What an account takeover is
An account takeover happens when someone other than you gains control of one of your online accounts. They might have guessed or stolen the password, tricked you into entering it on a fake page, or used a password that leaked from another site. Once inside, they may read messages, send messages as you, change settings, or try to reach your money or other accounts.
Takeovers are stressful, but they are common and usually fixable if you act promptly. Knowing the signs helps you notice early.
Warning signs
No single sign proves a takeover. Some have innocent explanations. But several together, or any one that you cannot explain, deserve a closer look.
Alerts you did not expect
- Emails or texts saying your password was changed, a new device signed in, or a reset was requested, when you did none of those things.
- Verification codes arriving that you did not request. These can mean someone is trying to sign in using your password.
- Notices of sign-ins from unfamiliar places or devices.
Things you can no longer do
- Your usual password stops working.
- You are signed out unexpectedly and cannot recover access.
- Your recovery email or phone number has been replaced.
Changes you did not make
- New forwarding rules in your email that copy messages to another address.
- Altered profile details, a new name, a new photo or changed privacy settings.
- Unfamiliar apps or devices connected to the account.
- New payment methods, shipping addresses or subscriptions.
Activity under your name
- Friends or contacts tell you they received odd messages or links from you.
- Posts, comments, purchases or messages in your history that you do not recognize.
- Sent folders containing emails you never wrote.
- Unexplained charges. Regularly looking for unfamiliar charges on your statements helps you catch financial misuse early.
Not every odd event is a takeover
A single unfamiliar-location alert can result from a mobile network or a VPN. A sudden logout can follow a service update. A friend’s strange message might mean their account was taken over, not yours. If you are unsure, do the checks below calmly rather than assuming the worst.
What to do if you suspect a takeover
Act in a sensible order, using official channels rather than links in messages.
- Go to the service directly. Type the address yourself or use the official app. Do not click links in suspicious emails or texts, which could be phishing emails.
- Try to sign in and change the password. Choose a long, unique one that you have never used elsewhere. If you cannot sign in, use the service’s official recovery page.
- Secure your email first if it may be affected. Email is the hub for resets on other accounts. If it has been taken over, other accounts are at risk too.
- Turn on a second step. The guide to two-step verification covers common forms.
- Sign out of all other sessions. Most services provide a setting that ends every active sign-in.
- Review recovery details. Check the backup email and phone number, and remove any you do not recognize.
- Check settings and connections. Look for forwarding rules, linked apps and devices you did not authorize, and remove them.
- Change passwords elsewhere if reused. If the same password was used on other accounts, change those too. This is why password reuse is so risky.
- Scan your device. If your own phone or computer may have been compromised, keep your software updates current and consider running a reputable security check. The overview of device security has more on this.
- Alert your contacts. Tell friends and family not to click anything odd they received from you. Use a different channel than the affected account.
Financial accounts and identity
If a bank, payment or shopping account is involved, contact the provider through its official number or app promptly so it can review activity and, where appropriate, protect your funds. Keep records of what you see. If personal documents or identity information may have been exposed, your local consumer-protection or fraud-reporting channels, and your local police where appropriate, can advise on next steps. The process for reporting scams outlines the general approach.
If you believe someone is in danger, or you are being harassed or threatened as part of the incident, contact local emergency services or the police. A trusted adult can help if you are a young person. The practice of saving evidence, such as screenshots and dates, is useful if you need to report.
After you regain control
- Review your account activity from the time of the takeover and note anything done in your name.
- Think about how it might have happened. Was the password reused? Did you click a link? Did a service tell you of a breach? Try to close that gap.
- Consider moving to a password manager and unique passwords across your accounts.
- Keep an eye on the account for a few weeks.
- If the account was a game profile, the points in game account security apply as well.
Recovery results differ by service, and some losses cannot be reversed. That uncertainty is a good reason to set up protections ahead of time, but it is also a reason to avoid blaming yourself. Anyone can be tricked, and the best response is to fix what you can and learn from it.