Assume the account is actively compromised. From a device you trust, open the service’s official app or type its known address yourself. Change the exposed password to a new, unique one, then use the account’s control to sign out everywhere or revoke active sessions. If you cannot sign in, start the provider’s official recovery process immediately. After regaining access, replace compromised sign-in methods, inspect recovery details and account activity, check email rules and connected apps, secure every account that reused the password, and respond to any financial or identity risk.
A password and a one-time MFA code are both sensitive credentials. Do not approve or share additional prompts or codes that you did not initiate. Exact menu names and available controls vary by provider, account type and whether you can still sign in.
As an Amazon Associate I earn from qualifying purchases.
Do these things first
- Stop the conversation with the attacker. Do not send another code, password, screenshot or sign-in approval. The Federal Trade Commission’s rule is direct: “No matter what the story is, don’t share your verification code with someone if you didn’t contact them first.”
- Use a trusted route to the account. Open the provider’s app or type an address you already know. Do not use a link from the unexpected message that requested the code. If the computer or phone might contain malware, use a different trusted device.
- Change the password. Make it long, unique to this account and unrelated to the exposed password. Do not recycle a small variation of the old one.
- End existing access. Choose the provider’s “sign out of all devices,” “log out everywhere,” “revoke sessions” or equivalent control. Changing a password alone is not a guarantee that every existing session or token has ended.
- Record what happened. Note the time, suspicious messages, devices, changed settings and any transactions. This information helps an employer, bank or provider investigate.
Treat the MFA code as evidence that the attacker may have been in an active sign-in flow. You do not need to determine whether the code was technically still valid before taking containment steps.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Change the password and terminate active sessions
If you can still sign in
Go directly to the provider’s security or account settings page. Change the password before browsing other settings. Use a password that has never appeared on another service. If your provider offers a session dashboard, revoke every unfamiliar session and, when practical, sign out all sessions so that you can start again only from devices you control.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Some services separate browser sessions, mobile sessions, API tokens, app passwords and remembered devices. Review each category. An attacker who obtained a token may continue using it even after a normal browser logout unless you revoke that token through the provider’s controls.
If the attacker changed your password
Stop trying random passwords; repeated attempts can trigger additional locks. Select the provider’s official “forgot password,” “account recovery” or “hacked account” route. Follow the recovery prompts from a clean device and use an email address or phone number that you know belongs to you. Save recovery confirmation messages and case numbers.
Recovery questions, backup codes and identity checks differ by service. Do not pay anyone who claims they can bypass the provider’s process, and do not give a supposed helper your new password or verification code.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReplace compromised MFA and recovery methods
Audit every sign-in method
After access is restored, open the security page and list the enrolled MFA methods: authenticator applications, security keys, SMS numbers, email addresses, backup codes, trusted devices and app passwords. Remove registrations you do not recognize. Re-enroll a method under your control according to the provider’s instructions.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not assume that a password change removes an attacker-added authenticator, phone number or app password. Consumer controls vary. For a managed workplace account, an administrator may need to remove suspicious MFA devices and revoke active sessions centrally; Microsoft 365 guidance, for example, treats session revocation and MFA-device review as separate incident actions.
Generate new backup codes
If the service provides one-time backup codes and you suspect the old set was viewed, used or stored by the attacker, invalidate it and generate a new set. Store the replacement codes offline in a location that other people cannot access. Never post them in a shared chat or send them to a caller.
Prefer phishing-resistant MFA after recovery
When the provider supports it, a FIDO/WebAuthn security key is a strong future option because the sign-in proof is bound to the legitimate site rather than copied into a phishing page. It requires a compatible account, device and physical key, and you must enroll it correctly. A key does not repair the current compromise or remove an attacker’s existing session.
Inspect the account for persistence and damage
Recovery information and security events
Verify the recovery phone, recovery email, alternate address and account name. Delete unfamiliar entries, but first capture screenshots or notes if you may need evidence. Review recent security events, login history, IP locations and signed-in devices. A location can be approximate, so investigate the device and time rather than rejecting an event solely because the map looks unfamiliar.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Connected applications and permissions
Open the list of applications, browser extensions, integrations and third-party services with account access. Revoke anything you do not recognize or no longer need. Check whether the attacker created an app password, forwarding integration or new administrator role. Review the provider’s privacy and sharing pages for newly added delegates or shared folders.
