If you suspect an account has been compromised, open the service through its official app or by typing its known website address—not through a link in an unexpected alert. If you can still sign in, change the password, revoke other sessions, and check recovery settings. If you are locked out, use the provider’s official recovery process. Then secure the email account used for password resets and check for unauthorized activity.
1. Verify the warning safely
An unexpected login alert is a reason to check, not proof by itself that someone accessed your account. Possible warning signs include being unable to sign in, password or recovery-detail changes you did not make, unfamiliar logins, messages you did not send, changed security settings, or purchases and transfers you do not recognize. The FTC’s hacked-account guidance and the UK National Cyber Security Centre’s account-recovery guidance describe these kinds of indicators.
As an Amazon Associate I earn from qualifying purchases.
Do not use a link or phone number in an unsolicited message to investigate. Open the service using its known app or address and check alerts and recent activity there. Messages about a data breach can also be used in scams; the UK NCSC advises caution in its guidance for individuals on data breaches.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Choose the right recovery path
| Situation | What to do |
|---|---|
| You can still sign in | Use the service’s official settings to change the password, sign out other devices or sessions, and review recovery details and connected access. |
| You are locked out | Start the provider’s official account-recovery process from its website or app. Follow its instructions and continue through official support if recovery does not work. |
| It is a work-managed account or device | Contact your employer’s IT or security team promptly; organizational response procedures may apply. |
Account-recovery steps differ by provider, so no generic sequence can guarantee access will be restored. The UK NCSC’s guidance on recovering a hacked account or service explains why the service’s own process matters.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. If you can still access the account
- Change the password. Use the provider’s official app or website. Choose a strong password you have not used on another account.
- End other access. Use the option to sign out all devices or sessions. Review devices and apps connected to the account, and remove ones you do not recognize where the service allows it.
- Check recovery details. Confirm that recovery email addresses and phone numbers belong to you and that you can access them. Remove unfamiliar details if possible.
- Turn on two-factor authentication. Enable the provider’s available two-factor authentication (2FA), also called two-step verification. You may need to finish reviewing the account before this option is available.
A password change alone may not remove access that is already active on another device or through a connected app. That is why ending sessions and reviewing connected access are separate steps. The FTC recovery checklist covers password changes, signing out, 2FA, and recovery contacts.
4. Secure the email account used for recovery
Your email account may receive password-reset messages for other services, so treat it as a priority if it is exposed or connected to the affected account.
- Change its password if it may have been exposed, and replace that password anywhere else you reused it.
- Check that its recovery phone numbers and email addresses are yours.
- Inspect filters and forwarding rules for ones you did not create. An unauthorized forwarding rule can send copies of password-reset messages elsewhere.
- Review recent sign-ins, devices, and connected apps, and end or remove access you do not recognize where possible.
The UK NCSC’s guidance on hacked accounts and recovery guidance specifically advise checking email forwarding and changing reused passwords.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
5. Change reused passwords on other accounts
If you used the affected password anywhere else, change it on every account where it was reused. An exposed password can put multiple services at risk. Prioritize the email account that receives resets, financial accounts, work accounts, and other important accounts. Give each one a different password. The FTC also advises changing reused passwords in its guidance on what to do after a scam.
6. Look for unauthorized activity and warn others
Review the account’s recent sign-ins, security and recovery settings, sent messages, linked devices and apps, and transactions. Remove unfamiliar access where the provider permits it, and notify the provider of activity you did not authorize.
If the account sent suspicious messages to your contacts, tell them through another channel. In particular, warn them not to follow links or respond to requests for money that appear to come from you. The FTC’s recovery guidance includes checking account activity and notifying contacts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Take extra steps if a device, work account, or money is involved
If you entered a password on a suspicious page
Change that password through the real service and change every other account where you reused it. Do not return to the page through the message that led you there.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you downloaded or installed software
Update your security software and run a scan. The UK NCSC’s phishing guidance covers actions to take after clicking, entering details, or installing software.
If a work device or account is involved
Contact your organization’s IT or security team and follow its instructions. Avoid treating a work-managed account like a personal one: the organization may need to manage access and investigate centrally.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
If there are unauthorized payments or transfers
Contact your bank or payment provider promptly using the official contact route from its app, card, statement, or known website. Do not rely on a number in a suspicious message. An unverified alert is not the same as confirmed fraudulent activity; check the account or contact the provider through an official route.
8. Strengthen protection after recovery
Enable the strongest multi-factor authentication (MFA) option the provider offers and that your devices support. MFA requires another authentication step in addition to a password; CISA describes it as a layered approach to securing online accounts and their data.
Free tools Windows power users keep installed
One-click scans. No signup required.
A physical security key is one optional MFA method for services and devices that support it. Check compatibility before choosing one. It does not replace recovering the account, changing exposed passwords, or revoking existing sessions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
