Account takeover: what to do in the first hour
Secure the email root, end unknown sessions and preserve a recovery trail in the right order.

Practical guides for authentication, impersonation, recovery and the decisions that keep one compromised account from becoming five.
If you need to organise the evidence before choosing a guide, begin with the breach response builder.
Secure the email root, end unknown sessions and preserve a recovery trail in the right order.
Compare security keys, authenticator apps, passkeys and SMS by threat, not by slogans.
Passkeys replace shared secrets with device-held credentials and can reduce phishing risk.
Sudden loss of mobile service can be an account-security signal, especially when paired with login alerts.
Compare history, relationships and independent contact routes before reporting or engaging.
A clear timeline helps banks, platforms and official bodies understand what happened.
Use remote controls, carrier support and session review while protecting the recovery channel.
An attacker can keep receiving mail after a password change unless hidden rules and sessions are removed.
Secure the email root, end unknown sessions and preserve a recovery trail in the right order.
Apply the pause, verify and decide method to the current situation.
Browse the complete set of practical digital trust guides.