What to do after an account compromise

Contain before you investigate

If you still control the account, change the password from a trusted device and end other sessions. If you are locked out, use the provider’s official recovery page—not a link sent by someone offering help.

Secure the email account used for recovery before lower-priority services. If the same password was used elsewhere, assume those accounts also need new credentials.

Work in a deliberate order

A simple sequence reduces the chance of missing a persistence mechanism the intruder left behind.

1. Use a clean device and update its operating system and security software.
2. Recover and secure your primary email account.
3. Change reused passwords and turn on stronger multi-factor authentication.
4. Remove unknown sessions, devices, forwarding rules and connected applications.
5. Check financial activity, purchases, messages and profile changes.
6. Tell contacts if your account sent messages that may put them at risk.
7. Preserve alerts, timestamps and transaction details before they disappear.

Watch for the second incident

Compromised information can be reused later in targeted messages. Be cautious of follow-up calls that know accurate details and claim to investigate, recover money or secure your device.

Monitor important accounts and financial statements. If identity information or money was involved, follow the reporting and protective steps available in your country.