What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If someone tried to access your shopping account, changed its details, placed an order, or left you unable to sign in, act through the retailer’s official app or a web address you already trust. The recovery path depends on one decision: can you still sign in? If yes, change the password, end other sessions, enable available MFA, verify recovery details, and inspect account activity. If no, use the retailer’s official recovery process, secure the email account used for resets, and contact official support and your payment provider about suspicious activity.
What credential stuffing means
Credential stuffing is an automated attack in which criminals try username-and-password combinations obtained from earlier breaches or unrelated services against another site. It succeeds when a person has reused a password. The retailer may not have suffered a password breach at all; an old password exposed elsewhere can be enough for an attacker to get into the retail account.
NIST describes the risk this way: “A consumer who reuses an online account password for their account with an E-Commerce retailer risks having their account used by a malicious user.” A successful login can expose stored addresses, payment details, gift-card balances, loyalty points, order history, and personal information. Attackers may also change the recovery email or phone number so the legitimate owner is locked out.
An older NIST SP 1800-17 example attributed more than 90% of login traffic on many large websites and mobile applications to credential-stuffing attacks in a 2017 study. That is a historical, study-specific figure, not a current rate for retail traffic. No broadly representative recent rate should be assumed from it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
First, choose the right recovery path
| What you see | What to do first |
|---|---|
| You can still sign in and nothing looks changed | Change the password immediately, sign out other sessions, enable available MFA, verify recovery details, and review activity. |
| You can sign in but see an unfamiliar order, address, payment method, gift-card action, or loyalty transaction | Secure the account first, then contact the retailer through its official channel about the suspicious activity and any pending order. |
| You cannot sign in, or your password no longer works | Use the retailer’s official account-recovery flow. Do not use a reset link from an unexpected email or text. |
| Your recovery email or phone was changed, or self-service recovery fails | Secure the email account used for resets and contact the retailer’s official support channel. |
| Your card or other payment account shows an unauthorized charge | Use the payment provider’s known website or phone number to report it and ask about its process. Retailer and payment-provider procedures differ. |
Do not click a sign-in or “fraud alert” link in an unsolicited message. Open the retailer’s known app yourself or type its established web address. A message can imitate a retailer while leading to a phishing page that steals your new password or a one-time code.
If you can still sign in
1. Replace the password with a unique one
- Open the official retailer app or navigate to the retailer’s known website yourself.
- Go to the account area and look for a label such as Password, Security, or Sign-in settings. Retailer labels and menus vary.
- Set a long, new password or passphrase that has never been used on any other service. Do not make a minor variation of the old password.
- Save the new credential in a reputable password manager if you use one, or store it using another method that does not encourage reuse.
- After saving it, sign in again only through the official app or site and confirm that the change succeeded.
The FTC advises changing a compromised password and changing it anywhere that password was reused. A new retail password protects this account; it does not repair the exposure on other accounts that still use the old credential.
2. End sessions on every device
Look for Sign out all devices, Log out everywhere, Active sessions, or a similar control under security settings. Use it after changing the password. The FTC explains: “Sign out of all devices. That way anyone who’s logged in to your account on another device will get kicked out.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some retailers invalidate every session automatically after a password change; others leave existing sessions active. If the account lists individual browsers, phones, or locations, remove anything you do not recognize. If no session-management control exists, ask official support whether it can invalidate active sessions.
3. Turn on the strongest MFA option the retailer actually supports
Multi-factor authentication adds a second factor beyond the password. Enable it in the account’s security settings, then complete the enrollment from a device and recovery method you control. Keep any backup or recovery procedure in a safe place before signing out.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Availability is retailer-specific. A security key or authenticator app can provide stronger protection than a one-time code sent by text, but either option is useful when it is the best supported choice you can reliably recover. Text-message codes can be exposed in a SIM-swap attack. Email codes depend on the security of the email account that receives them.
4. Check recovery email and phone information
Open the account’s recovery or contact-information page. Confirm that every email address and phone number belongs to you, is spelled correctly, and remains accessible. Remove an unfamiliar address or number only after noting it for your report to the retailer. If the retailer sends a confirmation message when details change, verify that the message came from the real service by opening the account directly rather than following its embedded link.
