What to Do When an Account Is Compromised: A DEWA89 Guide

Why the Order Matters More Than the Steps

When someone else has access to your account, doing the right things in the wrong order can make the situation worse.

• Change the password first, and you may hand the new one straight to malware still running on your own laptop.
• Change it but skip the session list, and the intruder stays signed in, because a password change does not always invalidate a login that already happened.
• Delete the evidence before you have read it, and you lose the dates that a bank dispute or a platform report will ask for.

What follows is an incident-response sequence written for one person with one or two devices, not for a company with a security team. Work through it in order, and stop where it stops applying to you.

Step 1: Get to a Device You Trust Before You Change Anything

Many takeovers begin with an infostealer - malware that copies saved browser passwords, session cookies, cryptocurrency wallet files and autofill data, then uploads them. If that is what happened, every password you type on the infected machine is captured as well, and you will be locked out again within hours. Resetting credentials from a compromised computer is how people end up doing this twice.

So before touching the account, move to a device you have reason to trust:

• A second phone, using mobile data rather than the home Wi-Fi.
• A household computer that has not been used for pirated software, game cheats, cracked installers or unusual downloads.
• A freshly reset device, if you have one.

Do not use a shared or public computer. You will be typing your most sensitive password and reading one-time codes on it.

If you have no second device, accept the trade-off explicitly: run a full malware scan first (Step 6), do the recovery from the machine, then repeat the password changes from a clean device afterwards.

Step 2: Use the Provider's Own Recovery Flow, Reached by Typing the Address

Type the provider's domain into the address bar, or open its installed app. Never reach a recovery page from a link in an email, and never from a sponsored search result - fake recovery pages are a standard follow-up scam aimed specifically at people who are panicking and searching for help.

Recovery is not the same thing as a password reset. It is an evidence-weighing process. The provider asks for things only the real owner is likely to know, then scores the answers: a code sent to your recovery phone or email, an older password you once used, the month the account was created, devices it already recognises, sometimes a government ID for high-value accounts. Answer from memory. Approximations are often accepted; a pile of confident wrong guesses hurts your case.

Two limits worth understanding before you start

• Deliberate waiting periods. If the attacker already changed your recovery phone and email, some providers impose a cooling-off period before honouring further changes, precisely so the real owner has a chance to object. This is frustrating and it is also protecting you.
• Refiling does not help. Submitting the same form repeatedly rarely accelerates anything and can look like an automated attack. Get one submission as complete as you can make it.

Google's public guidance for a hacked account is a good model of what these flows ask, and it is worth reading before you need it, so you know which recovery details you have registered and whether they are still current.

Step 3: Set a New Unique Password, Then Sign Out Every Other Session

Choose something long and used nowhere else: a passphrase of unrelated words, or a manager-generated random string. Current NIST guidance moved away from forced character-composition rules and from mandatory periodic rotation, because both pushed people toward predictable patterns and small increments of the old password. A new password that is a variation of the old one is not a new password.

Now the step most people skip. When you sign in, the service gives your browser a session cookie - a token meaning this browser already proved who it is. The attacker's browser holds one too. On many services a password change does not retract it, and almost none retract tokens held by other client types: mail apps connected over IMAP, linked mobile apps and app-specific passwords can all survive a reset.

So clear the list. Look under Security for Your devices, Where you're signed in or Active sessions, and choose the option to sign out everywhere else. Do this after changing the password, or the intruder can simply sign back in with the old one.

Step 4: Hunt for the Persistence They Left Behind

A competent intruder does not depend on keeping your password. They plant a second way in, plus a way to stop you noticing. Check every row below, even if the first few look untouched - the point of persistence is that it is quiet.

Where to look, concretely: a Google Account keeps most of this under Security and under Data & privacy at myaccount.google.com; Microsoft, Apple and Meta keep theirs under Security, Privacy or Connected apps. Note any forwarding destination before deleting the rule - it belongs in your report.

