Act immediately: stop using the scam message or website, record what you disclosed, then open the real service through its official app or a trusted bookmark. Change the exposed password and every reused copy, sign out other sessions, enable multi-factor authentication (MFA), inspect account activity and recovery details, and contact your employer, school, bank, or card issuer if those accounts or details were involved.
1. Stop interacting with the scam
Do not click another link in the message, call a number it supplied, install software, or provide a verification code. A scammer may use a second request to capture an MFA code, remote-access approval, or additional personal information.
As an Amazon Associate I earn from qualifying purchases.
Keep the message instead of deleting it immediately. Take screenshots or save the email, text, social-media conversation, or pop-up. Note the account name, website or app, approximate time, and every item you entered or disclosed. Microsoft’s phishing guidance recommends recording usernames, account numbers, passwords, and where the attack occurred while the details are fresh.
Use a different route to reach the service: its installed app, a bookmark you created earlier, or an official website address you type yourself. Never use a recovery link or phone number supplied by the suspicious message.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Change the exposed password through the real service
Open the account’s security settings from the trusted channel and replace the disclosed password with a long, unique one. Microsoft’s direct instruction is to change the password on every affected account and anywhere else the same password was used. A password manager can generate and store unique passwords so one disclosure does not expose several services.
- Sign in through the provider’s known app or official site.
- Open the account or profile menu, then Security, Password, or the provider’s equivalent.
- Set a new password that has not been used on another account.
- Save the change and confirm that you can sign in again from the trusted app or site.
If you cannot sign in, stop guessing passwords and use the provider’s official account-recovery process. Recovery steps differ by service and may ask you to verify a previous password, recovery address, phone number, or other account history. Start recovery only from the provider’s known website or app.
3. End sessions and check what changed
Changing a password does not necessarily end every existing login. In the account’s security area, choose Sign out of all devices, Sign out everywhere, or the equivalent, when available. This removes sessions a scammer may have established before you changed the password.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review the service’s recent sign-ins or account activity. Look for unfamiliar devices, locations, times, password changes, or security events. Microsoft and the Federal Trade Commission (FTC) both advise checking activity after a suspected compromise.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Inspect recovery and security settings as well. Verify that the recovery email address and phone number still belong to you, and remove any unfamiliar entry. Check whether MFA was changed or disabled. If the service offers a list of trusted devices or active sessions, remove anything you do not recognize.
If you see an unauthorized change, document it before correcting it where practical. The record can help the provider, your workplace IT team, or a financial institution investigate.
4. Protect every account that reused the password
Make a list of services that used the same password or a close variation. Change each one through its official channel. Prioritize accounts that can reset other accounts, especially your primary email, followed by banking and payment services, shopping accounts, social networks, and work or school accounts. This is a practical order based on account-recovery relationships, not a universal provider rule.
Do not simply add a number or punctuation mark to the old password. Use a genuinely different credential for each service. If you are unsure where a password was reused, search your password manager or browser’s saved-password list and check the accounts you remember creating. Do not paste the exposed password into random “breach checker” websites.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Your email account deserves particular attention because password-reset messages for other services often arrive there. After changing its password, end its sessions, verify recovery details, and enable MFA before working through less critical accounts.
5. Turn on multi-factor authentication
MFA requires an additional factor after the password. Enable it on the affected account and, where offered, on email, banking, purchases, social media, and work or school accounts. The FTC identifies text or email codes, authenticator apps, and security keys as common options; CISA recommends turning MFA on across important accounts and applications.
| Method | What to check | Trade-off |
|---|---|---|
| Text or email code | Whether your phone number or email remains under your control and how the service handles recovery | Easy to deploy, but an attacker who controls your email or defeats a mobile number may also receive codes |
| Authenticator app | Whether the service supports app-based codes and how you will restore the app if the phone is lost | The FTC notes that authenticator apps can be safer than SMS for risks such as SIM swapping or email compromise; recovery planning is essential |
| Security key | Whether the account supports the key standard and whether you can register a spare or another recovery factor | A separate possession factor can resist many phishing attempts, but losing the key without a recovery method can lock you out |
No method works identically for every service. Choose a factor that is separate from the compromised password and, where possible, separate from a compromised email account. Before leaving the setup screen, save the provider’s recovery codes in a secure place and confirm how to replace a lost phone or key. Never give an MFA code to a person who contacted you unexpectedly; a legitimate support representative will not need you to read a one-time code back to them.
