Account security
Recover control first. Then close the routes back in.
Unexpected messages, changed settings, unfamiliar sign-ins or being locked out can indicate account access by somebody else. Use the service’s genuine app or website — never a recovery link sent by an unknown person.
Still able to sign in
Change the password and end other sessions.
- Change the password to a strong, unique one through the genuine service.
- Change the password anywhere else it was reused.
- Use the security settings to sign out other devices, apps and sessions.
- Check recovery email addresses, telephone numbers, linked apps and security questions for changes.
- Turn on two-step verification and store any recovery codes safely.
Locked out
Use the provider’s account-recovery process.
Search the provider’s genuine support pages for account recovery. Be ready to verify your identity or previous account information. Do not pay an individual who claims they can recover it privately.
If the provider cannot restore access, tell trusted contacts that the old account is compromised and may send fraudulent messages. Update other services that used it for password resets or contact.
Email account
Check forwarding rules before resetting everything else.
Email can be used to reset other accounts. Check for unfamiliar forwarding rules, filters, recovery addresses and deleted security messages. Then change the email password, sign out other sessions and turn on two-step verification.
Review important accounts linked to that inbox — particularly banking, shopping, cloud storage, social media and messaging — for password resets or changes you did not make.
Money or purchases involved
Contact the bank or card provider immediately.
Report unfamiliar payments or purchases through a trusted bank route. Keep the security alerts, order details, messages and transaction references.
If somebody else used the account to contact people, warn those contacts through another route.
What to check afterwards
Look for changes, not just a changed password.
- Security settingsRecovery details, passkeys, two-step verification methods and trusted devices.
- Account activityMessages, posts, purchases, logins or files you do not recognise.
- Connected accessThird-party apps, browser extensions and active sessions that should be removed.
- Financial impactIf money was lost, tell the bank and report through Report Fraud; in Scotland, contact Police Scotland.
Sources checked
- National Cyber Security Centre — recovering a hacked account
- National Cyber Security Centre — two-step verification
- National Cyber Security Centre — data-breach guidance for individuals
Reviewed 29 August 2026. Account-recovery controls differ by provider; use the provider’s genuine support instructions.