Skip to content
Practical technology, explained simply

Step-by-step guides · security

What to do if someone got into your account

Step by step, what to do if you suspect someone has got into your account: contain the access, recover it and warn others without making things worse.

Ibrahin · Published on 2 September 2026 · 4 min read

Text drafted with artificial intelligence. The topic, the angle and the final review are Ibrahin's. How AI is used here

Someone working through an account recovery on a phone and a laptop
Illustration, not a real screenshot.

What has happened

The signs are usually these: a sign-in you didn’t make, a password changed without your permission, sent messages you didn’t write or a recovery email that isn’t yours. Any one of them is enough to act.

Why it matters to you

Changing only the password doesn’t always lock out whoever got in: an open session, an authorised app or a forwarding rule lets them stay. And if what they have is your email, they can reset all your other accounts even if you change their passwords.

What you can do, in this order

1. Check the device and go in through the official door

Before changing anything, update the phone or computer you’ll use and run an antivirus scan, or use another device you know is clean: if it has spyware, it could see the new password too. Microsoft asks you to do this before changing your password, and the US Federal Trade Commission gives the same advice.

Then type the service’s address yourself. If you can’t get in, use its official recovery: Google, Apple and Microsoft each have their own. Never pay anyone offering to “unlock” it.

2. Secure your main email first

If the affected account isn’t your email, first protect the email that receives its recovery links: new password, two-step verification, and remove any forwarding or devices you don’t know. Forwarding is a setting that sends a copy of your email to another address: in Gmail it’s under Settings, “See all settings”, “Forwarding and POP/IMAP” tab, and also “Filters and Blocked Addresses”, because a filter can forward messages too; in Outlook.com, under Settings, Mail, Forwarding, and check the rules as well.

3. A new, unique password

Generate it with a password manager. If you used the old one elsewhere, change those too, starting with your bank, payments and your Apple, Google or Microsoft account.

4. Close every door

Remove anything you don’t recognise: open sessions, devices, authorised apps (programs you gave permission to access your account) and passkeys (a way to sign in without a password, using your phone or fingerprint). Also check that the recovery email and phone number are yours. Where to find each one:

  • Google: at myaccount.google.com, “Security & sign-in”. There you’ll find “Your devices”, to sign out of sessions, and “Passkeys and security keys”. Apps with access are under “Linked apps”. The recovery email and phone are on the same page, under “How you sign in to Google”.
  • Apple: in Settings, tap your name. Scroll down to your device list, tap one you don’t recognise and choose “Remove from Account”. On the same screen, “Sign in with Apple” lists the apps using your account. Apple also suggests asking your mobile provider whether anyone has set up forwarding of your text messages.
  • Microsoft: at account.live.com/Activity you can see recent sign-ins. Under “Advanced security options” there’s “Sign out everywhere”, which can take up to 24 hours.

And if the service gave you recovery codes, generate new ones: with Google and Microsoft, creating new ones makes the old ones stop working.

5. See what may have happened and warn people

  • Check sent messages, purchases, profile changes and shared files, and note the dates.
  • If you see a charge, call your bank through its official channel; if it’s a work account, tell whoever handles security.
  • If the account sent messages, warn your contacts through another channel, not from the affected account.
  • Keep the evidence, such as screenshots and messages, without posting screenshots showing codes or other people’s details.
  • If you’re in the UK and have lost money, tell your bank and report it to Report Fraud, which replaced Action Fraud in December 2025 (in Scotland, call the police on 101). In the US, the Federal Trade Commission explains the steps on its consumer site.

If you’re in Spain, INCIBE’s free helpline, Tu Ayuda en Ciberseguridad, is open on 017 every day from 8:00 to 23:00, also on WhatsApp (900 116 117; save it to your contacts first) and Telegram (@INCIBE017).

The recommendation

Don’t try to fix ten accounts at once. First the device you sign in from; then the account that can reset all the others, which is almost always your email; then, one by one.

Sources

Review

Responsible for publication: Ibrahin. Date: 2026-09-02. Last checked: 2026-10-17. Steps and menus taken from the NCSC, the FTC, INCIBE and the Google, Apple and Microsoft help pages. Menu names may change.