Step 5: Rebuild Multi-Factor Authentication From Scratch

Do not simply delete the one method you do not recognise. Remove all of them and enrol again, because you often cannot tell which entry is yours: an authenticator app entry shows only a label, and the label was chosen by whoever enrolled it.

• Regenerate backup codes. The old set may have been downloaded during the intrusion, and old codes usually stay valid until a new set is issued.
• Store the new codes offline - on paper, or in a password manager, but never inside the account they unlock.
• Prefer a passkey or hardware security key where offered. SMS beats no second factor but loses to both SIM swap and proxy phishing. If SMS is the only option, ask the operator for a port-out PIN as well.
• Enrol a backup factor on a second device in the same sitting, so the next lost phone is an inconvenience rather than a crisis.

How each method works, and where each one fails, is set out on multi-factor authentication and passkeys.

Step 6: Widen the Search - One Account Is Rarely the Only Loss

A single compromised account is usually a symptom rather than the whole event. Work outwards.

1. Check breach exposure. Enter the address at Have I Been Pwned, which indexes public breach data and names the services involved. It cannot see unpublished breaches, so a clean result is reassurance rather than proof.
2. Change the old password everywhere it was reused. Reuse is the normal case, not a shameful exception. Order: primary email first, then anything holding payment or identity data, then the rest. Your browser's saved-password list is a serviceable inventory of what to work through.
3. Scan for infostealer malware. On Windows: Windows Security, then Virus and threat protection, then Scan options, then Full scan - followed by a second, reputable on-demand scanner, because no single engine catches everything. If a stealer is confirmed, treat every credential ever saved in that browser as compromised and seriously consider reinstalling the operating system rather than cleaning it.
4. Warn the people it messaged, through a different channel, and say what the scam message asked for - not just "I was hacked". A specific warning is one people act on.
5. Watch the money. If payment details were stored or visible, read recent statements line by line, switch on transaction alerts, and ask the issuer to reissue the card rather than merely block one charge. The card number itself is compromised and will be tried again.
6. Consider a credit freeze or your country's equivalent if identity documents were exposed. In the United States, IdentityTheft.gov builds a recovery plan for your specific case.

Step 7: Report It, and Know What Reporting Achieves

Three channels are worth the time, for three different reasons.

• The platform. Its compromised-account or abuse form is what gets messages sent in your name taken down, and it creates a record if a payment dispute later turns on whether you notified anyone.
• Your bank or card issuer, the same day, if payment data was involved. Chargeback rights and fraud-liability rules are frequently tied to how fast you reported, and that window can be measured in days.
• Your national cybercrime or consumer-protection body. Most countries run an official portal through the police, a telecoms regulator or a cyber-security agency. Find yours on your government's own domain, never through a search advertisement.

Be realistic: a single report rarely identifies the attacker or recovers money by itself. Its value is a dated paper trail, eligibility for a chargeback or insurance claim, takedown of content sent in your name, and the aggregate data that eventually gets criminal infrastructure blocked. Refuse one offer outright: anyone who contacts you offering paid account recovery, or a hacker for hire, is running a second scam aimed at people who were just robbed.

If You Cannot Get the Account Back

Sometimes recovery fails, particularly when the attacker changed the recovery details and the provider's cooling-off period favours whoever holds them. Shift from recovery to containment.

1. Open a new account on a different address and secure it with a passkey or hardware key from day one.
2. Find every service that used the lost address as its login or its recovery contact, and change it there. This is the real damage: whoever holds the mailbox can reset those accounts whenever they choose.
3. Detach it from the other side. Wherever you used "Sign in with..." with that address, open that service's own security settings and remove the link, or set a direct password.
4. Tell your contacts that the old address is no longer yours and that anything arriving from it should be ignored.
5. Keep the timeline. If the address is later used to impersonate you, a dated record of when you lost control is the most useful document you will have.

Questions readers ask about this page

Back to top ↑