How to Recover a Compromised Account

Step by step

1. 1 min

   Disconnect active sessions

   Navigate to the account security settings page and locate the 'Active Sessions' or 'Where you're logged in' section. Select the option to 'Log out of all devices' or 'Terminate all sessions' to immediately eject the attacker from your account.

   Note: If you cannot access the account settings, proceed immediately to the password reset flow.
2. 2 min

   Reset your account password

   Initiate the password recovery process from the login screen. Ensure you choose a unique, high-entropy password of at least 16 characters that is not shared with any other service.

   Note: Use a password manager to generate and store this credential.
3. 1 min

   Audit recovery information

   Check the account profile to ensure the attacker did not add their own email address or phone number as a recovery method. Remove any unrecognized contact details immediately.

   Note: Verification codes sent to an attacker's phone will prevent you from regaining access.
4. 2 min

   Enable Multi-Factor Authentication

   Navigate to the Security or Privacy settings and enable Multi-Factor Authentication (MFA). Prioritize the use of a hardware security key or an authenticator app over SMS-based verification codes.

   Note: Store your backup recovery codes in an offline, secure location.
5. 1 min

   Review recent activity logs

   Open your account history or activity log to identify unauthorized transactions or settings changes made during the compromise. Report any fraudulent activity to the service provider's support department immediately.

   Note: Check 'Sent' folders in email accounts for signs of phishing campaigns sent in your name.