Start here: protect money and your main email
Unexpected sign-ins, changed recovery contacts, missing messages or friends receiving requests from your account can indicate compromise. Open the service directly to check; a security alert itself may be phishing. If money is at risk, contact your bank or mobile-money provider immediately. If your number unexpectedly loses service, ask your mobile operator to investigate an unauthorised SIM replacement.
For a work account, tell your IT or security team before making changes that could disrupt its response. Use a trusted device and a safe communication channel. If the account is being monitored by an abusive person, consider your safety before changes that may alert them.
Step 1: regain access through the provider
If you can sign in: open security settings directly, set a new unique password and review recent activity. Do not follow links supplied by someone offering recovery assistance.
If you are locked out: use the provider's official recovery or hacked-account process. Use a previously trusted device if it is safe and the provider recommends it. Complete identity checks only inside that verified process.
If recovery details were changed: look for genuine change notifications through the service's help centre and follow its reversal instructions. Keep support case numbers. Do not pay a stranger to bypass the provider's checks.
Step 2: remove the attacker's ways back in
A password change alone may leave existing sessions or connected apps active. Review each of these settings; names vary by service.
Sign out other sessions and revoke unfamiliar devices, app passwords, connected applications and access tokens.
Remove recovery email addresses, phone numbers, passkeys or authentication methods you do not recognise. Add a method you control and save fresh recovery codes privately.
Check email forwarding, filters, delegated access, sent items and deleted messages. An attacker may hide alerts or intercept future password resets.
Review payment details, advertising accounts, administrator roles and recent posts. For business email, have IT review mailbox permissions and logs.
Step 3: secure related accounts and devices
Protect the email account that resets your other passwords first, then financial accounts and any service that reused the exposed password. Enable a passkey or strong multi-factor authentication where supported. Check your password manager and the account that synchronises credentials.
If you installed remote-access software or suspect malware, stop using that device for sensitive activity and arrange a security check or trusted rebuild. Update supported software. Change exposed credentials from a clean device after containment, and revoke sessions again if new activity appears.
Step 4: preserve evidence and warn affected people
Save the account name, suspicious activity times, change notifications, fraudulent message links and provider references. Warn contacts through a separate channel if the attacker asked them for money. For business payment changes, call affected customers or suppliers using known numbers and ask them to verify pending transactions.
Use incident reporting guidance and the current contact channels. Check the form's intake notice before submitting: a preview form does not lodge an operational report. Never include a password, PIN or recovery code. If identity documents were accessed, also follow the identity theft playbook.
Recovery check: stay in control
You can sign in and use a recovery method you control.
Unfamiliar sessions, recovery methods and forwarding rules are removed.
Linked accounts and recent payments have been checked, and your device is trusted.
You are watching for fresh alerts over the following days and have kept the case references.
For prevention, see MFA and passkeys and passwords and password managers.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.