Guides
How to respond when an online account or personal record is exposed
Account exposure response, step by step: pick a trusted route, secure recovery channels, freeze your credit, report the misuse, and keep watching.
What to take away
An account exposure response runs in the same order every time: close the attacker's routes, then prove the account is clean.
- Open the service by typing its address or using its app, never through the alert's link or phone number.
- Save the alert, its headers, the time, and the affected username before you change anything.
- Secure the recovery email, carrier account, and backup codes first; they reset everything else.
- Read forwarding rules, delegates, linked apps, and active sessions, because a new password leaves them running.
- Log every step with dates until recovery, reporting, and monitoring are finished.
These steps fit an ordinary personal account: email, social, shopping, cloud storage. If exposure touches these account types, hand it to their incident process:
- work
- school
- clinical
- legal
- financial
- government account
Start on a route you chose
An unexpected warning is not a route. Do not use its link, phone number, QR code, attachment, or remote-support offer. Open the official app, or type the address you already know.
Which device to use
Did the device run an unknown attachment, grant remote access, or act oddly?
Move to a second trusted device
Stay on this device
If the warning arrived on a work device, tell the designated team and leave the cleanup to them.
Move to a second trusted device when the first one ran an unknown attachment, granted remote access, or is behaving oddly. Stop entering passwords and card numbers on the questionable device until someone assesses it.
Save a narrow record
Keep the original alert, the sender details, the headers if you can see them, and the date and time. Add the username, the security events you can see, settings that changed, devices you do not recognize, and any case number.
What to save from the alert
- Original alert and sender details
- Headers, date, and time
- Username and visible security events
- Changed settings and unknown devices
- Case number
Photograph the screen if taking a screenshot would change the page. Do not forward a malicious attachment to friends, and do not gather more private content than the incident needs.
Secure the recovery chain first
Begin with the primary email and any password manager, because both can reset your other accounts.
Secure recovery chain in order
- Primary email and password manager
- Recovery email and carrier account
- Phone number and trusted devices
- Security keys and backup codes
If a recovery phone or email changed without your permission, use the provider's own recovery flow instead of guessing. Google's account recovery, Apple's account recovery, and Meta's help page for a hacked account each start from the sign-in screen and run their own identity checks. Repeated guesses can trigger a lockout, so record the exact error and follow the steps the provider gives you.
Recover the account itself
Microsoft's compromised-account recovery page sends Microsoft Account users to its sign-in helper. It also recommends checking a Windows PC for malware before changing the password, then reviewing connected accounts, forwarding, and automatic replies. Those instructions apply only to supported Microsoft accounts and systems.
If you can still sign in:
- Sign in from a trusted device, change the password on the service's own page, and turn on strong authentication.
- Revoke active sessions, app passwords, tokens, and linked apps you do not recognize.
- Set a new recovery email, phone number, and backup codes, and remove any you did not add.
- Delete forwarding rules, filters, delegates, and automatic replies you did not create.
- Save the security history and confirm the contact details on the account.
If you can still sign in
- Change password to a unique value
- End other sessions from account controls
- Replace unknown recovery methods and factors
- Save fresh backup codes
- Remove unfamiliar apps, devices, and delegates
If you cannot sign in, use the recovery form published on the provider's own site or app, reached from its sign-in screen or help center, and never one offered in a message. Anyone who offers paid recovery in a comment or direct message is outside that process unless the provider confirms them through a channel you already trust.
Look for what survives a password change
In email, read forwarding addresses, filters, rules, and delegates.
What survives a password change
- Email forwarding, filters, rules, delegates
- Connected mail clients and sent mail
- Vacation replies and linked cloud storage
- Social posts, admins, login history, apps
- Shopping addresses, cards, loyalty points
In social accounts, check posts, messages, profile fields, and advertisements. Also check administrators, linked pages, login history, and authorized apps. Also check payment methods and privacy settings. In shopping accounts, check addresses, orders, stored cards, and loyalty points. Also check gift-card balances.
Keep an unfamiliar item separate from a confirmed unauthorized action. A login location can be a service relay or a mobile network. Write it down, compare the provider's explanation, and do not name a person yet.
Break the reuse
Search the password manager for every account that used the exposed password.
