If you shared your password with a scammer, treat it as stolen: change it immediately, replace it anywhere you reused it, and turn on two-factor authentication (2FA). If you cannot sign in, use the service’s official recovery process—not a link or phone number in the suspicious message. Then check for account changes and activity, sign out other sessions, and warn contacts if the account may have messaged them.
The steps are the same whether or not AI was involved. Federal Trade Commission (FTC) and Cybersecurity and Infrastructure Security Agency (CISA) guidance covers phishing, credential theft, account takeover and recovery generally; it does not establish that an AI-powered scam requires a different response.
As an Amazon Associate I earn from qualifying purchases.
What to do first if you can still access the account
- Open the service through a trusted route. Use its official app or type an address you already know. Do not follow links or call numbers in the suspicious message. The FTC advises contacting an organization through a website, email address or phone number you know is real: FTC phishing guidance.
- Change the exposed password. Make it strong and unique to that account. The FTC’s guidance is direct: “Create a new, strong password for the account that was compromised.” Change it on every other service where you used the same password, too. FTC: What To Do if You Were Scammed.
- Turn on two-factor authentication. Enable it in the account’s security settings. If the provider offers several methods, see how to choose one below.
Changing a password does not necessarily end every existing session. Look for a control such as “Sign out of all devices” or “Log out of other sessions” and use it where available.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If you are locked out
Go directly to the service’s official account-recovery instructions, using its app or a known website address. Do not use a recovery link supplied by the scammer, and do not share a one-time code with anyone who contacts you. The FTC’s account recovery guide links to recovery routes for common email and social accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
After you regain access, change the password if you have not already, sign out other sessions, enable 2FA, and check that the recovery email and phone number are yours. Review recent sign-ins and account activity for changes or actions you did not make.
Secure other accounts that may be exposed
Change the password anywhere you reused it, starting with your email account. Email often provides the route for resetting passwords elsewhere. Then check financial, payment, work, social, tax and shopping accounts that shared the password or show suspicious activity. Use a different password for every account; a password manager can help create and store unique passwords, but it cannot recover a compromised account.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Check for signs the account was taken over
These signs can indicate unauthorized access, but they do not prove how the attacker got in:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- You can no longer log in, or your username or password changed without your action.
- You receive unexpected password-reset notices or see logins from unfamiliar devices or locations.
- The recovery email address or phone number has changed.
- Friends or colleagues report receiving messages from you that you did not send.
If the account may have sent messages, tell affected contacts not to click links or send money in response. The FTC’s recovery guidance also recommends alerting friends when an account may have contacted them.
Choose a second factor the account supports
2FA, also called multifactor authentication (MFA), requires another form of verification in addition to a password. It can block access when a password is compromised, though the protection depends on the method and the provider. CISA explains the added protection in its MFA guidance.
| Method | What to know |
|---|---|
| Security key | The FTC identifies physical security keys as the strongest 2FA method covered in its guidance. They use encryption to confirm their association with an account. A key only works if the service supports it; check how to recover the account if the key is lost. FTC 2FA guidance. |
| Authenticator app | An option when the service supports it. It is less exposed than email codes to a compromised email account, and less exposed than text-message codes to SIM swapping, in the risks described by the FTC. Keep the provider’s recovery options current. |
| Text-message or email code | Use these if they are the available options, but understand their risks: a text code may be exposed through SIM swapping, while an email code may be exposed if the email account is compromised. |
Method availability and account-recovery procedures vary by provider. Follow the service’s instructions and keep recovery details current.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Report the scam and respond to any misuse
- Report the scam: submit a report at ReportFraud.ftc.gov.
- If personal information is being used: go to IdentityTheft.gov for an identity-theft recovery plan. The FTC’s identity theft guidance explains when to use the service.
- If a financial account or payment is involved: contact the bank, card issuer or payment service through its known official channel.
When to check the device
A stolen password by itself does not show that your phone or computer has malware. If the scam also involved remote access, an installed attachment or app, or suspected device control, update your security software and run a scan. The FTC recommends contacting the device maker or a trusted technical-support provider if you need help: FTC scam-response guidance.
Free tools Windows power users keep installed
One-click scans. No signup required.
What the “AI-powered” label does—and does not—tell you
The label alone does not establish how the scam worked or whether AI was used to create a message, imitate a voice or automate contact. Official guidance on phishing and account recovery does not identify a distinct AI-specific recovery process. Focus on containing the credential exposure and securing the account rather than trying to infer the scammer’s tools.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
