Cybersecurity

Should You Pay Ransomware? The Facts

Your files are locked, the ransom note is on the screen, and the clock is ticking. The question is urgent and understandable: should you pay? The short answer is no — and this guide explains why, in the words of the agencies that deal with ransomware every day, and what to do instead to recover without paying criminals.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

The official line: do not pay

The advice from law enforcement and cybersecurity agencies is consistent and long-standing. The FBI states that it does not support paying a ransom, and the US Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) give the same advice: do not pay. The reasons are practical, not moral — payment does not reliably work, and it makes the problem worse for you and for everyone else.

First, payment does not guarantee your files back. The decryption tool provided after payment is software written by criminals: it may be faulty, it may only partly work, or it may never arrive. Some victims who pay receive nothing at all. Others get a tool that decrypts some files and corrupts others. You are relying on the honesty of the people who just extorted you.

Second, payment marks you as a payer. Ransomware groups keep records, and a victim who pays once is a known payer — a target worth attacking again, either by the same group or by another one that buys the information. Third, the money funds more attacks: it pays the developers, the affiliates, and the brokers, and it finances the next wave of phishing and break-ins, including against hospitals and schools.

Why payment is not a reliable recovery

Even when a decryption key arrives, recovery is not simple. The decryption process can take days, may require technical support from the attackers themselves, and often fails on large or complex files such as databases. Some ransomware encrypts in a way that damages the files even if the correct key is used, and the tool may not handle every file type.

In a double extortion attack, payment has a second problem: there is no way to verify that stolen data has been deleted. You pay to stop publication, but the data may have been copied, sold, or kept for a later demand — and attackers have been known to demand more after a first payment. You are paying for a promise that cannot be checked.

There is also a legal risk. Some ransomware groups are associated with sanctioned entities, and paying them can breach sanctions law in the United States, the United Kingdom and other countries. That is a decision with legal consequences, and it needs legal advice before any payment is considered — not after.

What to do instead: the recovery path

Start by disconnecting the affected devices from the network, but do not turn them off — memory contents and logs can help investigators. Report the attack immediately: in the US, the FBI Internet Crime Complaint Center at ic3.gov; in the UK, Action Fraud and the National Cyber Security Centre. Preserve the ransom note and any messages from the attackers, and do not delete logs.

Check No More Ransom (nomoreransom.org), the free decryption project run by law enforcement and security companies. It provides free decryption tools for many ransomware variants, and it is worth checking before assuming your files are lost. Then restore from your backups onto clean systems — this is the moment backups exist for — and change all passwords from a clean device.

Bring in help if you need it: your IT team, a reputable incident response company, your insurer if you have cyber insurance, and legal advice on your notification duties. If personal data was stolen, you may be legally required to notify regulators and the people affected within a set time — do not leave that decision until after recovery.

• Disconnect affected devices, but do not switch them off.
• Report to law enforcement and preserve the ransom note.
• Check No More Ransom for a free decryption tool.
• Restore from backups onto clean systems.
• Take legal advice on notification duties before deciding anything.

If you have no backups and no decryption tool

This is the hardest situation, and it is the reason this guide, and the whole ransomware section, puts backup before anything else. Without a backup and without a free decryption tool, the encrypted files may be unrecoverable — and accepting that is better than paying and still losing them.

Before concluding that, exhaust the free options. Check No More Ransom again, including for variants with similar names, and check whether a different device holds a copy — a cloud drive with version history, an email attachment, an old external drive, a colleague's copy. Cloud services often keep earlier versions of files, and those versions predate the encryption.

If the files are truly gone, the task becomes rebuilding: what can be recreated, what can be recovered from other sources, and what to tell the people affected. Be honest about it. Then fix the cause — almost always a phishing email, a stolen password, or an unpatched system — and set up the backup that would have made this a bad day instead of a disaster.

The decision, and who should make it

For an individual, the decision is personal, but the advice is the same: do not pay, report it, restore from backup, and get help. For an organisation, the decision should never be made by one person under pressure. It should involve senior leadership, legal advisers, the insurer, and law enforcement — and it should be made with the full picture: the value of the data, the cost of downtime, the legal risk of paying, and the likelihood that payment actually works.

Some organisations insure against ransomware, and some insurers have historically been involved in ransom decisions. That is a matter for the insurer and legal counsel, not for a quick decision in the first hour of an attack. If your organisation has cyber insurance, call the insurer immediately — the policy usually requires it, and the insurer provides the incident response team.

Whatever you decide, document everything: the ransom note, the timeline, the decisions and who made them, and the advice you received. If the matter is ever reviewed — by a regulator, an insurer, or a court — that record is what shows you acted responsibly.

Preventing the next demand

The best time to deal with ransomware is before it happens. The defences are the same ones covered across this section: regular backups kept offline and tested, multi-factor authentication on email and remote access, prompt patching, phishing training, and a written incident plan that is practised. The cheapest lesson is the one learned from someone else's attack.

After an attack, review honestly how the attacker got in and close that path. Was it a phishing email? Then training and reporting need work. Was it a stolen password? Then password hygiene and multi-factor authentication need work. Was it an unpatched system? Then patching needs work. A ransomware attack is, above all, a report on where your defences failed — read it properly, and the next attack finds a harder target.

Sources

• CISA — Ransomware guidance — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Ransomware guidance — last checked 14 November 2026.
• No More Ransom — Free decryption tools — last checked 14 November 2026.
• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

Should I pay the ransom to get my files back?

Law enforcement in the US and UK advises against paying. Payment does not guarantee your files back, marks you as someone who pays, and funds further attacks. Backups and free decryption tools from No More Ransom are the recovery path that works.

What happens if I pay and get no decryption key?

This happens. Some victims receive nothing, some receive a faulty tool, and some are asked for more money. There is no way to enforce a deal with criminals, and no refund process. That is why agencies advise against paying.

Is it illegal to pay a ransomware demand?

Paying is not generally illegal in itself, but it can breach sanctions law if the group receiving the money is linked to a sanctioned entity. That is a legal question with real consequences — take legal advice before any payment is considered.

Can I negotiate with ransomware attackers?

Attackers often offer a negotiation channel, and some victims do negotiate — usually through a professional incident response team or an insurer. Negotiation does not make payment safe, and any decision should involve legal advice and law enforcement.

What if the attackers threaten to publish my data?

This is double extortion. There is no way to verify that stolen data has been deleted after payment, and it may be sold later anyway. Report the attack, take legal advice, and notify the people affected through the proper channels.