Secure an account after suspicious access
Recover access, remove unfamiliar sessions, and check what changed.
Use the provider’s recovery route
If you cannot sign in or see changes you did not make, go directly to the provider’s official help page. The FTC links to common providers’ recovery instructions. Avoid people promising recovery through direct messages or requesting payment in advance.
Secure the sign-in
After regaining access, set a unique password and enable additional authentication where available. Sign out other sessions through account settings. If you suspect malware, use a trusted device and follow the provider’s recovery advice.
Review persistence points
Check recovery email addresses, phone numbers, connected applications and email-forwarding rules. Remove unfamiliar entries carefully. A password change alone may not undo a forwarding rule or an attacker’s recovery setting.
Review the impact
Look for messages or changes you did not make and warn affected contacts through a channel you control. If financial or identity misuse occurred, use the relevant provider’s reporting process and keep a private record of your case.