Account Security
How to Tell If Someone Took Over Your Account
An account takeover may cause password changes, unknown devices, messages you did not send, new recovery details, or missing funds. These signs can also result from a mistake, so verify through the official provider and secure the account immediately.
What are the clearest takeover signs?
Look for a password that no longer works, an unfamiliar recovery email, messages or posts you did not send, unknown devices, security settings you did not change, or purchases you do not recognize. One alert may be an error, but several changes together need urgent attention.
- Password suddenly fails.
- Recovery details changed.
- Unknown device or session.
- Messages you did not send.
What should I do first?
Use the provider's official app or website, not a link in an alert. If you can sign in, secure the account immediately. If you cannot, start official recovery and protect the email address connected to it.
- Open the official provider site.
- Do not argue with a suspicious caller.
- Do not share one-time codes.
What information is unsafe to submit?
Never enter a current password, recovery code, authentication code, card number, bank detail, or government identifier into an exposure checker. Check only identifiers you own or are authorized to manage.
Recover control through the provider
Use the official recovery page, confirm your original recovery methods, and follow the provider's identity-verification process. Avoid paid recovery services that request your password or remote access.
- Use official recovery.
- Reject requests for remote access.
- Keep case numbers.
Remove the attacker's access
Change the password, sign out all sessions, remove unknown devices and connected apps, restore your recovery details, and inspect forwarding or delegation settings.
- Sign out everywhere.
- Remove unknown apps.
- Restore recovery settings.
Check financial and connected accounts
Review statements and other accounts that use the compromised email or password. Contact financial institutions immediately about unauthorized transactions. Change reused passwords everywhere.
- Review transactions.
- Change reused passwords.
- Contact the bank about unauthorized activity.
Report and monitor
Report confirmed compromise to the provider and relevant authorities. 4safer can show known exposure context for a permitted email, but it cannot prove an account takeover or guarantee that no intrusion occurred.
Frequently asked questions
Is a locked account proof of takeover?
No. A lockout can result from failed attempts, a security policy, or an attack. Use official recovery and review activity.
Should I delete the account?
Not before securing it and preserving evidence. Closing an account may make recovery or investigation harder.
Can an exposed password cause takeover?
It can increase risk, especially when reused, but exposure alone does not prove that someone accessed the account.
Sources
This guide is reviewed against official guidance. External pages may be updated by their respective owners.