Suspected account compromise: contain, recover and revoke persistent access

If an account may have been taken over, change the password from a device you trust, sign out other sessions, and review recovery methods and forwarding rules. Changing the password is not enough on its own. You also need to look at the second factor, connected apps, and accounts that depend on this one.

Create and store the new password in a password manager. If malware or a fake page may be involved, read malware and phishing first so you do not set a new password on an infected device. Details of the second factor and backup codes are in two-factor authentication.

Take the signs seriously, but do not treat them all as one thing

Some signs are almost certain: a sign-in alert from a place you were not, a password that no longer works, mail or a post you did not send, or a second factor that suddenly changed. Other signs are vaguer: mail landing in spam, delayed notifications, or an unfamiliar name in the session list. Vague means you should look, not that you should immediately burn down your whole digital life, and not that you should ignore it.

• A sign-in or sign-in attempt that was not you.
• A password, recovery address or phone number changed without you doing it.
• Messages in Sent that you do not recognise.
• A filter or forward that sends mail somewhere else or hides it.
• A connected app or site you did not authorise.
• Contacts telling you they received a strange message from you.

If you only saw one sign-in alert and you had just signed in yourself on a new network, match that first. If doubt remains, go in through the official security path for that account and work through containment; the cost of that is usually lower than waiting.

Work from a healthy device

If the phone or computer may have malware, changing the password on that same device may hand the new password to the same program. Use another device you trust, or at least a private browser window after an official scan and after removing a suspicious app. If you have no healthy device at all, clean the one you have as far as the malware guide allows, then go to the account.

1. Type the service address yourself or open it from a bookmark, not from a link in an alert message.
2. If the page asks for anything other than the familiar sign-in path, stop there.
3. Write down or store the password somewhere safe so you are not locked out halfway through.

Contain, then recover

The order matters. First you close the way others are getting in, then you bring the account back under your control, then you look at the circle of damage. If you change the password but leave sessions open, someone who is already inside may stay. If you only close sessions and keep the old password, they can sign in again with it.

1. Sign in from the official security page. If the current password still works, change it at once to a long, unique one.
2. If the password does not work, use that service’s official recovery: a backup email, a number, stored codes or a passkey. Do not open a recovery link from a suspicious message.
3. Sign out every active session and device except the one you are using right now.
4. Review the second factor: numbers, authenticator apps, security keys and backup codes. Remove any method you do not recognise and create a fresh one if you need to.
5. Check that the recovery email and phone number are actually yours.

Sessions, devices and connected apps

Many services list devices or open sessions. Any name, city or time that was not you should be removed. Beyond that, apps connected to the account — sign-in with Google, extensions, an old mail app, an app password — can keep a door open even after the password changes.

1. In a Google account, open Security and look at Your devices and recent security activity.
2. Review apps that have access to the account and remove any access you do not recognise.
3. In Gmail, go to Settings > See all settings and open the sections for forwarding, filters and automatic replies.
4. If you see an unfamiliar “app password” or IMAP access, revoke it.
5. On Apple, Microsoft and social accounts, find the same three places: devices, connected apps, and recovery methods.

Mail forwarding and filters that hide messages

One of the most persistent ways to stay inside a mail account is a rule that forwards a copy of every message to the attacker, or that files security mail into a hidden folder. After you get back into the account, do not skip this section even if you are in a hurry.

1. Read the forwarding list and delete any address that is not yours.
2. Look at filters one by one: rules that delete mail, remove its star or send it to a folder out of sight are suspicious, especially if they were built around words such as security, password or verification.
3. Check automatic replies and the signature as well; sometimes a deceptive link is placed in the signature.
4. Search spam and trash for security messages from the last few days.

Rebuild the second factor if you need to

If someone had access to your SMS or authenticator as well as the password, they may have added a new method in their own name. Look at every method on the two-step verification page.

1. Remove a number you do not recognise.
2. Connect the authenticator app again on a healthy device and generate fresh backup codes.
3. Keep a security key if it is yours, and remove any entry in the list that you do not have.
4. Delete a passkey that was created on an unknown device.
5. Treat old backup codes as spent and store a fresh set somewhere offline.

If your phone number may have reached someone else, lean on an authenticator or a security key as far as the service allows, and talk to the operator about whether the SIM is locked to you. How to choose a method is in the two-factor guide.