Email rules and mailbox activity
If the account includes email, inspect forwarding addresses, filters, rules, delegation, automatic replies, signatures, sent mail, drafts, deleted items and archive folders. Attackers commonly create forwarding or filtering rules that silently copy messages or hide security notices. Remove unauthorized rules and search for password-reset messages, invoices, identity documents and conversations the attacker may have read or sent.
Tell contacts that the account was compromised. Ask them to ignore unusual links, requests for money, password-reset instructions or urgent messages sent during the incident. Check sent and deleted folders so you can identify which contacts may need a warning.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect every other account connected to it
Find password reuse
Change the exposed password anywhere it was reused, even if those services show no suspicious login. Prioritize your primary email account and any service that uses this email address for password resets. An attacker who controls the inbox can often request resets for banking, shopping, workplace, cloud-storage and social accounts.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a different password for every service. A password manager can help create and store unique credentials, but the immediate priority is replacing reused passwords and securing the email account that links them.
Review high-impact accounts
Check financial, payroll, tax, health, identity and business accounts for new devices, changed contact details, transfers, purchases, password resets and messages marked as read. Contact the bank or relevant provider through a number or app you already trust if payment details or identity documents may have been exposed. In the United States, the Federal Trade Commission directs people who believe personal information was stolen to IdentityTheft.gov for a tailored recovery plan.
Preserve statements, confirmation emails and screenshots. Ask financial providers whether they can add a fraud alert, replace an exposed card, freeze transfers or monitor the account. The right action depends on the information stored and the provider’s policy.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck the device that may have leaked the credentials
Credential theft can result from a fake login page, a malicious browser extension, infostealer malware or someone with physical access. Update the device’s security software and run a full scan. Review installed applications, browser extensions, remote-access tools and operating-system accounts for anything unfamiliar.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you have a credible reason to suspect infection, do not use that device to change the password. Recover the account from a different trusted device, then follow reputable device-cleanup or operating-system recovery guidance. After cleanup, change important passwords again if they were entered before the device was secured.
Choose stronger MFA for the next sign-in
Future MFA choices have different failure modes. Use the strongest method your provider supports, but do not postpone current recovery while changing methods.
| Method | Advantages | Risks and requirements |
|---|---|---|
| SMS or email code | Works on many accounts and requires no extra application. | An SMS code can be exposed through a SIM swap. An email code depends on the security of the mailbox delivering it. |
| Authenticator app | Less exposed to SIM-swap attacks than SMS and does not depend on email delivery. | The phone must be secured and enrollment or recovery must be completed correctly. |
| FIDO/WebAuthn security key | Designed to resist phishing and requires possession of the enrolled physical key. | The account and device must support it; losing the key requires a separately enrolled backup method. |
Whichever method you select, protect the recovery channel as carefully as the account itself. Keep a second legitimate recovery method where the provider allows it, and remove old numbers, addresses and devices that no longer belong to you.
Recommended Free Tools
Special handling for work or managed accounts
Tell your employer’s security or IT team immediately if the account is corporate, administrative or connected to company data. Do not rely only on the consumer recovery page. An administrator may need to revoke refresh tokens, disable the account temporarily, remove malicious MFA registrations, review mailbox rules and investigate sign-in logs across other users.
Provide the time of the suspicious code request, the device used, unusual messages, changed settings and any files or systems that may have been accessed. Do not delete evidence before the security team advises you.
Quick Recap
Common mistakes that prolong the compromise
- Sharing a second code to “prove” ownership to a caller or support agent.
- Changing the password but leaving unknown sessions, app passwords or tokens active.
- Ignoring recovery-email, phone and MFA changes because the new password works.
- Failing to inspect forwarding rules, delegates and sent messages in an email account.
- Using an infected device to reset every password.
- Reusing the replacement password on another service.
- Clicking a recovery link delivered in the same suspicious conversation.
- Waiting for proof of fraud before notifying a bank, employer or affected contacts.
A practical follow-up schedule
Today
- Change the password, revoke sessions and remove unauthorized sign-in methods.
- Verify recovery details, devices, connected apps and email rules.
- Change reused passwords, starting with the primary email account.
- Notify financial providers, your employer and contacts when relevant.
Over the next few days
- Review account activity and financial statements for transactions or changes that appeared after the incident.
- Finish malware scans and device cleanup; repeat password changes from a clean device if necessary.
- Enroll an authenticator app or security key if supported, and store new backup codes safely.
For the next several weeks
- Watch for delayed password-reset emails, new-device alerts, mailbox forwarding and unfamiliar support calls.
- Keep records of provider case numbers, transactions, messages and remediation steps.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
