The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Assume any password or verification code you entered on a suspicious page, or gave to an unsolicited caller, is exposed. From a trusted device, change that password and every account where you reused it, starting with email. Then recover any locked account through the provider’s official site, end other sessions, enable the strongest available multi-factor method, inspect recovery settings and activity, and contact your bank, carrier, or identity-theft service if money, identity data, or your phone number was involved.
Do these things first
Work through this sequence in order. Use a device and internet connection you trust; if the incident included an attachment, an installed app, remote-control software, or a request to change device settings, handle the device check before trusting it with new passwords.
As an Amazon Associate I earn from qualifying purchases.
- Move to a trusted device. If possible, use another computer or phone that was not involved in the scam. Do not continue signing in through links, phone numbers, or chat handles supplied by the suspicious message or caller.
- Check the device that may have been exposed. Update its security software, run a scan, and remove anything the scan identifies. If you suspect malware, clear it before changing passwords on that device.
- Change the exposed password. Create a new password that has never been used on another service. Change the same old password anywhere else it was reused.
- Protect email early. An inbox can receive password-reset links for many other accounts. Secure the email account, then review its forwarding rules, filters, recovery methods, and recent sign-ins.
- Recover accounts you cannot open. Type the provider’s web address yourself or use its official app. Follow its account-recovery process; do not use a recovery number or link supplied in the scam.
- Cut off existing access. Sign out of all devices or remove sessions you do not recognize. Turn on multi-factor authentication (MFA), preferably a passkey, authenticator app, or security key when the service supports one.
- Contain non-account damage. Contact the bank or card issuer if payment data was exposed, the mobile carrier if your number was taken over, and IdentityTheft.gov if Social Security or other identity information was involved. Report the scam and warn contacts after you have started recovery.
Changing a password alone does not remove an attacker who already has a session, a new recovery method, a forwarding rule, or a device token. The later checks in this guide close those routes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use the right response for what the scammer obtained
| What you disclosed or allowed | Immediate priority | Additional check |
|---|---|---|
| Password | Change it on that service and every account where it was reused. | End other sessions and inspect security activity. |
| One-time verification code | Treat the account as potentially accessed; use the provider’s official recovery route. | Change authentication and recovery methods, then revoke sessions. |
| Email access | Recover and secure the inbox before less critical accounts. | Look for forwarding, filters, sent mail, deleted mail, and password resets. |
| Bank, card, payment-app, or saved-payment details | Call the institution through a known number or its official app/site. | Report unauthorized activity and ask what account or card protections are needed. |
| Mobile number or SIM control | Contact the carrier and regain control of the number. | Reset passwords and inspect financial accounts for changes. |
| Identity information | Use the recovery plan at IdentityTheft.gov. | Follow the plan’s steps for reports, freezes, or replacement documents that apply to your case. |
| Attachment, app, or remote access | Scan and clean the device; use another trusted device for account changes. | Ask the device maker or a company you already know and trust for help if the scan finds a threat. |
Step 1: Make sure the device is safe enough for recovery
A stolen password is one problem; a compromised device can capture every new password you type. This distinction matters when a scam asked you to install an attachment, mobile app, browser extension, remote-access tool, or “security” utility, or when the caller controlled your screen.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you only entered information in a browser
Use a different, updated device for the password changes if you can. On the original device, install current security updates and run the built-in security scan. Remove software the scan flags. Do not install a cleaner or support tool recommended by the same caller.
If software or remote access was installed
- Disconnect the affected device from the internet if you need to stop an active remote session.
- From a trusted device, change the important passwords, beginning with email.
- On the affected device, update security software and run a full scan.
- Remove detected threats and uninstall the remote-access program or app you did not intentionally choose.
- If you cannot verify that the device is clean, have the manufacturer or a known, trusted technician guide the cleanup before using it for sensitive sign-ins.
