What to Do After an Account Is Compromised

Start by staying calm

Discovering that someone else may have been in your account is unsettling, and panic leads to mistakes such as clicking a fake recovery link or deleting evidence you will later need. The situation is usually manageable if you take the steps in a sensible order. This article gives general good practice; the details differ between services, and some cases need professional or legal help.

Signs something is wrong

A compromise is not always obvious. Common signs include:

• Sign-in alerts or password reset emails you did not request.
• Login activity from places or devices you do not recognize.
• Messages sent from your account that you did not write, or sent items you do not recall.
• Settings that changed without you, such as a new forwarding rule, recovery email, or phone number.
• Being unexpectedly logged out, or your password no longer working.
• Unfamiliar purchases, files shared, or apps connected.
• Contacts telling you they received strange messages from you.

A single odd email is not proof. But when in doubt, it is cheaper to treat it as real, and then relax if it turns out to be nothing.

First actions

1. Use a device you trust. If you think malware may be on your computer, use a different, clean device to change passwords. Changing a password on an infected machine can hand the new one to the attacker.

2. Get into the account and change the password. Choose a new, long, unique one that you have never used elsewhere. A password manager makes this easy. If you cannot sign in, use the service’s official recovery process, reached by typing the address yourself and not through a link in an email.

3. Sign out everywhere. Most services have an option to end all other sessions or sign out of all devices. A changed password does not always end an active session, so look for this setting.

4. Turn on or reset two-factor authentication. Add it if it was missing, and if it was already on, review it. Attackers sometimes add their own phone number or authenticator. Remove any method you do not recognize.

5. Review recovery options. Check the recovery email address, phone number, and security questions. If these were changed, the attacker could take the account back later.

Look for changes the attacker made

Once the account is secured, check what was altered:

• Email rules and forwarding. A hidden rule that forwards or deletes messages is a common way to keep watching, or to hide replies to fraud attempts.
• Connected apps and permissions. Remove anything you do not recognize. App permissions can grant lasting access even after a password change.
• Shared items and permissions. See whether files or folders were shared with unknown addresses, and review sharing permissions.
• Sent messages and drafts. Check what was sent and to whom, so you know whom to warn.
• Payment, billing, and address details, and any stored cards or payout settings.
• Delegates or additional users added to the account.

Take notes and screenshots as you go. If you later report the incident, a record of what you found is useful.

Check related accounts

The email account is the key to many others, because password resets arrive there. If your email was compromised, assume other accounts tied to it may be at risk. If you reused the password anywhere, change it everywhere it was used, starting with the most important, such as banking, work systems, and cloud storage. Reusing passwords is how one breach becomes many, which is the main reason to use a unique password for each account.

Also consider whether the attacker may have used the account to reach others. Work accounts can lead to shared files and customer records. If personal or customer information might have been exposed, tell the person responsible for security or data in your team.

Tell the right people

• Your team or administrator, quickly, so that others can watch for suspicious activity. Hiding it rarely helps and can let the problem grow.
• Contacts who may have received messages from the account, with a brief warning not to open links or attachments or act on payment requests from it.
• The service provider, through its official support or security channel.
• Banks or card issuers, if financial details may be involved.
• Authorities or legal advisers, where fraud or legal reporting duties may apply. Requirements vary by place and circumstance, so ask when unsure.

Find out how it happened

Understanding the cause helps stop a repeat. Typical routes include:

• A phishing email or fake sign-in page that captured your password.
• A reused password exposed in an unrelated breach.
• A weak or guessed password.
• Malware on a device.
• Sign-in on a shared or public computer, or an insecure public Wi-Fi network.
• A stolen or lost device that was not locked.
• A stolen verification code obtained by trickery.

If you suspect a device was infected, run a reputable security scan, update the system, and consider whether a clean reinstall is warranted. Treat the device as untrusted until you are confident.

Recover and strengthen

After the immediate steps, reduce the chance of it happening again:

1. Use unique passwords stored in a manager, with two-factor authentication on important accounts.
2. Learn the signs of phishing and take a moment before clicking.
3. Keep devices and apps updated.
4. Remove unused apps, old accounts, and stale access.
5. Keep backups of important data, in case content was deleted or altered.
6. Write down what happened and what you changed, and fold the lessons into your team’s incident checklist.

A broader view of protecting your logins appears in the guide to account security.

Be realistic

You may not learn exactly what the attacker saw or did, and some damage, such as messages already sent, cannot be undone. Securing the account quickly, cleaning up, warning the right people, and tightening your habits is a sound response even when the full picture stays unclear.