If an account was breached, first regain access through the provider’s official recovery process. Then change its password, sign out unfamiliar devices or sessions, turn on multi-factor authentication (MFA), and check for settings the intruder may have changed. If you cannot sign in, use the provider’s recovery flow instead of trying to secure the account from an active session you no longer control.
1. Recover access safely
Go directly to the service’s official website or app and follow its account-recovery instructions. The Federal Trade Commission’s recovery guidance links to resources for major services; Google and Microsoft also provide compromised-account steps.
As an Amazon Associate I earn from qualifying purchases.
Do not use a recovery link in an unsolicited email or message. Open the provider’s site or app yourself. If you suspect the computer or phone you use is infected, update its security software and run a full scan before changing the password. The FTC advises scanning before account recovery, and Microsoft specifically recommends a full malware scan before a password change when a device may be compromised.
Recommended Free Tools
2. Change the password—and any reused copies
Once you can sign in, set a new, unique password for the breached account. The FTC’s October 2024 guidance suggests aiming for 12 to 15 characters or using a passphrase; this is a practical target from that alert, not a universal technical requirement. The FTC puts the core instruction plainly: “Change your account password. Create a unique and strong password that is hard to guess.” (FTC, October 2024.)
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not reuse the exposed password. If you used it on other services, change those passwords too, starting with your email account. Email can receive password-reset links for other services, so an attacker who still controls it may be able to regain access elsewhere. A password manager can help you keep distinct passwords without having to memorize each one.
3. Sign out other devices and sessions
In the account’s security settings, review signed-in devices or active sessions. Sign out anything you do not recognize; if the service offers a global option such as “sign out everywhere,” use it when you need to end other sessions at once.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The controls and timing differ by provider. Google’s device and session guidance notes that one device can show multiple sessions. A session time can also reflect background communication, so examine the device and session details rather than treating every unfamiliar timestamp as proof of an intruder. Microsoft’s “sign out everywhere” action can take up to 24 hours and does not sign out Xbox consoles. Do not assume a global sign-out is instant or covers every device.
4. Turn on MFA
Enable MFA—also called two-factor authentication or 2FA—in the account’s security settings. It requires an additional verification method when signing in, so a password alone is not enough. Choose the strongest method the service supports that you can reliably access.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Method | What to consider |
|---|---|
| Security key or physical token | The FTC calls security keys the strongest of the methods it discusses. Check that your account and devices support the key before choosing one; support varies. |
| Authenticator app | The FTC says an authenticator app is safer than text or email codes when those are the only alternatives. Make sure you can keep access to the app and its recovery method. |
| Text or email code | Use this if it is the available option, but the FTC rates an authenticator app as safer than codes by text or email when those are the only choices. |
These comparisons reflect FTC consumer guidance; they do not mean every service offers every method. CISA also describes a secure physical token as an MFA option in its MFA tip sheet.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Check for changes the intruder may have left behind
Changing the password and ending sessions may not undo settings or activity changed during the breach. Review the account for unfamiliar changes, remove anything you did not make, and look for misuse:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Check recovery email addresses and phone numbers. Replace unfamiliar details with your own.
- For email, inspect forwarding rules and sent and deleted folders for messages or settings you did not create.
- For social accounts, check recent messages, posts, and contacts for activity you do not recognize.
- If the account may have sent messages, warn contacts not to click links or respond to requests for money that appear to come from you.
After you finish, confirm that the recovery details and MFA method you expect are still attached to the account.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
