Urgent and after-hours

If anyone is hurt or in immediate danger, call 911 now

Do not fill in this form first. Emergency services are faster than we are, they are closer than we are, and they can compel things we cannot. Call them, and come back to this page afterwards — we will still be here.

The same applies if a crime is happening as you read this, if someone is at your door, or if you are deciding whether it is serious enough to call. If you are weighing it up, it is serious enough. Call.

Two other numbers that are better than ours for what they cover: 988 for a mental health or suicidal crisis (988lifeline.org), and 1-800-799-7233 for domestic violence (thehotline.org).

Skip straight to the form →  or call (602) 725-2818

Consultations at Honeybadger Solutions are scheduled Monday to Friday. The calendar is closed at weekends. The company is not. This page is how you reach us when something cannot wait for business hours — and it is a better instrument for that than a booking link, because a person in an incident does not need a fifteen-minute slot on Tuesday. They need somebody to have the details now.

Everything on this page is read seven days a week, including holidays. What follows is what qualifies, what to do in the meantime, and exactly what we will and will not promise you.

Does this belong here?

The test is not how bad it feels. Everybody who contacts a security firm is having a bad day, and distress is not a useful signal. The test is a single question:

Does waiting until Monday change the outcome?

That comes down to three things. If any one of them is true, use this page.

Two that look ordinary and are genuinely counted in hours

People often apologise for these, and they should not. A fraudulent wire or a business email compromise in the last day or two sits inside a bank recall window that closes fast, and the caller is usually calm because the shock has not landed yet. Ransomware that is still encrypting costs systems by the hour. Both belong here even if nobody is shouting.

And the honest other side

Some things feel urgent at midnight and are genuinely no worse on Monday: wanting a quote or a price. Wanting to talk through options. A situation that has been running for months and did not change this week. A background check. A matter already in litigation. Wanting reassurance about a decision.

Every one of those deserves a real answer, and it will get a better one from a proper conversation than from a form at 1 a.m. If that is where you are, book a consultation and we will give it the time it needs. We will not think less of you for using this page and being wrong about it — but we will say so, kindly, and send you the link.

The first ten minutes, before anyone calls you back

This is the part of the page worth reading even if you never contact us. Most of what determines whether a matter can be proved later is decided in the first hour, usually by someone acting reasonably and destroying the evidence while they do it.

Everyone, first

• Safety before evidence, always. Do not go back into a building you have just left. Do not confront anyone. Do not drive to a location alone to check on something. Nothing you might preserve is worth this.
• Write down the time. When you noticed it, what you have done since, who you have told. Times decay faster than anything else you have, and by tomorrow you will be certain about a sequence you have already got wrong.
• Stop the cleanup. Do not tidy, repair, replace or move anything at a physical scene until it is photographed — wide first, then medium, then close, with something ordinary in frame for scale.
• Do not change the locks or codes yet. First write down who currently has keys, codes and access. Change them after that list exists, not before it.

If a computer or phone is involved

• Do not switch it off. Do not switch it back on. Powering a machine down destroys what is held in memory. Powering one back up overwrites data and can restart whatever was running. Whichever state it is in, leave it there.
• If you think something is still running, disconnect it from the network but leave it powered on. Unplug the cable, or turn off Wi-Fi. That stops the spread without destroying the evidence, and it is one of the few actions worth taking before anyone advises you.
• Do not run scans, delete files, reinstall, restore from backup, or let anyone “clean it up”. Every one of those writes to the disk, and what it writes over is the part that mattered.
• Do not log in to the affected account to check. Not from that device and not from another one. Leave the state as it is.
• Photograph the screen with a different phone. A ransom note, an extortion message, an error, a login alert — a photograph of the screen costs nothing and survives everything that happens next.

If money has moved

• Call your bank’s fraud line now, before you finish this page. Use the words fraudulent wire or fraudulent transfer and ask them to initiate a recall. That window is short, it is a bank action, and no security firm can do it for you.
• Report it at ic3.gov. Do it the same day. It is free, it takes a few minutes, and reporting early is what makes some recovery mechanisms available at all.
• Do not reply to the email or message that started it, and do not delete it. Leave the whole thread exactly where it is.

If video exists

• Find out how long your recorder keeps footage — ask whoever administers it if you do not know. Many systems overwrite within days.
• Export the relevant window now, to a drive you keep. Export generously — hours either side, not minutes. It is easier to ignore extra footage than to recover deleted footage.
• Check the recorder’s clock against real time and write down the difference. Recorder clocks drift, and an unexplained offset is what gets footage argued over later.

If somebody is contacting you

• Do not respond, and do not block them yet. Blocking ends the record and sometimes escalates the behaviour. Preserve first, then decide with someone who has seen this before.
• Keep the original messages on the original device. Forwarded screenshots lose the information underneath the picture, which is usually the part that identifies anybody.
• Start a log, and keep it dull. Date, time, what happened, who saw it. Under A.R.S. § 13-2923 a course of conduct for stalking can be established by as few as two occasions — the threshold is low, and the thing that is usually missing is not a third incident but a written record of the first.

What happens when you send this

One promise, stated once, and nothing else implied around it.

Urgent intake

Answer what you can. A half-finished form still reaches us, and it is better than a perfect one you were too rattled to finish. If typing is not workable right now, call (602) 725-2818 instead.

What we will never ask you for

People who have just been defrauded, extorted or breached get targeted a second time within days, by operations that have read the same public traces you have and know exactly what you are afraid of. So it is worth knowing what a legitimate contact from us does not look like.

• We will never ask for your passwords, your two-factor codes, your recovery codes, or a seed phrase.
• We will never ask you to install remote-access software during a first contact.
• We will never ask for payment in cryptocurrency, gift cards, or a transfer to a personal account.
• We will never tell you that funds can be recovered, or that anything can be undone, before anyone has looked at it. Anybody who does that on a first call is selling you something that does not exist.

If someone contacts you claiming to be Honeybadger Solutions and does any of the above, it is not us. Call (602) 725-2818 and check.

Where we can respond, stated plainly

Investigative, digital forensics, cyber and financial work is performed remotely from Arizona under Arizona licensure for clients anywhere in the United States and internationally, so distance affects it far less. For a great deal of what arrives on this page — a compromised account, a device to preserve, a fraudulent transfer, a message thread that needs to survive — the first useful hour happens over a phone line, wherever you are.

If this can wait for a weekday

Then let it. A scheduled conversation on a Tuesday morning is a better use of your problem than a form at midnight, and you will get a more careful answer from someone who has had time to think about it.