Review dependent accounts in the same pass

Primary mail is usually the key to everything else. Once that mailbox is taken over, recovery for social networks, shops, cloud storage and even a bank may go to the same inbox. After you harden the main account:

1. Write down the accounts that recover through that same mail or number.
2. Change their passwords too from a healthy device, starting with anything that holds money, identity or a large contact list.
3. See which of them have sent “new sign-in” or “password changed” messages to your inbox, and whether those events were you.
4. If you open an account with “Sign in with Google” or a similar method, review that app access in the parent account as well.

After you are back, close the circle

Technical containment is only half the work. You still need to see how the account was used and who should be told.

1. Search Sent, Drafts and Trash for messages you did not write.
2. If a deceptive message went to your contacts, tell them briefly not to follow the link and to let you know if they typed anything.
3. On social networks, review posts, the bio, links and newly followed accounts.
4. Review newly created or newly shared cloud files.
5. If a payment method was stored, check bank and shop activity on the official path, not from a link in an email.
6. Estimate when the signs started so you know which messages and files in that window are suspicious.

A Google account

1. Open your Google account and go to Security.
2. Review recent security activity and devices, and remove anything unknown.
3. Check two-step verification, numbers and authenticator apps.
4. Open apps with access to the account and remove access you do not need.
5. In Gmail, review forwarding, filters, automatic replies and connected accounts.
6. If you cannot get into the account, use Google’s official recovery flow and do not trust a separate message that offers help through a link.

An Apple Account

1. From a device you still trust, go to Settings > [your name], or sign in on the official Apple Account page.
2. Look at the device list and remove any device that is not yours from the account.
3. Change the Apple Account password and review two-factor authentication.
4. Review trusted numbers and recovery keys.
5. Look at recent purchases, subscriptions and iCloud files for unknown activity.

Microsoft accounts and social networks

The logic is the same: a new password, signing out every session, reviewing the second factor, connected apps and recovery methods. In a Microsoft account, open the security or sign-in area and look at devices and activity. Facebook, Instagram, X and similar services usually have a security or sessions page that shows active devices and recent sign-ins. Change or remove connected apps and contact addresses there as well.

When you cannot get into the account

If the password has been changed and the second factor is no longer yours, use only that service’s official recovery. The more information already on the account — creation date, earlier devices, familiar contacts — the better your chance of getting it back. Do not take help from someone who messages you claiming to be support and offering to restore the account for a fee or after you install an app.

1. Open the official “forgot password” page directly.
2. If recovery mail goes to another inbox you still control, continue from there and harden that inbox too.
3. Enter backup codes if you have them on paper.
4. If no path remains, contact official support from inside that company’s own site or app, not from a number at the top of search adverts.

What you do not need to change without a reason after recovery

Changing every username at once and closing every low-importance account is usually unnecessary and makes you lose your place. Priority goes to the account that unlocks the others, then to accounts with money or many contacts, then to the rest. Reused passwords must be changed; a unique password that lived only on one low-importance account is a lower priority, but if that same password was used anywhere else it has to change.

What to tell other people

If your account was used to deceive people, a short note is better than silence. You do not need unnecessary detail. Say that the account was out of your control for a while, that a message asking for money or a link was not from you, and that they should not follow that link. At work, report it through that workplace’s process so security staff can block a domain or warn other people.

Common mistakes

• Changing the password on the same device that is still suspicious.
• Ignoring sessions and connected apps after you change the password.
• Skipping mail forwarding and filters.
• Leaving an unknown number or authenticator in the second-factor list.
• Forgetting accounts that recover through the same mailbox.
• Clicking a “we will restore your account” message that arrives right after the incident.

A timeline for the first hour

If you have just learned that someone else has the account, the first hour can look like this. You do not have to do every step perfectly; what matters is closing an open door early.

1. From a healthy device, go to the official security page, not to a link in a message.
2. Change the password, or start recovery if you cannot sign in.
3. Sign out other sessions and devices.
4. Look at the second factor and recovery methods and remove anything unknown.
5. Check forwarding and connected apps in that same first session, even if you leave a full search of Sent until later.
6. If the account holds money or identity, check activity the same day in the official app.

Writing down the time and what you did on paper helps you avoid doing something twice or skipping it, especially when you are hardening several accounts in a row.

SMS sign-in, SIMs and a recycled number

If your two-step method is SMS and the signs arrived together with a sudden loss of the number or delayed texts, the problem may be the number itself, not only the password. In that case, changing the password without changing the second method is not enough.

