If it already happened
Four situations, each with a sequence. In every one the order matters more than the speed, and in every one people instinctively do it backwards.
The ordering principle
People check the balance first. That is the wrong first move in almost every case, because a balance is a number that will still be there in five minutes and an account is something somebody can act through right now, including talking to other people as you.
So the general shape is: close the access, then look at what was done with it, then deal with the money. Each page below applies that to a specific situation.
The one rule shared by all fourDoing something in the wrong order is usually recoverable. Doing it from the wrong place is not, so every sequence below starts from an address you verified yourself rather than the one you were using when it went wrong.
The four
You typed credentials somewhereAccount first, message log second, balance last. Not the other way round.Minutes matterYou paid outside escrowThe honest answer is that there is no process. What is still worth doing.No mechanismAn order has not arrivedMost of the outcome is decided before you file anything.Wait firstYou cannot get inSix boring causes before you assume the worst. One of them changes what to do first.Check first