Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIf you are still signed in, secure the account immediately: change its password, end other sessions, turn on two-factor authentication, and check that recovery details are yours. If you cannot sign in, stop trying random links and use the provider’s official recovery page. When malware may be involved, scan and clean the device with updated, trusted security software before changing credentials, following the provider’s instructions.
An account takeover can expose password-reset messages, private conversations, contacts, payment details, and identity information. Work through the steps below in order, keeping the official account-help pages open in your browser or provider app rather than using links sent in unexpected messages.
As an Amazon Associate I earn from qualifying purchases.
First, identify what changed
Treat these events as warning signs that need investigation, not automatic proof that a takeover succeeded:
- You cannot log in, or a password you know is correct no longer works.
- You receive a notice about a password, email address, phone number, or other account change you did not make.
- Your security page shows an unfamiliar sign-in, device, location, or login attempt.
- A password-reset message arrives when you did not request one.
- Friends, family, or followers receive messages, posts, or requests you did not send.
The Federal Trade Commission (FTC) lists these indicators in its recovery guidance and October 2024 consumer alert. An unfamiliar login attempt can be blocked without a successful takeover, so verify the account’s security history before drawing conclusions. FTC recovery guidance and the FTC October 2024 alert explain the warning signs.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose the correct path: still signed in or locked out
If you still have access
Do not sign out until you know you can regain access. Open the account’s security settings from the provider’s official app or by typing the provider’s address yourself. Change the password, sign out other devices, enable two-factor authentication (2FA), and verify the recovery email address and phone number. Then inspect the account for forwarding, filters, connected apps, messages, posts, and other changes.
If you are locked out
Use the provider’s official “account recovery,” “sign-in helper,” or equivalent flow. Do not pay an unsolicited “recovery expert,” call a number in a suspicious message, or submit credentials to a look-alike website. Recovery options and interfaces differ, and a provider may not be able to restore every account or offer a human agent.
Google directs people who cannot sign in or whose account information was changed to its official account-recovery instructions. Microsoft’s compromised-account guide uses a sign-in helper that presents the available self-service steps and, where offered, support options. The FTC also maintains a list of official recovery links in its consumer guidance.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Secure the device before changing credentials when malware is possible
A stolen password is not the only way an account can be taken over. If the computer or phone may contain spyware, an infostealer, a malicious browser extension, or another unwanted program, a new password entered on that device could be captured again. This does not mean every account incident came from an infected device; use this step when you see other signs of compromise or when the provider tells you to.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Update the device’s operating system and trusted security software.
- Run a full scan. Remove or quarantine anything the security software identifies.
- Restart the device after cleanup.
- Continue recovery from the cleaned device, or use a different device you trust.
The FTC recommends updating security software, scanning, removing suspicious software, and restarting. Microsoft specifically says to clear a PC of viruses or malware before changing a compromised-account password; Google likewise advises removing harmful software and using trusted antivirus tools when suspicious activity warrants it. See the FTC instructions, Microsoft guidance, and Google guidance.
Recover an account you cannot open
- Start at the provider’s official site or app. Type the address, use a bookmark you created earlier, or open the provider’s published help center. Avoid links in unsolicited email, direct messages, and search ads that ask for your password or verification code.
- Enter the account identifier. Use the email address, username, or phone number the provider requests. If the attacker changed the visible address, try the original identifier and any documented recovery alias.
- Use a recovery method you still control. Follow prompts for a recovery email, phone, authenticator, security key, printed code, or backup code. Never share a one-time code with a person who contacts you first.
- Provide accurate historical information. Some systems ask for an older password, approximate account-creation details, or other evidence. Give your best truthful answers; guessing repeatedly can make the process harder.
- Review every notification. A genuine provider message should identify the account and appear in the provider’s normal notification channel. If a message sends you to a different domain, close it and return to the official recovery page.
- Record the result. Save the recovery case number or confirmation and note which recovery addresses and devices remain available. Do not assume that submitting a form guarantees restoration or a particular response time.
Google and Microsoft publish their own recovery flows because the exact checks vary by service. The FTC’s guidance links to official pages for common platforms and warns against people who claim they can recover an account through unofficial means. Read the FTC’s account-recovery advice before proceeding.
Lock down the account immediately after access returns
Replace the password
Create a password that is unique to this service and not a variation of one used elsewhere. The FTC’s October 2024 alert recommends aiming for 12 to 15 characters or using a passphrase. That is the FTC’s recommendation in that guidance, not a guarantee that every service accepts a particular length. A password manager can generate and store distinct passwords; the FTC discusses this category in its personal-information protection advice.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
End other sessions
Use the security page’s option to sign out of all devices or review each active session and remove anything unfamiliar. Changing a password alone may leave an attacker’s existing browser session or app token active.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Restore recovery controls
Check the recovery email address and phone number character by character. Remove an attacker’s address or number, confirm that your own destinations are accessible, and replace any backup codes that may have been viewed. Check the account’s name, date of birth, security questions, and other identity fields if the service uses them for recovery.
