What to Do If You Think Someone Else Used Your Account

TL;DR — If you think someone else used your account, act in this order: change your password, sign out other sessions, turn on two-factor authentication (2FA, a second login step), and remove any unknown devices, apps, or recovery methods. The most likely fix is that an old password was reused somewhere else, so changing it everywhere it was reused is critical. Reading time: ~5 min

Goal

When you finish, your account will have a new strong password, all other active sessions will be signed out, two-factor authentication will be enabled, and any unknown devices, connected apps, or recovery details will be removed so only you can access the account.

Prerequisites

• Your account login page URL
• Access to the email address tied to the account
• Access to your phone or authenticator app for two-factor authentication
• Your provider's dashboard access for the account (the exact menu names vary by provider)
• If available, your recent sign-in history or security activity page
• A password manager app or browser password manager to save the new password
• If you cannot sign in: access to the provider's password reset flow and any backup codes you previously saved

Steps

Step 1: Sign in from a device you trust

Open your account login page in a browser on your own phone or computer, then sign in.

Exact menu path if you are already signed in:

Profile or Avatar menu → Account → Security

What you should see when this succeeds: a Security or Account page that shows password, sessions, devices, or two-factor authentication options.

Step 2: Change your password immediately

In your provider's dashboard, go to:

Profile or Avatar menu → Account → Security → Password → Change password

Enter these literal values in the form fields:

Current password: your current password
New password: a new password with 16+ characters, unique to this account
Confirm password: the same new password

If your provider shows a "Sign out of other sessions" checkbox on the password screen, set it to:

Checked

If you use a password manager, generate and save a new password there before you submit.

What you should see when this succeeds: a confirmation message such as "Password changed" or you are asked to sign in again with the new password.

⚠️ If you reused this old password on other sites, those accounts are also at risk. Change the password on those accounts too, starting with your email account and any banking or shopping accounts.

Step 3: Sign out all other sessions and devices

In your provider's dashboard, go to:

Profile or Avatar menu → Account → Security → Sessions

or, if your provider uses a devices page:

Profile or Avatar menu → Account → Security → Devices

Click the literal action that matches your provider:

Sign out all other sessions

or:

Log out of all devices except this one

If the page lists devices one by one, remove every device you do not recognize.

What you should see when this succeeds: the list shows only your current device, or a message such as "Other sessions signed out."

Step 4: Turn on two-factor authentication

In your provider's dashboard, go to:

Profile or Avatar menu → Account → Security → Two-factor authentication

Choose this option if available:

Authenticator app

Then follow the on-screen setup. If the provider gives you a QR code, scan it with your authenticator app and enter the 6-digit code shown by the app.

If the provider asks for a method and only offers SMS, choose:

Text message (SMS)

If backup codes are offered, click:

Generate backup codes

Then save them in your password manager or print them.

What you should see when this succeeds: the two-factor authentication status changes to "On," "Enabled," or a green check appears.

Step 5: Remove unknown recovery methods and connected apps

In your provider's dashboard, check these menu paths one by one:

Profile or Avatar menu → Account → Security → Recovery email
Profile or Avatar menu → Account → Security → Recovery phone
Profile or Avatar menu → Account → Security → Connected apps
Profile or Avatar menu → Account → Security → API tokens or Access tokens

Take these literal actions:

Recovery email: remove any address you do not recognize
Recovery phone: remove any number you do not recognize
Connected apps: revoke any app you do not recognize
API tokens or Access tokens: delete any token you did not create

What you should see when this succeeds: only your own recovery email, your own phone number, and your known apps or tokens remain.

Step 6: Review recent account activity

In your provider's dashboard, go to one of these common paths:

Profile or Avatar menu → Account → Security → Login history
Profile or Avatar menu → Account → Security → Recent activity
Profile or Avatar menu → Account → Audit log

Look for entries you do not recognize, especially:

New device signed in
Password changed
Recovery email changed
API token created
Two-factor authentication disabled

If you find suspicious changes, reverse them from the same area if possible. If you cannot reverse them, contact the provider's support team and include the exact timestamps from the activity log.

What you should see when this succeeds: the recent activity matches your own actions, or you have a short list of exact suspicious events to report.

Step 7: Check your email account too

If someone accessed your main account, they may also have access to your email. Open your email provider and repeat these paths there:

Profile or Avatar menu → Account → Security → Password
Profile or Avatar menu → Account → Security → Sessions or Devices
Profile or Avatar menu → Account → Security → Two-factor authentication

Take the same literal actions:

Change password
Sign out other sessions
Enable two-factor authentication
Remove unknown recovery methods and connected apps

What you should see when this succeeds: your email account shows only your devices and has two-factor authentication enabled.

Step 8: Contact support if you lost access or see changes you cannot undo

If you cannot sign in, use the provider's reset flow first:

Login page → Forgot password?

If that fails, contact support from the provider's official support page and send this exact checklist in your message:

- I think someone else accessed my account
- My account email: your email address
- Approximate time I noticed it: YYYY-MM-DD HH:MM and time zone
- Suspicious events seen in login history: list exact timestamps
- Changes I did not make: password change / recovery email / API token / connected app / billing change
- I have already changed my password and enabled 2FA: yes/no

What you should see when this succeeds: you receive a case number or confirmation email from support.

Verify it works

Run these checks in the account dashboard:

1. Open:

Profile or Avatar menu → Account → Security → Sessions or Devices

Expected result:

Only your current device or your known devices are listed

1. Open:

Profile or Avatar menu → Account → Security → Two-factor authentication

Expected result:

Status shows On, Enabled, or a green check

1. Sign out, then sign back in with your new password. Expected result:

The old password no longer works, the new password works, and you are prompted for your 2FA code

1. Open:

Profile or Avatar menu → Account → Security → Connected apps / API tokens

Expected result:

No unknown apps or tokens remain

1. Open your email inbox for security alerts from the provider. Expected result:

You see alerts for your own password change, session sign-out, or 2FA setup, and no new unknown alerts after that

Common pitfalls

You changed the password but did not sign out other sessions

Mistake: only updating the password.

Symptom: a suspicious device still appears in Sessions or the attacker stays signed in on an existing session.

Fix: go to Account → Security → Sessions and click Sign out all other sessions.

You enabled SMS 2FA but your phone number on file is wrong

Mistake: turning on text-message codes without checking the saved phone number.

Symptom: you never receive the login code.

Fix: go to Account → Security → Recovery phone and replace it with your current number, then retry 2FA setup.

You removed unknown devices but left connected apps or API tokens active

Mistake: cleaning up devices only.

Symptom: suspicious activity continues even after all sessions are signed out.

Fix: go to Account → Security → Connected apps and Account → Security → API tokens, then revoke unknown entries.

You secured the app account but not the email account behind it

Mistake: stopping after fixing the first account.

Symptom: password reset emails or security alerts disappear, or account changes happen again.

Fix: repeat the same password, session, and 2FA steps in your email provider account immediately.

You reused the same new password on multiple sites

Mistake: setting one new password everywhere.

Symptom: another breached site can expose the same password again.

Fix: generate a unique password for each account in your password manager and save each one separately.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.