Recommended Free Tools
Your recovery details are as important as the password: an attacker who controls them may be able to reset the account again. Make sure the email account used for retail resets is secured before relying on it.
5. Inspect every part of the account that can be abused
Review activity in a deliberate order and record anything unfamiliar:
- Orders: Look for completed, canceled, and pending purchases, unusual quantities, and shipping destinations you do not recognize.
- Addresses: Check shipping, billing, and pickup addresses. An attacker may add an address without placing an order yet.
- Saved payment methods: Remove an unfamiliar card or bank account only after documenting the last four digits or other identifying details for support.
- Gift cards: Check purchases, redemptions, transfers, and balance changes. Gift-card value can be stolen even when no merchandise order appears.
- Loyalty programs: Inspect points earned, redeemed, transferred, or converted. Account takeover can be used for loyalty-program misappropriation.
- Profile and communication settings: Look for a changed name, delivery preference, email subscription, or notification address that could hide future alerts.
NIST’s e-commerce guidance identifies fraudulent purchases, gift-card purchase or redemption, and loyalty-program abuse as documented takeover uses. The absence of an unfamiliar order does not prove that the account was untouched; check the other categories as well.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
6. Contact the retailer about suspicious changes
Use the help or support path inside the official app or the retailer’s known website. Explain what changed, when you noticed it, and which orders, addresses, payment methods, gift cards, or points are affected. Ask whether the retailer can cancel or hold a pending order, remove unauthorized account changes, and invalidate suspicious sessions. The exact actions depend on that retailer’s policy and on whether an order has already shipped.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Never give a password or one-time verification code to an unexpected caller, text sender, or email correspondent who claims to be support. If a representative needs to verify ownership, start the conversation through the retailer’s official channel and follow its published process.
If you cannot sign in
1. Start with official account recovery
- Open the retailer’s official app or type its known web address manually.
- Select Forgot password, Can’t sign in, or the equivalent account-recovery option.
- Enter the requested identifier and use only the verification method shown in the official flow.
- Set a completely new password when recovery succeeds, then sign out other sessions and enable MFA if available.
The FTC advises locked-out users to follow the service’s account-recovery instructions. Do not keep retrying guesses: repeated attempts can trigger additional locks, and a phishing page can capture every password you try.
2. Secure the email account used for resets
Email is often the control point for retail recovery. From the email provider’s official app or website, change the email password if it was reused, sign out other sessions, enable MFA, and verify recovery addresses and phone numbers. Check for forwarding rules or filters that could hide password-reset messages, and review recent sign-ins if the provider shows them.
Secure email before requesting repeated retail resets. Otherwise, an attacker who still controls the inbox can intercept the reset link and regain the retail account.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteRank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Escalate when recovery details were changed
If the recovery email or phone number no longer belongs to you, or the self-service flow cannot verify you, contact support through a known official channel. State that you suspect account takeover and provide the account identifier, approximate time of the change, and details of any unfamiliar orders or transactions. Ask which ownership-verification documents or information the retailer accepts; do not send extra personal information to an unverified contact.
Once access is restored, perform the full password, session, MFA, recovery-detail, and activity review described above. Restoration of login access alone does not show that an attacker’s address, payment method, gift-card action, or loyalty redemption was removed.
Deal with unauthorized purchases and payment activity
If the retailer account shows an order you did not place, contact the retailer promptly through its official support path. Ask whether it can cancel or investigate a pending order and whether it can freeze or reverse gift-card or loyalty activity. The retailer may have options that disappear after shipment or redemption, but the available action is policy-dependent.
For an unfamiliar charge, contact the card issuer, bank, or other payment provider through its official website, app, or the number printed on the payment instrument. Report the transaction as unauthorized and follow that provider’s instructions. Payment-dispute deadlines and procedures vary; the available guidance here does not establish a universal deadline, so ask the provider what applies to your account.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteKeep a concise record of the retailer case number, order numbers, dates, amounts, messages, and the channels you used. This makes it easier to give consistent information to both the retailer and payment provider without forwarding suspicious messages or exposing passwords.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Change every reused password, starting with email
Credential stuffing works across services, so changing only the retail password leaves the original weakness in place. Make a list of accounts that used the old password or a close variation and replace each with a distinct password. Start with the email account used for retail recovery, then address other accounts that could expose money, personal information, or additional recovery channels.
