Account recovery

What to do if you gave a scammer your password

2 min readPractical safety guide

Change the password on the real service immediately, end unfamiliar sessions, verify recovery email and phone details, and change any other account that reused the same password. If a one-time code or recovery code was also shared, treat the account as potentially compromised even if the password has already been changed.

1. Use the real app or website

Do not return through the suspicious message. Open the service from a trusted bookmark, official app or address you type yourself.

2. Change the password

Choose a unique password that is not reused on another service. If the account no longer lets you sign in, use the provider’s official recovery process.

3. End active sessions and review recent activity

Sign out unfamiliar devices or sessions, check recent security events and remove app passwords or connected applications you do not recognize.

4. Check recovery methods and multi-factor authentication

Confirm that recovery email addresses, phone numbers and authentication methods still belong to you. Replace exposed recovery codes.

5. Protect accounts that reused the password

Credential reuse lets one stolen password affect multiple services. Change any other account that used the same or a closely related password.

Sources

Primary prevention references

Check suspicious links and sender addresses

Use the same homepage field for a URL or email address.

Analyze it