1. Contact the operator on its official path and ask whether a new SIM was issued in your name or a transfer took place.
2. As soon as you are back in the account, strengthen or replace SMS with an authenticator or a security key.
3. Check the recovery number on every important account so it has not suddenly changed.
4. If you have lost the number for good, use any other recovery methods you still have before the service’s waiting period runs out.

Passkeys and browser sessions

A passkey is stored on the device where you created it. If the account lists a passkey on a device that is not yours, delete it. On the other hand, a passkey on your own device can be your way back in after a takeover; do not delete it without a reason unless that device has also left your trust. A saved browser session is a lasting sign-in as well: on a shared computer, sign out when you finish so you do not undo your own containment.

Work accounts and personal accounts

If a work account is involved, tell that organisation’s administrators as well as doing what you can yourself. They may be able to close sessions from the server side, preserve mail or lock the account for a while. Do not move internal documents off a suspicious device again. If a personal account was open on the same work computer, harden that too in the same pass, and the other way around. Mixing the two after an incident widens the circle.

When you only have one of several signs

A single recorded failed sign-in, or an alert you later realise was you, is not a reason to reset your whole life. Still, open that one sign in the security page and see whether its details match what you remember: the time, the approximate city, the device type. If they do not match, continue containment at least as far as closing sessions and reviewing the second factor. If they do match, still glance at mail forwarding; it is quick and sometimes shows something unexpected. That is the difference between a proportionate response and panic: looking is always useful, burning everything is only sometimes necessary.

Look again after a few days

Some changes show up late: a filter that hides only certain messages, a connected app that pulls data once a week, or another sign-in after you changed the password but missed a recovery method. Two or three days later, visit the device list, connected apps and filters again. If something new has returned, assume a door is still open and close that door, rather than only changing the password a third time.

Identity documents and the service’s own recovery

Some services ask for identity documents or a video to restore a very old or very important account. Do that only in the official flow inside that same site or app. Do not send a document to someone who contacts you in a messenger claiming to be support. If a service has no such flow, do not trust someone who claims they can restore the account “from the inside” for a fee.

If the account does not come back

Sometimes recovery fails: the backup mailbox is gone too, the number has changed and there are no stored codes. In that case:

1. If other devices are still signed into that account, use them to start a recovery request or to save what you can; then remove those devices from the account.
2. Harden dependent accounts as above and change their recovery address to a new mailbox you control.
3. Tell important contacts that the identifier is no longer yours, so they are not fooled by a later message.
4. If that account was used for work or a public service, say so on another channel that is still yours.
5. Set up the new account you create with a unique password, a strong second factor and stored backup codes from the first day, so the same failure is not repeated.

Create the new password properly

The new password should not resemble the old one, should not be the same familiar pattern with one digit changed, and should not be a password you still use somewhere else. The best approach is to create it in a password manager so that it is long and you are not tempted to reuse it. If you cannot reach the manager in the middle of recovery, write a long phrase on paper and move it into the vault as soon as things are calmer, then keep the paper somewhere safe. Do not send the new password in a message to yourself or to fake support.

What does not have to be solved in the first hour

Changing a profile photo, rereading years of mail, or creating a new account alongside one you have just recovered can usually wait. First the door is closed, then the circle of damage is reviewed, then the habits that would let it happen again are fixed: a reused password, SMS as the only second factor, no bookmark for the sign-in page. If you are exhausted, write down what remains and continue tomorrow; stopping in the middle without a note makes it easy to believe the next day that everything is finished.

Write down what you saw

Note the times of alerts, the names of unknown devices, addresses you saw in forwarding, and messages sent without your permission. If you later talk to official support or to a bank, those details help. Do not keep this note only inside the damaged account itself; put it on paper or somewhere else you control. You do not need a literary report; a few lines with times and facts are enough.

Connect this incident to the next habit

After the account is back, ask yourself once where the door opened: a reused password, SMS, a fake page, an unlocked device, or an old connected app. Fix that one cause the same week so the guide is not only the memory of a crisis. If you cannot find the cause, at least remove leftover reused passwords and weak second factors on the main accounts. A takeover usually repeats through the same previous hole, not through some new unknown tool.

What to do from today

1. If you see a sign, open the official security page from a healthy device.
2. Change the password, close sessions and review the second factor.
3. Check mail forwarding, filters and connected apps.
4. Harden dependent accounts in the same pass.
5. Search Sent and, if needed, tell your contacts.