- Do not reuse the new retail password on email, banking, payment, social, work, or other shopping accounts.
- Change close variations, not just exact matches; attackers commonly try predictable substitutions.
- Use a password manager if it helps you create and maintain unique credentials. No particular product is required for this step.
- Where a service offers it, sign out other sessions and enable MFA after changing the password.
NIST SP 800-63-4 supports the distinct-password rationale: a password exposed on one service should not unlock another. The practical goal is containment—one future breach should not provide a ready-made login for every account.
Choose an MFA method the retailer supports
| Method | Security and trade-off | What to confirm before enabling it |
|---|---|---|
| Security key | The FTC describes security keys as the strongest method among those it discusses. They resist many forms of remote credential theft, but only work if the retailer supports them. | Confirm compatibility and create a safe recovery route if the key is lost, damaged, or unavailable. |
| Authenticator app | Generates codes on a device you control and avoids dependence on the mobile carrier. It still requires a recovery plan if the device is lost. | Check whether the retailer provides backup codes or another approved recovery method and store them securely. |
| Text-message code | Better than password-only access, but the FTC notes that text codes can be exposed in a SIM-swap attack. | Make sure the phone number is yours and know how you would recover access if your number or SIM changes. |
| Email code | Convenient, but its protection depends on the security of the email account receiving the code. | Secure the email account with a unique password and MFA before using it as the retail account’s second factor. |
Do not buy a security key as a required recovery step. It is an optional future-hardening measure only when the retailer accepts that type of MFA and you can maintain a workable backup method.
What to do when the retailer offers few security controls
Some retailers provide only password resets and text or email verification; others offer authenticator apps, security keys, session management, or risk-based extra authentication. Use every reliable control that is available, but do not assume a feature exists because another retailer has it.
NIST SP 1800-17 demonstrates FIDO U2F and risk-based extra authentication in an e-commerce practice guide. It is an implementation example from an earlier project, not a compatibility list for current consumer accounts. Check the retailer’s own security settings and support documentation for the options it currently accepts.
If the retailer cannot invalidate sessions, remove an attacker’s recovery address, or support a method you need, ask support what compensating action it can take. Keep monitoring orders, payment activity, gift-card balances, and loyalty points until the case is resolved.
Common recovery mistakes
- Using a message link: A fake “account locked” notice can steal the replacement password. Navigate independently to the official app or site.
- Changing only one password: Reused credentials remain dangerous on every other service until they are replaced there too.
- Ignoring email security: An attacker in the reset inbox can undo a retail password change.
- Stopping after login returns: Access may be restored while an unauthorized address, card, gift-card action, or loyalty transaction remains.
- Sharing verification codes: A legitimate support process should not require you to disclose a one-time code to an unsolicited contact.
- Assuming a new security key is mandatory: Hardware MFA is conditional on retailer support and should come after the no-cost recovery actions.
- Assuming every provider has the same dispute clock: Ask the payment provider which deadlines and evidence rules apply instead of relying on a universal number.
A compact recovery checklist
- Stop using links in unexpected messages; open the official retailer app or known website.
- Decide whether you can still sign in.
- If you can, change the password to a unique one and sign out all devices or sessions.
- Enable the strongest MFA method the retailer supports and prepare a recovery route.
- Verify recovery email and phone details.
- Inspect orders, addresses, saved payment methods, gift cards, loyalty points, and profile changes.
- Contact the retailer through its official channel about unfamiliar activity.
- If you are locked out, use official recovery and secure the reset email account.
- Report unauthorized charges to the payment provider through its official process.
- Replace the exposed password anywhere else it was reused.
The immediate objective is to remove unauthorized access; the longer-term objective is to ensure the same credential cannot open another account. Treat the retailer’s specific recovery and MFA features as conditional, because no universal menu, compatibility list, or support policy applies to every store.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