Do not assume a factory reset is necessary in every case, and do not assume it is unnecessary. The appropriate remedy depends on the device, the software installed, and what the security scan finds.
Step 2: Replace exposed passwords and remove reuse
Sign in by typing the service’s address yourself or opening its official app. Set a unique password that is not a variation of the old one. If you used the exposed password on several services, change all of them, even when you have no evidence that each account was opened.
Secure email before accounts that depend on it
Prioritize the inbox used for password resets. After changing its password, inspect recent sign-ins and account-security events. Confirm that the recovery email address and phone number belong to you. Later, check forwarding rules and filters because an intruder can silently redirect reset messages while leaving normal mail visible.
Find reuse you may have forgotten
Check your password manager, browser-saved passwords, or a private list of services you use. Google’s account-security guidance specifically calls out accounts that share the password, accounts that contact you through the compromised email, and services where that email is used as a sign-in or has saved passwords. Change high-impact accounts first: email, banking, shopping, cloud storage, work systems, and social accounts.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Store the replacement safely
A password manager can generate and store unique passwords, but it is optional for recovery. If you use one, protect its master account with MFA and keep its recovery information under your control. Never send a password or recovery code to a person who contacted you unexpectedly.
Step 3: Recover an account you can no longer open
Go to the provider’s official recovery page by typing the address, using a bookmark you created before the incident, or opening the provider’s official app. Provider identity checks and available recovery methods vary by account type, country, and device, so a procedure that works for one service may not work for another.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches- Start from the provider’s own sign-in or help page, not a link in the suspicious message.
- Use the recovery email address, phone number, authenticator, passkey, or backup code that you still control.
- Complete the provider’s identity checks accurately. Avoid repeatedly guessing if the service warns that attempts are limited.
- If the first route fails, use the provider’s documented alternative or support channel. Independently verify any phone number before calling.
- Once access is restored, change the password, revoke other sessions, replace unfamiliar recovery methods, and review activity before resuming normal use.
Recovery instructions cannot guarantee that every account will be returned. A scammer may have replaced recovery details or deleted data, and each provider decides which evidence it accepts.
Step 4: End other sessions and choose stronger sign-in protection
Use the account’s security or device-management page to sign out everywhere, or remove each unfamiliar session. Revoke third-party apps and tokens you do not recognize. Then enroll in MFA and save recovery codes somewhere the attacker cannot reach.
| Method | Phishing resistance and practical notes | Recovery considerations |
|---|---|---|
| Security key | FTC describes security keys as the strongest two-factor method it discusses because they do not use credentials that hackers can steal. Google also calls them its most secure 2-Step Verification option. | You need a compatible service and a spare key or another recovery method in case the key is lost. |
| Passkey | Google says passkeys are more resistant to phishing than passwords and cannot be shared, copied, written down, or accidentally given to someone else. | Availability depends on the provider and device ecosystem. Keep an alternate recovery route that you control. |
| Authenticator app | A practical stronger option where the provider supports time-based codes or approvals in an authenticator app. | Plan how you will restore the app if the phone is lost or replaced; store the provider’s backup codes securely. |
| SMS code | Better than password-only sign-in, but vulnerable to phone-number takeover and interception. Use a stronger available method when possible. | Keep the mobile account protected and maintain another recovery method. |
Not every service supports every method. Choose the strongest option that the service offers and that you can realistically recover if a phone, key, or device is lost. Never read a verification code to an unsolicited caller or type it into a page opened from an unexpected message.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 5: Look for changes that let an intruder persist
After you regain access, inspect the account rather than assuming the attacker left when the password changed. Work through the account’s security, privacy, and connected-app pages.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Confirm recovery email addresses, phone numbers, and backup methods.
- Remove unfamiliar devices, browsers, sessions, apps, integrations, and access tokens.
- Review recent security events, password changes, new MFA enrollments, and sign-in locations.
- For email, inspect forwarding rules, filters, delegates, automatic replies, sent mail, drafts, and deleted mail.
