Ilia Nikolaevich Zavialov answers questions on digital security

Ilia Nikolaevich Zavialov works with individuals, families and small organisations. His subject is narrow: the decisions a person makes while being hurried. Whether to pay, whether to install, whether to sign, whether to grant access.

So the answers here are not about antivirus software and password length. They are about where the point beyond return sits in a given situation, and which single action closes that point in advance.

A scheme is not built on the victim being careless. It is built on a shortage of time. First a deadline is created: an account about to be blocked, a parcel about to be returned, a price valid until the evening. Then, under that deadline, one specific action is requested.

Attention does not help against a deadline, because it is itself consumed by the decision. What helps is a rule that requires no judgement: do not continue a conversation about money on the channel it arrived on, restart it from your side.

Presentation can be bought. A website, documents, reviews, a confident voice and accurate knowledge of your personal details all cost money and time, and an attacker spends both.

Records cannot be bought. An entry in a state register, a licence number in the regulator's list, the registration date of a domain and the payment details all exist regardless of how the conversation went. The check moves there.

First: a second factor that survives a fake page, which means a key or an app rather than an SMS code. Second: backup codes printed and kept away from the phone. Third: a check of which email and which number are set as recovery contacts in your main accounts.

These three take an evening and then work on their own. Those are the measures that survive a real incident, unlike the intention to be more careful.

A card leaves a dispute open under the payment scheme rules, and its deadlines start running at once. A platform holds the money until a condition is met. A transfer to a private person is rarely recalled and only while the money is still there. A cryptocurrency transfer is final by design.

Separately: offers to recover funds for an advance payment arrive quickly after a public loss. That is a second loss on top of the first, not help.