Recommended Free Tools
6. Recover the account if you are locked out
If the scammer changed the password, recovery address, or MFA method, use only the provider’s official recovery flow. FTC guidance points users to each provider’s recovery instructions, while Microsoft directs people who cannot sign in to its account-recovery process.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Navigate to the provider’s known sign-in page from a saved bookmark or official app.
- Select Forgot password, Can’t access your account?, or the equivalent.
- Follow the verification steps using a recovery address, phone, backup code, or other method that you recognize.
- If recovery fails, use the provider’s official support channel and explain that a phishing scam may have changed the account.
- After regaining access, set a new unique password, sign out other sessions, restore your recovery details, enable MFA, and review activity.
Be wary of “account recovery” helpers who contact you through social media, search ads, or replies to the scam. Use contact information published by the organization itself or already present in trusted account materials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Escalate based on what else you disclosed
Work or school credentials
Tell your organization’s IT or security team promptly, even if you changed the password yourself. Give them the time, message, site, username, and information disclosed. They may need to revoke sessions, reset related access, or check whether the account connected to internal systems. Do not hide the incident because the password change appears to have worked.
Bank, card, or payment information
Contact the bank or card issuer through the number on the physical card, a statement, or the institution’s official website. Explain exactly what was shared and when. Follow the institution’s instructions for monitoring, replacing a card, securing online banking, or disputing transactions. Do not call a number in the suspicious message.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Identity-theft concerns
If personal information was stolen or misused in the United States, IdentityTheft.gov can provide a tailored recovery plan. Other countries have their own reporting and identity-protection services; use the official government channel for your location. If money was sent, report it to the payment provider and the relevant local authorities as soon as possible.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Contacts and connected accounts
If the compromised email or social account may have sent messages, posts, or payment requests, warn contacts through a separate channel. Tell them not to trust recent links or requests that appear to come from you. Review connected applications in the account’s security settings and remove any integration you do not recognize.
8. Scan a device only when there are signs of harmful software
Entering a password into a fake website does not, by itself, establish that malware was installed. Do not treat a disclosed password as proof that your computer or phone is infected.
Scan when there are additional warning signs, such as repeated unexpected password-change prompts, unfamiliar software, browser behavior you cannot explain, or security alerts that continue after you secure the account. Google recommends updating antivirus software, running a scan, and removing unwanted software in that situation. Keep the operating system and browser updated as well. A scan is a conditional response to possible harmful software, not a substitute for changing passwords and ending sessions.
Free tools Windows power users keep installed
One-click scans. No signup required.
9. Monitor after the first response
For the next several days, check sign-in alerts, account activity, recovery settings, and financial statements for changes you did not make. Treat unexpected “security” messages as possible follow-up scams, even when they mention the incident you just experienced. Open the service directly rather than clicking the message’s link.
Keep your incident notes, screenshots, support case numbers, and dates. If another account shows suspicious activity, repeat the same process: stop contact, use the official channel, change the password, end sessions, verify recovery settings, and enable MFA.
Quick Recap
Common mistakes that make the situation worse
- Changing only the password used on the scam site: reused copies remain exposed.
- Continuing the conversation: scammers may seek MFA codes, remote access, or payment.
- Using a search-ad phone number or a link from the message: it can lead to another fake support channel.
- Ignoring active sessions: a password change may leave an existing login active.
- Skipping recovery checks: an attacker may have replaced your email address or phone number.
- Buying security software as the only response: scanning does not revoke stolen credentials or sessions.
- Assuming no visible damage means no risk: the provider may not yet show an unauthorized sign-in.
A practical decision path
- Password disclosed, account still accessible: change it through the official service, sign out everywhere, inspect activity and recovery settings, then enable MFA.
- Password reused elsewhere: change every copy, starting with email and other accounts that can reset access.
- Locked out or security details changed: use the provider’s official recovery process and contact verified support.
- Work or school account involved: notify IT immediately.
- Financial information or money involved: contact the bank, card issuer, payment provider, and appropriate authorities through trusted channels.
- Signs of harmful software: update antivirus, scan, and remove unwanted software; continue the account-recovery steps regardless.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
