Retaking an Account That Someone Else Controls

When an account is taken over, the instinct is to change the password. That is correct and insufficient. A competent attacker establishes ways back in within minutes, and none of them are affected by a password change.

First, from a device you trust

Do not work from the device you suspect. If something on it captured the credentials, it will capture the new ones. Use a different computer or phone.

Change the password to something new and unique.

Sign out of all sessions. Every service has this, variously labelled active sessions, devices, or where you're signed in. A password change alone does not always terminate existing sessions, which means the attacker stays connected.

Those two steps together end current access. Everything after this removes persistence.

The persistence checklist

This is the part people skip.

Recovery email and phone. Attackers add their own so they can reset the password later. Check both, remove anything you do not recognise, and confirm what remains is current.

Second factors. Look at what is registered. An attacker who added their own authenticator or key retains access. Remove unknown entries and re-register your own.

Email forwarding rules and filters. On email accounts specifically. A rule that quietly copies everything to another address, or one that deletes security notifications so you never see them, is the classic move. Check both forwarding settings and message rules.

Connected apps and authorised third parties. Anything with an active token can read the account without the password. Revoke everything unfamiliar.

App-specific passwords, where the service supports them. These bypass two-factor authentication by design.

Delegated access. Some services allow granting another account access. Check for it.

Payment methods and addresses. Anything added should be removed.

Profile and contact details, which may have been altered.

Then work outward

Change passwords on accounts that used the same password. If you cannot remember, use the manager's reuse audit or assume the worst for anything important.

Change passwords on accounts recoverable through the compromised one. If your email was taken, every account whose reset goes there is exposed regardless of its own password.

Check those accounts for the same persistence — recovery settings, connected apps, forwarding.

Warn your contacts, particularly if the account sends messages. Compromised accounts are used to phish people who trust you, and a warning prevents real harm.

If it is a financial account

Contact the institution directly, on a number you look up yourself, before anything else. They can freeze activity in ways you cannot.

Review transactions, including small ones. Test charges of a dollar or two precede larger fraud.

Ask about a credit freeze if personal details were exposed.

Keep records — dates, times, what you saw, who you spoke to. Disputes go better with a timeline.

If you cannot get back in

Use the service's account recovery flow, which exists for exactly this. Be prepared for it to be slow and to ask for details.

Do it from a device and network you have used before. Familiar signals carry weight.

Have specifics ready: approximate creation date, previous passwords, recovery details as they used to be, payment records for paid accounts.

Do not start over repeatedly. Many recovery processes impose a deliberate waiting period, and restarting resets it.

Report it to the service as a compromise, not just as a forgotten password. Different queue, different treatment.

Afterwards

Register a phishing-resistant second factor if you did not have one. Passkeys and hardware keys stop the attack that most likely caused this.

Generate fresh recovery codes and store them offline. Old ones may be in the attacker's hands.

Check the device you suspected. Run a scan, review installed applications and browser extensions, and consider a clean reinstall if you have real reason to suspect it.

Work out how it happened, if you can. A reused password from a breach, a phishing page, a compromised device, or a SIM swap each imply a different fix. Repeating the same exposure is common.

The order that matters

If you do nothing else in sequence, do this: different device, change password, sign out everywhere, check recovery settings, check forwarding rules, revoke connected apps.

Those six steps in that order close the door and remove the keys the attacker cut. Password alone leaves the keys.