Secure an account someone else used

If you notice something you didn't do, like a sign-in you don't recognise, a password change or a message about your email changing, someone else may have your password. Act straight away.

Step 1: Get back in

Sign in with your password, a passkey, or a code. If the password no longer works, select Forgot password? and reset it with a code. If you can't sign in at all, see Get back into your account.

Step 2: Lock the door

1. Change your password to a new one you've never used. This signs out every other device. How to change it.
2. Sign out everywhere else. Review where you're signed in and end anything you don't recognise.
3. Check your email or mobile on the account is still yours. If it changed, change it back.
4. Check your passkeys. Remove any you didn't save.

Step 3: Look at what happened

Review your account activity for the last 90 days. It shows sign-ins, failed sign-ins, and changes to your password, contact details, passkeys and sessions, with the rough network each came from.

Step 4: Protect the rest

• Secure your email or phone. Anyone who can read your messages can get codes. Change your email password and turn on your email provider's extra protection.
• Change reused passwords. If you used the same password on other sites, change it there too. Reused passwords spread a single leak across many accounts (Das et al., 2014).
• Check the sites you use. Look for posts, messages or purchases you didn't make, and tell those sites.
• Add a passkey. A passkey can't be phished or reused.

If we noticed first

If an old sign-in token is used a second time, which can mean it was copied, we end that sign-in on every device that shared it and you need to sign in again. If we believe an account has been taken over, we may turn it off to protect it. Learn more.

Tell us about anything you can't fix with the contact form.