If you clicked a phishing link, close the page and do not enter more information. If you entered a password, change it from the service’s official site or app, then end unknown sessions and turn on 2FA. Check for downloads or new extensions, scan the device, report the message, and use official recovery if account details changed.
Open the account’s Security or Sign-In & Security settings, select Two-Factor Authentication, 2-Step Verification, or MFA, then follow the setup prompts. Prefer a passkey or authenticator app over SMS when the service offers it. Save the recovery codes offline, add a second recovery method, and test a fresh sign-in before ending the session.
Start with any device where the account is still signed in, then use backup codes or another enrolled verification method. If the authenticator app supports cloud restoration, restore it only through its official process. Otherwise, use the account provider’s recovery page or contact a work-account administrator. After access returns, remove the lost phone and enroll a new authenticator.
Report a fake social media account impersonating you, preserve evidence, protect your real account, and verify the platform has removed or restricted it.
Learn how to check email forwarding rules, forwarding addresses, filters, sign-in activity, and security settings for unauthorized mailbox access.