- For social accounts, check posts, direct messages, new contacts, profile details, and linked applications.
- For cloud storage, review shared files, public links, and newly created accounts or folders.
- For shopping and payment services, verify saved addresses, payment instruments, orders, and notification settings.
Record unfamiliar changes with screenshots or dates before removing them if you may need evidence for a bank, provider, employer, or law-enforcement report. Tell contacts if messages, money requests, or links were sent in your name so they do not trust the impersonation.
Step 6: Contain financial, phone, and identity exposure
Bank, card, and payment details
Contact the bank, card issuer, or payment service through a phone number printed on a card, a statement you already possess, or the institution’s official app or website. Report unauthorized transactions, ask what account protections or replacement credentials are appropriate, and follow its dispute process. Change any password that was exposed or reused; a card replacement does not secure an account login.
Mobile-number takeover
If a scammer transferred your number, changed the SIM, or persuaded the carrier to alter the account, contact the carrier immediately through a verified channel and regain control. Once the number is back, reset passwords, review MFA and recovery settings, and inspect financial accounts for changes or unauthorized activity. Consider moving critical accounts from SMS codes to a passkey, security key, or authenticator app where supported.
Identity information
If Social Security information or other identity documents were exposed, use the tailored recovery plan at IdentityTheft.gov. Follow the plan for the type of information involved; the appropriate reporting, account freeze, or replacement step differs by situation.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 7: Report the scam and protect other people
Report the phishing message to the service that was impersonated and report a U.S. scam through the FTC’s ReportFraud.gov pathway. Preserve the original message, sender details, web address, screenshots, transaction records, and dates without opening the suspicious links again.
Reporting helps institutions identify campaigns, but it does not restore access by itself. Recovery, session revocation, device cleanup, and financial containment must happen separately. If an intruder used your account to contact people, tell those contacts which messages were fraudulent and ask them not to click links or send money.
Common situations and the correct next move
“I gave a scammer my password.”
Change it immediately on that service and everywhere it was reused. Secure email early, end other sessions, and enable MFA. If sign-in fails, use the provider’s official recovery process rather than replying to the scammer.
“I gave them a verification code.”
Assume the account may have been accessed even if you still receive mail normally. Use official recovery, change the password, revoke sessions, and inspect MFA and recovery methods. Do not provide another code to anyone who contacts you unexpectedly.
“I cannot get into my email.”
Use the email provider’s official recovery path. After access returns, secure the inbox before other services and check forwarding, filters, recovery details, and sent or deleted mail for signs of persistence.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“They got my bank or card details.”
Contact the institution through a known channel, report unauthorized activity, and ask how it wants the account or card secured. Also change exposed or reused passwords.
“They took over my phone number.”
Have the carrier restore control first. Then reset passwords, replace compromised MFA methods, and check financial accounts for changes.
“I installed something or gave remote access.”
Use a trusted device for account recovery, update security software, scan the affected device, remove detected threats, and obtain help from the manufacturer or a company you already know and trust if the device cannot be verified as clean.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →After the emergency: harden the accounts you recovered
- Use a different, unique password for every important service.
- Enroll the strongest MFA method each provider supports, with a backup recovery plan.
- Keep recovery codes offline or in a protected vault; do not store them where a compromised inbox is the only way to reach them.
- Review account-security alerts and sign-in notifications so an unexpected change is visible quickly.
- Keep operating systems, browsers, apps, and security software updated.
- Verify unexpected requests through a second channel you find independently. A familiar name, logo, caller ID, or profile photo is not proof of identity.
When to get specialized help
Contact the relevant bank, carrier, provider, employer security team, or identity-theft service when the incident involves money, identity documents, a work account, a hijacked number, or an account you cannot recover through documented steps. Use contact details you obtain independently. If threats, extortion, or significant financial loss are involved, preserve evidence and contact the appropriate local authorities. No support representative should require you to disclose a password or a one-time code.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
