Common warning signs

One unusual event does not prove an account has been compromised, but several clear signs need prompt action. Examples include sign-in alerts you do not recognise, sent messages you did not write, changed recovery details, unfamiliar forwarding rules, new connected applications, unexpected multi-factor prompts or being locked out after credentials changed.

Safer first actions

  • Use a trusted device and type the provider's official website address or use a saved bookmark.
  • Change the account password to a new, unique password if you can still reach the official security settings.
  • Sign out unfamiliar sessions and remove devices or connected applications you do not recognise.
  • Check recovery email addresses, telephone numbers and authentication methods for unauthorised changes.
  • For email, inspect forwarding rules, filters, delegates, sent items and deleted items.
  • Change any other account that reused the same password, starting with email and financial accounts.
  • Tell affected contacts if the account sent messages, files or payment requests to them.
  • Keep security alerts, relevant messages, dates and screenshots as evidence.

For a work account, notify the organisation's responsible person immediately. They may need to protect other users, shared data, tokens and connected services rather than treating this as one password change.

Check what the account could reach

Consider the account's role. An email account may reset other passwords. A cloud account may expose files. An administrator account may affect many users. A shopping or financial account may contain payment details. Review recent activity and connected services in that order of risk. Contact the bank directly if money or payment information may be affected.

What not to do

Do not use a recovery link from the suspicious message. Do not approve an unexpected sign-in prompt or share an authentication code. Avoid making sensitive changes from a device you believe may contain unwanted software. Do not delete all evidence, confront an unknown attacker or pay an unsolicited person offering recovery.

When to stop and ask for urgent help

Get help promptly if you cannot sign in, recovery details changed, messages continue to send, software may have been installed or the account controls money, business administration or important systems. Use the provider's official recovery process. If personal safety, crime or immediate financial loss is involved, follow the relevant provider, bank and authority reporting route.

Prepare for support

Record the provider, account purpose, first suspicious time, alerts received, unauthorised changes, affected devices and actions already taken. State whether the account is personal or business-owned and whether it has administrator access. Do not send passwords, live codes, recovery codes or full confidential documents.