Take back a compromised account
Recovery is a sequence: regain control, close access, then inspect the damage.
A password change is necessary, but it may not be enough. An intruder can leave behind active sessions, altered recovery details, or email rules that keep forwarding messages after you think the account is secure.
Work from a device you trust
- Use the official recovery flow.Open the provider’s app or type its known address yourself. Do not use a recovery link sent by a stranger.
- Replace the password.Make the new password unique, then protect the account with MFA or a passkey.
- End every other session.Sign out all devices and remove apps or devices you do not recognize.
- Check what changed.Review recovery contacts, forwarding rules, sent messages, purchases, and security alerts.
- Warn people who received messages.Tell them not to trust links, payment requests, or files sent during the compromise.
Protect connected accounts
If the stolen password was reused elsewhere, change those accounts too. Start with email, banking, cloud storage, and any service that can reset another password.
The ruleRecovery is not finished until unfamiliar sessions are gone and recovery details belong to you again.
Supporting source: FTC steps after responding to phishing ↗