Browsers & Accounts · How Accounts Get Stolen · Lesson 4 of 5

After a Takeover

The steps, in order, to win an account back and close every back door.

The first hour, in order

In Staying Safe Online, you met a short list for when you think you were hacked. Now let's go deeper. Order matters, because each step protects the next one.

First, if you think malware caused it, use a different device you trust for all of this.

1. Secure your email first. Your email is the master key. Reset links for almost every other account go there. If the thief controls your email, they can undo every fix you make. If you can't get in, use the email provider's own recovery page, as you learned last module.
2. Check your email's recovery details. Thieves often swap in their own recovery email or phone. Put yours back before you do anything else.
3. Reset passwords. Start with email, then banking, shopping, social and gaming accounts. Give each one a new, different password. A password manager makes this much easier.
4. Sign out everywhere. Use "Sign out of all devices" or end each session one by one. Stolen session cookies stop working.
5. Check two-step. Make sure it is on, and that the phone number or authenticator app listed is yours. Remove any you don't recognize. Make a fresh set of backup codes, since the thief may have seen the old ones.

Why email before the account that was actually hit? Picture a thief who still controls your email. You fix your game account. Ten minutes later, they click "Forgot password" on it, open the reset link in your inbox, and take it again.

Go slowly and write down what you changed. It's easy to lose track when you're stressed. Feeling shaken is normal. Following the list is how you get back in control.

Closing the back doors

A smart thief leaves ways back in, even after you change your password. Look for these.

• Forwarding rules. A forwarding rule automatically sends copies of your email to another address. Thieves add one so they keep seeing your reset links. Check your email settings for forwarding.
• Filters. A filter sorts mail automatically. Thieves make filters that delete or hide alerts from your bank, so you don't notice. Look for any you didn't make.
• Connected apps. Many accounts let other apps sign in for you. Your account's security or privacy page lists them. Remove any you don't recognize.
• Changed details. Check your name, address, payment methods and linked accounts.

Next, warn your contacts. Thieves often message friends from a hacked account, asking for money or sending bad links. A quick note works: "My account was hacked. Ignore any odd messages from me." Send it from a different account or by text, if the hacked one isn't clean yet.

Then report it.

1. Report to the service itself, using its official help page. This can help you recover and stops the thief using it.
2. If money was taken or cards were used, call your bank using the number on your card.
3. In the United States, report scams at ReportFraud.ftc.gov. If someone is using your identity, IdentityTheft.gov builds a step by step recovery plan.

Finally, ask how it happened. A reused password? A fake sign-in page? A download that ran an info-stealer? Fixing the cause is what stops it happening again.