ACCOUNT COMPROMISE: WHAT TO DO WHEN SOMEONE MAY HAVE ACCESS
If you suspect that someone has accessed an important account without authorization, the priority is to regain control, protect related accounts and preserve useful information while avoiding actions that make investigation harder.
THE CORE PRINCIPLE
WHEN SOMETHING MAY BE COMPROMISED, PAUSE, CONTAIN, VERIFY AND THEN RECOVER.
01 · RECOGNIZE THE WARNING SIGNS
Possible signs include unexpected password changes, unfamiliar login alerts, unknown devices or sessions, messages you did not send, changed recovery information or transactions you do not recognize.
02 · USE A TRUSTED DEVICE AND OFFICIAL CHANNEL
If possible, access the account through a device you trust and use the service's known official website or application. Avoid links supplied by someone who claims they can fix the compromise.
03 · SECURE THE ACCOUNT
Follow the provider's official recovery process. Change compromised credentials, terminate unfamiliar sessions and review recovery methods where appropriate.
04 · PROTECT CONNECTED ACCOUNTS
If the compromised account can reset or access other accounts, review those accounts too. Email accounts deserve particular attention because they may be used for password recovery elsewhere.
05 · PRESERVE USEFUL INFORMATION
Record relevant alerts, unfamiliar transactions, dates, messages and other evidence before deleting things unnecessarily.
06 · ESCALATE WHEN NECESSARY
For financial loss, identity concerns, repeated unauthorized access or serious compromise, contact the relevant provider and appropriate authorities through trusted channels.
EXAMPLE
You receive a login alert for an unfamiliar device and then discover that your recovery email has changed. Do not follow a random “support” link sent in response to the incident. Use the provider's official recovery route, secure the account and document what happened.
WHAT TO DO
- Confirm what changed.
- Secure the account through an official channel.
- Terminate unauthorized sessions.
- Review recovery methods and connected access.
- Protect other accounts that depend on the compromised account.
- Preserve useful evidence.
WHY THIS MATTERS
A compromised account can become a gateway into other services. Responding methodically can reduce further damage.