Should We Pay? — Ransomware Payment Decision Aid
A ransom demand is on the table and the room is looking at you. This aid structures the call the way a response team should: answer seven questions — can you restore from backups, was data exfiltrated, is a free decryptor known, could the actor be sanctioned (OFAC), what are the obligations and the impact, and is law enforcement engaged — and get a reasoned recommendation, the legal and procedural gates that must be cleared, and a pre-payment checklist. It never tells you simply to pay: payment is always a conditional, legally gated last resort. It is decision support, not legal advice, it makes no legal determination, and everything runs in your browser.
Decision support, not legal advice. This tool is decision support, not legal advice, and it does not make a legal determination. Ransomware payment decisions carry sanctions, regulatory and contractual exposure — engage qualified counsel and, where applicable, your insurer and law enforcement before acting.
Answer the questions
The recommendation on the right updates as you answer. Nothing is uploaded — everything runs in your browser.
Do you have verified, tested, offline or immutable backups that actually cover the encrypted systems? Restore feasibility — not just the existence of a backup job — is what matters.
Is the threat also to leak or sell stolen data, not only to keep systems encrypted? Paying for a deletion promise cannot be verified, and the leak is a data-breach problem in its own right.
Has a free decryptor for this strain been published (for example on the No More Ransom project)? If one exists and works, decryption may not require any payment at all.
Is the threat actor identified, and is it — or its jurisdiction — on an OFAC/sanctions list, or likely linked to a sanctioned entity? Paying or facilitating payment to a sanctioned person can itself be a legal violation.
Business impact and recovery-time objective of remaining offline — and critically, whether any safety-of-life systems (clinical, OT/ICS, emergency services) are involved.
Have you reported to law enforcement (for example the FBI / IC3 in the US, or your national equivalent)? A report can inform the sanctions picture and is often a precondition of insurer cover.
A policy or incident-response retainer usually means the insurer and panel counsel must approve, and often lead, any negotiation. An unapproved payment can void cover.
Breach-notification deadlines (regulators, affected individuals) run regardless of the payment decision and must be met on their own timeline.
Contracts may impose their own notification, cooperation or do-not-pay obligations. Check them before acting.
Why this recommendation
cautionBackups exist but are untested — restore feasibility is unproven. Test a restore before assuming you can recover without paying.
cautionYou have not confirmed whether a free decryptor exists — check No More Ransom before contemplating payment.
cautionExfiltration is unconfirmed — assume data may have left until forensics shows otherwise, and plan breach response in parallel.
legal / procedural gateThe actor’s sanctions status is unconfirmed. OFAC screening of the wallet and actor, led by counsel and your IR firm, is required before any payment is contemplated.
contextDowntime impact is severe and the RTO is slipping — real pressure to pay. That pressure is precisely when a structured, counsel-led decision matters most.
legal / procedural gateLaw enforcement has not been engaged — report before paying; it can inform the sanctions picture and is often a precondition of insurer cover.
Gates before payment can even be considered
Payment is never automatic. Every one of these must be cleared, under counsel, before payment is even on the table — and clearing them is not the same as a recommendation to pay.
- Qualified breach counsel engaged and leading the decision.
- OFAC / sanctions screening of the wallet and actor completed and clear (or an OFAC licence obtained).
- Incident reported to law enforcement.
- Proof of decryption obtained from the attacker before any funds move.
- Exfiltration handled as a breach regardless — any deletion promise treated as unverifiable.
Payment is a last resort — and only after OFAC screening clears and every gate below is met
There is no confirmed clean recovery path, which is the hardest case. Even so, payment is never automatic: it is a last resort, legally gated, and decided by counsel — not by operational pressure. Exhaust restore and decryptor options, meet every gate below, and treat any attacker promise as unverifiable before payment is even discussed.
Not legal advice and not a legal determination. The recommendation is a framework output, never a blanket instruction to pay.
OFAC / sanctions caution
The US Treasury’s Office of Foreign Assets Control (OFAC) has issued advisories on the sanctions risk of ransomware payments (2020, updated 2021). Paying — or facilitating a payment — to a sanctioned person or entity can itself violate US sanctions law, which is strict-liability.
OFAC advisory — https://ofac.treasury.govThis tool flags the risk; it does not and cannot make the legal determination. Counsel must.
Before anything: check for a free decryptor
The No More Ransom project publishes free decryptors for many ransomware strains. Check it before assuming decryption requires payment.
No More Ransom — https://www.nomoreransom.orgSave this decision record
The permalink encodes your answers in the link only (base64url, no server). Share it with counsel, your insurer or the response team.
Pre-payment checklist
If payment is ever contemplated, these run regardless of the recommendation above. Items highlighted in amber are especially pointed given your answers. None of this is legal advice.
Breach counsel leads the decision and preserves privilege. Payment is a legal question before it is a technical one — do not negotiate or pay ahead of legal advice.
Screen the payment address and the identified actor against sanctions lists before any funds move. OFAC liability is strict — "we did not know" is not a defence. Counsel and your IR firm drive this; some cases need an OFAC licence.
If a cyber policy or IR retainer applies, the insurer and panel counsel typically must approve and often lead any negotiation. Acting without them can void cover.
File a report (e.g. FBI / IC3 or your national equivalent) regardless of the payment decision. It can inform the sanctions picture, support later recovery, and is often required by insurers.
Require the actor to decrypt sample files first. A working decryptor is not guaranteed by payment, and recovery via a flawed tool is often slow and partial.
