The first 24 hours after a deepfake of you or your company.

Before you start

This list is meant to help you act calmly and in order. It is not legal advice, and the National Cybersecurity Association of Ukraine receives no material from you, checks no files and removes nothing. Every report below goes to a platform or a public authority.

Step 1. The first 10 minutes

1. 1Do not reply to anyone who is threatening you or demanding something until you have preserved the evidence.
2. 2Do not spread the fake: no reposting, quote-sharing or forwarding, even “to warn people”.
3. 3Open an incident log: who found it, when and where, with the time zone.
4. 4Tell one person you trust so you are not deciding alone.

Step 2. Preserve evidence before it is deleted

1. 1Save the original file or the exact link as you received it. Do not edit, convert or compress it.
2. 2Record the URL of every copy, the account name, the profile URL and the post or video ID. A YouTube complaint needs the video URL and timestamps of every appearance ¹.
3. 3Record the date and time of each sighting with its time zone (UTC and local).
4. 4Screen-record the page so the URL, account and date are visible, and add screenshots.
5. 5Compute a cryptographic hash (for example SHA-256) of every saved file and write it in the log. A hash is the output of a hash function applied to data, so a changed file gives a different value ⁹.
6. 6Keep two copies, one of them offline. Make them read-only and note who handled them and when.
7. 7Save emails as .eml files: the Cyber Police form accepts email letters in that format ⁶.

Do not post sensitive material to public web archives: archiving makes it publicly visible.

Ask a lawyer how to secure web content for use in court. We do not publish procedures here that we have not verified.

Step 3. Notify the platform

Use each platform's own reporting route. Start where the fake spreads most, then work through the rest. Platforms change their forms, so open the current help page before you report.

1. 1YouTube: file a privacy complaint. You must be identifiable and the content must look realistic. Give the video URL and timestamps ¹.
2. 2A profile or channel impersonating you: use the platform's impersonation form. YouTube describes its route in its help centre ².
3. 3Telegram: use the Report button on public content. For takedown you can also email abuse@telegram.org with the t.me links. Telegram does not process private chats and groups ³.
4. 4Intimate synthetic images: adults can use StopNCII (hashes are created on your device, no image is uploaded, and it works only with participating platforms) ⁴. If the person in the image is under 18, use Take It Down ⁵.
5. 5Keep a copy of every report and every reply. Expect delays and a possible refusal: the final decision rests with the platform ¹.

Step 4. Notify the authorities in Ukraine

1. 1Cyber Police: for phishing or malware there is an incident form (describe the event, add an email address, attach a file up to 20 MB) ⁶. For other matters use cyberpolice.gov.ua/declare ⁶. Attach your evidence log.
2. 2Cyber Police helpline: 0800 50 51 70 (Mon–Thu 9:00–18:00, Fri 9:00–17:00). The contacts page labels it for enquiries about e-appeals sent through the feedback form ⁷.
3. 3An organisation that is also under technical attack: email CERT-UA at incidents@cert.gov.ua (phone +38 (044) 281-88-25, as published on 10 Feb 2025). Isolate the affected network first and have logs and suspicious files ready. CERT-UA is not a punitive body ⁸.
4. 4If you are abroad, contact the local police and use the platform routes.

Step 5. If the fake targets your company

1. 1Publish one short holding statement on your verified channels, and do not embed the fake in it.
2. 2Brief staff, key partners and your bank: any payment or credential request made by voice, video or chat is verified by callback (see the guide “Voice clones and fake calls”). Real-time AI video chats posing as executives are documented ¹⁰.
3. 3Lock down executive accounts (see the guide “Protecting your accounts and digital identity”).
4. 4Inform your insurer and your counsel.

Step 6. The next 24 to 72 hours

1. 1Check again for copies. Log new URLs and report them.
2. 2If your case has an EU link, a lawyer can assess an erasure request under GDPR Article 17; it has exceptions, including freedom of expression ¹¹.
3. 3Look after yourself: talk to people close to you and stop scrolling through the fake.

What not to do

• Do not negotiate with, or reply to, anyone demanding something from you.
• Do not publish a detector's output as proof. These tools produce false positives and variable accuracy, and on in-the-wild 2024 content their performance dropped sharply ^{12 13}.
• Do not publicly accuse a named person or site.

Limits