# If someone’s gotten into one of your accounts. If something already happened · 03 · 7 min read What to secure first depends on what is still happening. Stop active money movement or alert work or school security first. Otherwise, recover the affected account and any email that can reset it. This page helps you: - Decide what to secure first - Close the ways back in, including the less obvious ones - Build a checklist for what the account could reach This is general guidance drawn from official sources. The provider involved, or the official body where you live, decides what happens in your case. If you are in immediate danger, contact your local emergency services. ## Where to start The first move depends on what the account can still do. **Who to contact first** What is happening right now? - **Money is still moving or new purchases are appearing:** Contact the bank, card issuer, or payment provider through an official channel first. - **It is a work or school account:** Contact the organization’s IT or security team first. It may be able to end sessions and preserve evidence that you cannot see. - **It is another personal account:** Secure the email that can reset it as part of the first pass. Then work outward only to accounts where the same credential was reused or where you find an unfamiliar change. If the takeover followed a download, an unfamiliar prompt, or a remote-access session, make account changes from a different trusted device. The device you were using may still be able to capture a new password. ## The recovery order Close the visible door, then check the less obvious ways back in. The exact labels vary by service. The sequence stays useful: recover, replace the password and sign out other sessions, remove other ways back in, then review what happened. **Step through it in order** ### Choose a trusted recovery route Use a device and route you can trust. If the device you were using may have unwanted software, or someone had remote access to it, switch to a different trusted device. Open the service’s official app or type a known address yourself. Use its hacked-account or account-recovery route. ### Replace the password, then sign out everywhere Change the password before you close other sessions. Replace the compromised password with one used nowhere else. Then use “sign out everywhere” when the service offers it, so anyone still signed in has to sign in again and no longer has a password that works. ### Remove other ways back in and strengthen sign-in Look beyond the password. Review the account’s recovery details and connected apps. For email, check forwarding rules and filters too. Remove anything you do not recognize, then add the strongest second step the service supports. If the same password was used elsewhere, change it on those accounts too, starting with email and anything that can move money. ### Watch, document, and report Reconstruct what happened while access was open. Check recent sign-ins, settings, messages, purchases, and statements. Tell the people who received a message or post sent as you. Save dated screenshots and reference numbers, then use the service’s reporting route and any official route that applies where you live. This order follows the [FTC](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account) and [UK NCSC](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account) guidance for hacked accounts. **Keep these details straight** - Keep messages, alerts, and login records until the recovery and any disputes are finished. - If the password was reused, replace it on those accounts. Other unrelated accounts do not need a blanket reset. - Ignore an unexpected person who promises to “restore” the account for a fee. Find official support yourself. ## If you can’t get back in at all Look for the service’s official account-recovery path. A service may offer a separate recovery process when the email or phone on the account has changed. Use the official app or website, keep its reference numbers, and work through the steps in order. **Work through recovery in order** ### Find the “can’t access my account” form Start with the official recovery form. Many services have an account-recovery or “I can’t sign in” page for cases where the email or phone changed. Availability and required evidence vary. Open it from the official app or site, and follow the service’s instructions. ### Provide only what the official flow requests Follow only the official form. Each service decides what can support an account-recovery request. Provide only what its official flow asks for, and do not send recovery information to a person who contacts you unexpectedly. ### Send the form, then wait for the review Follow the service’s review instructions. Review times and retry rules vary by service. Keep any confirmation or reference number, and use the official status or support channel before submitting again. If the account can reach money or your main email, tell the relevant provider while the review is open. ### When recovery keeps failing If the door stays shut. If recovery keeps failing, contact the service’s official support and reference your attempts. A work or school administrator, bank, or payment provider may still be able to contain access while personal account recovery is unresolved. ## Build your personalized checklist Mark what the account could reach. Print the follow-up that applies. Each choice puts the situation-specific first move before the common recovery steps. Choose only what happened. The printed copy stays short enough to use while you work. **What was involved?** ### Money or payment details were involved - Tell your bank or card issuer about activity you do not recognize and ask which replacement or dispute steps apply - Review recent and new statements for activity you do not recognize ### It was a work or school account - Contact your organization’s IT, security, or help desk through a route you already know - Follow its instructions before deleting messages, changing managed settings, or wiping a work device ### The takeover followed a download, remote-access session, or unfamiliar prompt - Use a different trusted device for account recovery and new sign-in credentials - Disconnect the affected device from the internet if remote access may still be open, then follow its maker’s or your organization’s cleanup guidance ### It was my main email, or an account that email can reset - Secure the inbox and review the accounts it can reset for changes you did not make - Prioritize affected financial, medical, and other high-consequence accounts instead of resetting every account ### I used that password on other sites too - Change the reused password everywhere it appears - Set up a password manager so every site is unique ### Messages or posts were sent as me - Tell the people who received those messages or posts not to act on them - Remove or report the messages and posts through the service where possible ### My phone number or a texted sign-in code was changed, redirected, or used - Review the services that use this number for sign-in or recovery and update only the affected paths - If service disappeared or the carrier confirms a SIM or number-port change, ask the carrier to restore and protect the number ### Account taken over Illustrative. Reporting bodies and exact steps vary by company and country. 1. Use the official app or website to recover the affected account, then replace the compromised sign-in credential 2. Remove unfamiliar recovery details, connected apps, and other access; for email, check forwarding rules and filters too 3. Log out other active sessions wherever the service offers that control 4. Strengthen sign-in with the best supported method and review how account recovery works 5. Check recent sign-ins, settings, purchases, and messages for activity you did not make 6. Save screenshots, dates, and reference numbers as a timeline 7. Report to the platform and the right body for your region [Was your phone or an SMS code involved?](https://explained.withpersona.com/your-identity-online/phone-and-accounts) Reviewed July 2026. This guide draws on official guidance, but it is not the only route. Some of the places that can help: [FTC account-recovery guide](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account) · [UK NCSC hacked-account guidance](https://www.ncsc.gov.uk/guidance/recovering-a-hacked-account). --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/account-taken-over_