What a takeover actually means
An account takeover happens when someone other than you gains control of one of your online accounts. They may have your password, a one-time code, or access to the email address or phone number linked to the account. Sometimes the attacker locks you out. Sometimes they stay quiet and watch, which is harder to notice.
Recovery advice is usually presented as a checklist. A checklist is easier to follow when you understand what each item is for, because the right order depends on what the attacker may still be able to do. The steps below describe the common pattern. Specific services differ, and nothing here guarantees that an account can be recovered or that no harm was done.
Step 1: Work from a device you trust
Before changing anything, make sure the device you are using is not part of the problem. If a program on your phone or computer is capturing what you type, a new password entered there goes straight to the attacker.
The purpose of this step is to avoid fixing the lock while the intruder watches. Running security scans, applying pending software updates and, where possible, using a different device you trust are all ways of reducing that risk. Antivirus software and built-in protection can help find some known threats but cannot promise to find all of them.
Step 2: Secure the email account first
Email is often the master key. Most services let you reset a password by sending a link to the registered address. If an attacker controls that inbox, they can take over other accounts one by one, and they can also remove your reset messages before you see them.
So the purpose of securing email early is to cut off the route to every other account. That means changing its password, checking recovery options such as backup addresses and phone numbers, and looking for forwarding rules or filters you did not create. Forwarding rules are a known way to keep receiving copies of your mail after a password change.
Step 3: Change the password, and make it new
Changing the password ends the attacker’s ability to sign in with the old one. The new password should be unique, meaning not used anywhere else, and not a small variation of the old one. If the same password protected other accounts, those need new ones too, since attackers often try a leaked password on many sites.
A password manager makes unique passwords practical because you do not need to remember them. Good secure password habits also include length over cleverness. The step is to end access, not just to make the password harder to guess.
Step 4: Sign out other sessions and remove connected access
Changing a password does not always end sessions that are already signed in. Many services keep a device logged in through a stored token. Their security settings often include a “sign out of all devices” option.
The purpose is to throw out anyone who is still connected. It is also worth reviewing:
- apps and services that have been granted access to the account
- devices listed as trusted
- saved payment methods and shipping addresses
- recovery phone numbers and email addresses
Attackers sometimes add their own details so that they can regain control later. Removing anything unfamiliar closes those side doors.
Step 5: Turn on stronger sign-in protection
Once the account is yours again, add a second barrier. Two-factor authentication means a stolen password alone is not enough to get in. Methods differ in strength: codes sent by text message are better than nothing but can be intercepted, especially through SIM swapping, while an authenticator app or a security key is generally harder to defeat. A passkey login removes the typed password from the process altogether, where the service offers it.
The purpose here is to make a repeat attempt harder. It does not remove every risk, but it raises the effort required.
Step 6: Look at what the attacker did
Review recent activity, sent messages, changed settings and any purchases or transfers. This step is about measuring the damage and finding things that need further action, such as:
- messages sent from your account to your contacts, which may need a short warning that they should ignore them
- changed security questions or recovery options
- orders, subscriptions or payments you did not make
Many services show a login history with times and rough locations. Treat this as a clue, not proof, since locations can be inaccurate.
Step 7: Report it and protect your money
If money or payment cards are involved, contact the bank or card provider through the number on the card or in their official app. They can block cards and review transactions. Fraud alerts and credit freezes, where available in your country, can reduce the chance that stolen identity details are used to open new accounts. Whether money can be recovered depends on the circumstances and the provider, so avoid assuming it will be.
Most large services also have an account recovery or reporting form. Using it creates a record and, in some cases, helps them restore a locked account. If your own account was used to contact others, telling them promptly limits the spread.
Step 8: Work out how it happened
The final step is understanding the cause, because without that the same entry point may stay open. Common routes include a reused password from an old data breach, a convincing phishing page, an infected device, or a call that persuaded you to read out a code. Identifying which one applies tells you what to fix: a reused password calls for new unique ones, a phishing page for more caution about links, and so on.
This is not about blame. Careful people are caught regularly, as the way social engineering exploits trust and urgency shows.
What recovery cannot promise
Even a thorough response may not restore everything. Deleted data may be gone, funds may not be returned, and exposed personal details cannot be un-exposed. That is why the preventive layers matter, but an incident handled calmly and in a logical order usually leaves you in a much better position than one handled in a panic.