If you suspect someone has accessed your shopping account, go straight to the retailer’s official app or website, secure the account and its linked email, then check for unauthorized activity and contact the retailer and your bank or card issuer as needed. Don’t use a sign-in link in an unexpected email or text.
1. Reach the retailer through a trusted route
Open the retailer’s known app or type its web address yourself. Use its official account recovery or support process rather than following a link in an unexpected message. The FTC advises contacting a company through a phone number or website you know is real.
As an Amazon Associate I earn from qualifying purchases.
2. Secure the shopping account
If you can still sign in
- Change the password to a new, unique password you have not used on another account.
- Use the retailer’s sign-out-all-devices control if it offers one. The FTC recommends signing out other devices to remove anyone who may still be logged in.
- Turn on two-factor authentication (2FA) if available.
- Check the account’s recovery email address and phone number, and replace any details you do not recognize.
If you are locked out
Use the retailer’s official account-recovery route or contact its support team through its known website or app. Recovery steps and available controls differ between retailers. eBay, for example, tells users who cannot sign in to contact it promptly to secure the account: eBay account security guidance.
3. Secure your email and any reused passwords
Your email account may receive password-reset messages for the shopping account and other services. Change its password to a unique one, verify its recovery details, check for unfamiliar email-forwarding rules, and enable 2FA. If you reused the compromised password elsewhere, change it on every affected account, using a different password for each.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
4. Check account changes, orders, and payment activity
Look for activity you did not make, including orders, cancellations, bids, offers, or listings where the service supports them. Check saved shipping addresses, contact details, and payment settings. Remove unfamiliar changes and report unauthorized activity to the retailer. eBay’s guidance also recommends reviewing marketplace activity and account details after a suspected takeover.
Check your bank and card statements for unfamiliar charges. Promptly contact the bank or card issuer about any suspected unauthorized transaction; CISA’s online-shopping tip sheet recommends checking statements and notifying your financial institution about suspected fraudulent charges. Payment protections and dispute procedures depend on your issuer and location.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
5. If you entered your password on a suspicious page
Go to the real retailer site or app and change the exposed password there. Do not use that password again elsewhere. If you entered payment information on a page you now suspect was malicious, check the payment method saved to your shopping account and update it if needed; Amazon’s system-protection guidance advises updating the payment method on an Amazon account after suspected credential exposure.
6. Scan a device only if you suspect device access or malware
An account takeover by itself does not prove that your phone or computer is infected. If you also suspect malware or gave someone access to your device, update trusted security software, run a scan, and follow the software provider’s directions for any detected threats. The FTC’s account-recovery guidance recommends these steps when malware is suspected.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Make future sign-ins harder to steal
- Use a unique password for every account; a password manager can help you create and keep track of them.
- Prefer an authenticator app or security key for 2FA when the retailer supports it. The FTC identifies these as more secure choices than codes sent by text or email. A security key is optional, and compatibility varies by retailer and device.
- Keep recovery contact details current, and treat unexpected messages asking you to sign in as suspicious.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