Turn on two-factor authentication
2FA requires an additional proof after the password. Availability depends on the provider and account type. The FTC says authenticator apps and security keys are generally more secure than codes sent by text message or email. Google lists a phone, security key, or printed backup code among possible second factors. Keep a backup method that you can retain safely, because a factor you lose can become another lockout.
| Second-factor method | What it requires | Trade-off |
|---|---|---|
| Authenticator app | A code generated on a registered phone or device | Stronger than text or email codes, but you need access to the enrolled device or a documented backup |
| Hardware security key | A physical key that you insert or tap | Strong phishing resistance where supported; check platform compatibility and keep a spare or backup recovery route |
| Text message | A code sent to your phone number | Widely available, but the FTC rates it less secure than an authenticator app or security key |
| Email code | A code sent to another email address | Useful only if that mailbox is separately secured; it can create a chain of compromise |
| Printed or stored backup code | A one-time code kept offline | Helpful during device loss; protect the sheet or file like a password |
A FIDO2 security key is an optional physical product for protection after recovery, not a way to reclaim a locked account. Confirm that your provider supports the key before buying one. The FTC’s security-options guidance and Google’s 2-Step Verification information describe supported choices.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remove persistence and check what the attacker did
Email accounts
Attackers often leave behind changes that let them continue reading or hiding messages. Inspect forwarding addresses, inbox rules and filters, automatic replies, delegated access, connected accounts, scheduled messages, sent mail, and deleted mail. Remove anything you did not create, then check whether security notifications were diverted or deleted.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Social-media accounts
Review posts, stories, direct messages, comments, follows, friend requests, profile details, linked phone numbers, advertising or payment settings, and connected apps. Delete fraudulent content and revoke access for applications you do not recognize. Warn people who may have interacted with the account before you recovered it.
Account-wide security history
Review recent security events, signed-in devices, recovery details, and applications with account access. Google specifically directs users to check these areas, along with Gmail forwarding and filters; Microsoft calls out connected accounts, forwarding, and automatic replies. Menu names change, so use the provider’s current help documentation when a setting is hard to find. Google’s checklist and Microsoft’s checklist provide provider-specific paths.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect email-linked accounts and sensitive information
Secure the email account before changing passwords elsewhere: an inbox can receive password-reset links for shopping, banking, work, cloud-storage, and messaging services. Make a list of services that use the compromised address, starting with financial, work, identity, and administrator accounts. Change any reused password, sign out other sessions where available, enable 2FA, and review each service’s security activity. Do not reuse the recovered email password on another site.
If financial information may have been exposed, contact the relevant bank or card issuer through its official number or app and ask what protective steps apply. Google advises contacting a bank or local authorities when financial or identity information saved in the account may be at risk. Keep this advice jurisdiction-specific: the FTC’s IdentityTheft.gov service is for U.S. consumers. U.S. readers who believe personal information was stolen can report it at IdentityTheft.gov and receive a personalized recovery plan.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Tell contacts and contain the spread
Send a short warning through a channel you trust, not through the compromised account alone. Say that the account was accessed, ask people to ignore recent links, attachments, money requests, and login-code requests, and tell them not to reply to suspicious messages. If fraudulent posts or messages remain visible, remove them and report them using the platform’s abuse tools. Do not include your new password, recovery codes, or other sensitive details in the warning.
When recovery or cleanup does not work
The recovery code goes to an attacker-controlled address
Stop using that option and return to the provider’s official recovery flow to choose another method. If no alternate method exists, submit the provider’s documented compromised-account form with accurate historical information. Do not negotiate with the person who changed the address.
You regain access but are immediately locked out again
Assume that a device, browser extension, app token, forwarding rule, or reused password remains compromised. Scan a trusted device, remove unfamiliar apps and extensions, revoke third-party access, change the password again from the clean device, and end all sessions. Check recovery details after each change.
You find evidence of fraud or identity theft
Preserve provider notifications, timestamps, transaction records, and screenshots. Contact affected financial institutions through official channels and follow the reporting process in your country. U.S. consumers can use IdentityTheft.gov; it is not a worldwide reporting service.
Prevent the next takeover
- Use a different long password for every important service; a password manager can create and store them.
- Keep 2FA enabled and maintain a safe backup factor or recovery-code copy.
- Review signed-in devices, connected applications, forwarding rules, and recovery details periodically.
- Install operating-system and browser updates, and remove software or extensions you do not recognize.
- Use the provider’s official app or typed address for security changes; treat unsolicited “support” messages as phishing.
- Separate high-value accounts where practical, so one compromised mailbox does not reset everything else.
The FTC emphasizes that protecting email with a strong password and 2FA matters because the inbox can unlock other accounts. Its broader guidance on passwords and authentication is available at Protect Your Personal Information From Hackers and Scammers. For an additional government perspective, the UK National Cyber Security Centre’s Recovering a hacked account guide covers recovery and post-incident checks; its reporting advice is written for the UK, so follow local authorities elsewhere.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
