful in every single case above and requires no expertise.

"You are not the first person this happened to." True in every case, and it is the sentence that gets people to act rather than hide.

The end of the course

Eight modules of mechanism and one of practice, and the through-line is a single move: ask who chose, what they measured, who bears the cost, and what happens when it is wrong.

That question works on a hiring model, a benefits system, a chatbot, a face-recognition alert, a training corpus and a data centre. It does not require you to be a technologist. It requires you to refuse the framing in which a decision made by people, for reasons, with consequences that fall on somebody, gets described as something a machine did.