First, look for signs
Accounts are not always taken over loudly. Possible signs include:
- being unable to sign in with a password that used to work
- security alerts or password-reset messages you did not request
- messages, posts or emails you did not send
- unfamiliar devices or locations in your account activity
- changes to your name, recovery email, phone number or settings
- unexpected purchases or payment notifications
- friends telling you they received strange messages from you
Any of these could have an innocent cause, but they are worth treating seriously. Acting early usually limits the damage, although what can be recovered varies and is not guaranteed.
Steps to take
Work calmly and in roughly this order. The right sequence can depend on the account and what you can still access.
1. Use a device you trust
If you suspect the device you are using may be infected, for example after opening a suspicious attachment, a different and clean device is safer for the following steps. Run a security scan on the affected one and make sure its software is current.
2. Try to regain access through the official route
Go to the service’s own website or app by typing the address yourself, not through a link in a message, and use its “forgot password” or account recovery process. If you can still sign in, change the password immediately.
If the attacker changed your recovery details and you are locked out, the service may have a separate process for proving you own the account. These procedures vary, can take time, and success is not assured.
3. Choose a new password that is strong and unique
Make it long and unlike anything you have used before. Do not modify the old one slightly. A password manager can generate and store it, though you should still protect that tool’s own master password carefully.
4. Change the password anywhere you reused it
If the compromised password was used on other accounts, treat those as at risk too. Start with the most important: email, banking, shopping, work and anything that holds payment details. This is why unique passwords matter so much.
5. Secure your email account early
Email is often the key that resets other accounts. If your email is affected, fix it first. Check for forwarding rules or filters that send copies of your messages elsewhere, a common trick for hiding resets and monitoring you.
6. Turn on or review two-factor authentication
Enable an extra sign-in step if you had none. If you already had one, check whether the methods listed are still yours. See the basics on two-factor authentication for how the common options differ.
7. Check recovery options
Look at the backup email address, phone number, security questions and any recovery codes. Remove anything you do not recognize and update what is out of date. Attackers sometimes add their own details to return later.
8. Review activity and devices
Most services show recent sign-ins and a list of devices. Sign out of all sessions, remove unfamiliar devices and revoke access for apps or services you do not recognize.
9. Look at what the account was connected to
Check saved payment methods, linked accounts, forwarding addresses, recent messages sent, posts, and purchases. Remove stored card details if you are unsure, and consider whether anything else was shared from the account.
10. Tell people who may be affected
Let friends, family and colleagues know quickly, through another channel, that your account was compromised and that they should ignore unusual messages or links from it. If the account was used for work, inform your employer or IT contact promptly. They may have their own procedure.
11. Contact your bank or card provider if money is involved
If payment details were used or exposed, tell the provider, check recent transactions, and ask what protections or replacement steps apply. If identity documents or other sensitive details were exposed, look into the identity-protection options available where you live.
12. Report it
Report the compromise to the service. If you were the target of a scam or fraud, you may also report it to the relevant consumer or fraud authority in your country. Keep screenshots and dates.
Work out how it happened
Try to identify the cause so it does not repeat. Common causes include a reused password exposed in another breach, a phishing message, malware, or an unlocked device. Knowing the likely route helps you decide what to change. If you clicked something suspicious, the clues described in phishing emails may help you recognize the pattern next time.
Preventing a repeat
- Use unique passwords, ideally with a password manager.
- Keep devices, browsers and apps up to date; installing software updates promptly closes known weaknesses.
- Turn on two-factor authentication for important accounts.
- Review account recovery details once or twice a year.
- Keep file backups of important data so that losing access to one service or device is not catastrophic.
- Be careful about what you share publicly, because details can be used for guesswork and impersonation.
Be kind to yourself
Account takeovers happen to careful people, often through breaches at companies they have no control over. What matters most is acting quickly, working through the steps in order, and then tightening the habits that you can control.