If data was exfiltrated, paying buys only a promise to delete it — one that cannot be verified. Handle the exfiltration as a data breach on its own track (notification, monitoring) whatever you decide about decryption.
Regulatory and contractual notification deadlines run on their own timeline and are not satisfied by paying. Map and meet them in parallel.
A payment (and any facilitation by a financial intermediary) may trigger reporting obligations such as Suspicious Activity Reports. Confirm the compliance treatment with counsel and your finance function before paying.
Reminder: this is decision support, not legal advice, and it makes no legal determination — particularly on sanctions. Engage counsel, your insurer and law enforcement before acting.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.What this tool is
- A free, fully in-browser decision-support aid for a CISO or exec facing a ransom demand. Answer seven questions — restore feasibility, exfiltration, a known free decryptor, sanctions/OFAC exposure, obligations, business impact, and law enforcement — and get a reasoned recommendation, the gates that must be cleared, and a pre-payment checklist. Nothing is uploaded.
- It is decision support, not legal advice, and it never makes a legal determination — the disclaimer is repeated throughout, and the tool never produces a blanket "pay" verdict. Payment is always framed as a conditional, legally gated last resort.
- The one hard legal flag it raises: paying — or facilitating payment — to a sanctioned person or entity can itself violate US sanctions law. OFAC has issued ransomware-payment advisories (2020, updated 2021); the tool links to ofac.treasury.gov and leaves the determination to counsel.
- It points you to the No More Ransom project to check for a free decryptor before anything else, because decryption may not require any payment at all.
- Outputs are shareable: a permalink that encodes your answers in the URL (base64url, no server) and a Markdown decision record you can hand to counsel, the insurer or the response team. No fabricated statistics — only framework and logic.
The decision is legal before it is technical
The instinct under a ransom demand is to treat it as an engineering problem — can we decrypt, how fast, at what cost. But the first real question is a legal one. Paying, or helping to pay, a sanctioned person or entity can itself be a violation of US sanctions law, and OFAC has said so in advisories issued in 2020 and updated in 2021. That liability is strict — not knowing is not a defence — which is why this aid treats a likely sanctions nexus as a stop, not a trade-off, and routes you to screening and counsel rather than offering a verdict it has no business giving. This tool flags the risk; it never makes the determination.
Everything else is leverage. Tested, offline backups and a known free decryptor are what take the attacker's power away, and when you have them the recommendation leans hard toward not paying. Double extortion changes the shape of the problem but not the answer: paying buys an unverifiable promise to delete stolen data, and the leak is a breach you have to handle on its own track whatever you decide about decryption. Even in the worst case — no backups, no decryptor, severe impact — payment stays a last resort that only counsel, with the insurer and law enforcement in the room and every gate cleared, can authorise. That is the whole point of deciding before the pressure, not during it.
Frequently asked questions
Does this tool tell me to pay a ransom?
No. It never returns a blanket recommendation to pay. Payment is always framed as a conditional, legally gated last resort, and the strongest outputs point toward NOT paying — for example when you have tested, offline backups and no evidence of data exfiltration, or when a free decryptor is known. In the hardest case, where there is no confirmed recovery path, the tool still does not say "pay": it says payment can only be considered after counsel is engaged, sanctions screening clears, law enforcement is notified, proof of decryption is obtained, and every other gate is met. The decision is the organisation's to make with qualified counsel; the tool only structures it.
Is this legal advice?
No. This is decision support, not legal advice, and it does not and cannot make a legal determination — especially on sanctions. Ransomware payment decisions carry sanctions, regulatory and contractual exposure, and the right first step is to engage qualified breach counsel, who leads the decision and preserves privilege. Where applicable, your cyber insurer and law enforcement should be involved before any action. The tool repeats this throughout precisely because the stakes are legal before they are technical.
What is the OFAC caution about?
The US Treasury's Office of Foreign Assets Control (OFAC) has issued advisories (2020, updated 2021) on the sanctions risk of facilitating ransomware payments. Paying — or helping to pay — a sanctioned person or entity can itself violate US sanctions law, which is strict-liability: not knowing is not a defence. If the actor, or its jurisdiction, is on a sanctions list or likely linked to a sanctioned entity, the tool treats that as a legal stop before any cost-benefit reasoning and routes you to screening and counsel. It links to ofac.treasury.gov and explicitly leaves the determination to your lawyers.
What goes on the pre-payment checklist?
Engage qualified counsel first; complete OFAC/sanctions screening of the wallet and the identified actor; notify the insurer and incident-response firm (who often must approve and lead any negotiation); report to law enforcement; demand proof of decryption before any funds move; treat any data-deletion promise as unverifiable and handle exfiltration as a breach on its own track; meet regulatory and contractual notification clocks independently; and work through the tax, reporting and Suspicious-Activity-Report considerations with counsel and finance. Items relevant to your specific answers are highlighted.
Does anything I enter leave my browser?
No. The whole tool is client-side React with static data and inline SVG — there are no network calls, no account and no analytics on your inputs. The shareable permalink encodes your answers directly in the URL using base64url, so the link itself carries the state with no server involved, and the Markdown decision record is generated and downloaded locally.
Does it use real statistics about ransomware payments?
No, deliberately. The tool asserts only two external facts, both real: that OFAC has issued ransomware-payment advisories (2020 and updated 2021), and that the No More Ransom project publishes free decryptors. Everything else is framework and logic — it invents no payment rates, recovery percentages or dollar figures, because a decision aid that fabricates numbers would be worse than none.