Change the exposed password immediately, then sign out of all ChatGPT sessions and check your account for unfamiliar activity. If you reused that password elsewhere, change it on those accounts too. Use a known official OpenAI address—not a link from the fake site or a suspicious message—to secure your account.
1. Change the password—or secure the provider you use to sign in
OpenAI advises changing a password right away if you think it was exposed, reused, or shared. Treat it as compromised even if nothing unusual has happened yet. Go to ChatGPT by typing its address yourself or using a trusted bookmark, then follow the recovery path that matches how you sign in.
As an Amazon Associate I earn from qualifying purchases.
| How you sign in | What to do |
|---|---|
| Email and password for your OpenAI account | While signed in, open Settings → Account to update the password. If you cannot sign in, use the official login flow: enter your account email or phone number, choose Forgot password?, and follow the reset email. See OpenAI’s password-reset instructions. |
| Google, Microsoft, or Apple sign-in | Continue signing in with that provider and change or recover the provider password through its own official site. An OpenAI password reset may not be available for an account created with social sign-in. See OpenAI’s password-reset instructions. |
If you change an OpenAI password, the change applies across your OpenAI account, including the API Platform. Use a new, unique password; a password manager can generate and store one for you.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →2. Change any reused password on other accounts
If you used the exposed password anywhere else, replace it on every account where it was used. Prioritize your email account and other accounts that can be used to reset passwords, since access to them can enable further account takeovers. Give each account its own password rather than making small variations of the exposed one. The FTC also recommends unique passwords and using a password manager: FTC guidance on phishing and account security.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. End existing ChatGPT sessions and inspect account activity
- In ChatGPT, open Settings → Security (or Security and login, if that is the label shown) and choose Log out of all devices.
- Review Security history for sign-ins or security changes you did not make. OpenAI notes that the location and device information may be approximate or unavailable, so use it as a clue rather than definitive proof.
- If you find unfamiliar activity, or someone changed your account details, contact OpenAI Support through a new chat in the Help Center or submit an unauthorized-activity report. Follow OpenAI’s guidance at How can I keep my OpenAI account secure? and How to report unauthorized ChatGPT or OpenAI API activity.
OpenAI says a password change and a manual all-session logout can each take up to 30 minutes to complete. Turning on multifactor authentication (MFA) does not sign out sessions that are already active.
4. Turn on multifactor authentication
After changing the password and requesting a session logout, enable an available MFA method in ChatGPT’s security settings. Depending on your device, country, account tier, and sign-in setup, OpenAI may offer an authenticator app, push prompt, text or WhatsApp code, or passkey; available choices vary. OpenAI describes the options in its MFA guidance.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
MFA adds a barrier to future sign-ins if someone knows your password; it does not replace changing the password or ending existing sessions. CISA explains why MFA helps protect accounts when a password is compromised: CISA guidance on strong passwords and MFA.
5. Take extra steps only if something else was exposed
- If you entered an email or text verification code: tell OpenAI Support when reporting the incident, and secure the relevant email or phone account if you see signs it was accessed.
- If you entered payment details on the fake site: contact your card issuer or payment provider promptly and follow its instructions. The FTC advises contacting the financial institution after sharing payment information with a suspected scammer: FTC phishing guidance.
- If you downloaded or installed a file: use legitimate, up-to-date security software to scan the device. Entering a password alone does not establish that malware was installed.
- If you use the OpenAI API and suspect an API key was also exposed: delete that key in the API key dashboard, review API usage, and contact Support if you find anything suspicious. This is a separate step for API users; a ChatGPT password exposure by itself does not mean an API key was exposed.
6. Report the fake site or message
Secure your accounts first. You can then report a phishing email to [email protected], forward a phishing text to SPAM (7726), or report the scam to the FTC at ReportFraud.ftc.gov. Do not revisit the fake site or use its links to reach OpenAI.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