Accounts to re-password
- Email
- Finance
- Telecom
- Government
- Work
- Cloud storage
Do not change twenty passwords from a device you suspect. Contain the device first, or use another trusted system. Turn on strong authentication, and stop relying only on codes sent to the mailbox that was exposed.
Check the device and the phone line
Review operating-system accounts. Review browser extensions. Review installed apps. Review device administrators. Review configuration profiles. Review remote-access tools. Update the software and use a malware assessment suited to the device.
If calls or texts stop unexpectedly, or the carrier reports a SIM change, call the customer service number printed on your bill or listed in the carrier's app, never a number from a message. Set a carrier PIN and move high-consequence accounts off text-based recovery where the service supports something better.
Handle payments and identity data
Review stored cards and recent transactions. Call the financial provider using the number on the card, the statement, or the official app. Report an unauthorized payment before waiting on any online account investigation.
If government identifiers, tax data, health records, or credit information were exposed or used, go to the office that owns that record:
- Taxthe IRS Identity Theft Affidavit, Form 14039, is the route when a return or refund was filed under your Social Security number.
- Social Securitythe Social Security Administration's fraud hotline, plus your online earnings record.
- Health recordsthe U.S. Department of Health and Human Services Office for Civil Rights, which enforces the federal health privacy rules.
- Banks, lenders, and credit bureausthe Consumer Financial Protection Bureau.
- Identity theft in generalIdentityTheft.gov, the Federal Trade Commission's reporting site, which builds a recovery plan and produces an FTC Identity Theft Report you can give to police and creditors. Your state attorney general's consumer protection office takes complaints as well.
In Canada, the Office of the Privacy Commissioner and the relevant provincial commissioner take complaints, and a licensed lawyer can advise on your situation. Keep account takeover evidence separate from an identity-theft claim.
Freeze your credit files
A fraud alert and a security freeze are the two credit-side moves after a Social Security number is exposed, and they do different things:
- A fraud alert tells lenders to verify your identity before opening credit. Contact any one of Equifax, Experian, or TransUnion, and that bureau must pass the alert to the other two.
- A security freeze blocks most lenders from seeing your file until you lift it. You place it at Equifax, Experian, and TransUnion separately, and only you can lift it. Federal law makes the freeze free to place, lift, and remove.
- Pull your reports from AnnualCreditReport.com, the site the Fair Credit Reporting Act authorizes for free credit reports, and dispute anything you do not recognize with both the credit bureau and the company that reported it.
Warn the people who might act
Use a different channel to tell contacts that messages from the affected account during a set period may be false. Name the one action to avoid: opening a file, sending money, sharing a code. Do not tell someone their own account was compromised without evidence.
Preserve fraudulent posts before deleting them, in case a provider, employer, insurer, or investigator needs them. Then correct the public record plainly.
Get the record taken down
Removal depends on where the record sits:
- On a platformuse that site's own report or removal form, which Google, Microsoft, Meta, and most forums publish, and keep the case number.
- On a people-search or data-broker siteuse that site's opt-out page, then check back, because listings often reappear from other sources.
- In a company's filesask the business to delete your personal information. California's consumer privacy law gives residents that right for many categories of data, and several other states have similar laws.
- In a breachthe organization that lost the record is the one you ask to explain it, and your state attorney general and the FTC take complaints when the answer is not adequate.
Confirm, then keep watching
Run harmless tests. Sign in on a clean device. Receive an authentication prompt. Verify recovery. Inspect active sessions. Send a test message. Confirm the unwanted rules are gone. Check security events again after 24 hours, then on a schedule you set.
Keep a dated log until recovery is complete. Keep it until reporting, payments, and contact warnings are closed. Keep it until device checks and monitoring are closed.
Common questions
Should I delete the account immediately?
Contain it first. Deleting it can destroy evidence, messages, purchases, and recovery routes, and it may not erase what the provider already retained.
Does a new password sign out every device?
Not always. Use the service's session controls, then review tokens, app passwords, linked apps, and forwarding rules. Some stay active until you remove them by hand.
Should I warn all my contacts?
Warn the people plausibly affected, give the time window and the action to avoid, and leave out personal details they do not need.
Can a recovery service guarantee access?
No one outside the provider can guarantee its decision. Use the provider's verified recovery process, and treat unsolicited paid offers as suspect.
