The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Treat the account as actively compromised. From a device you trust, open the provider’s official security or account-recovery page—not a link in an unexpected message. Change the exposed password to a new, unique one, then use the provider’s controls to sign out everywhere or revoke active sessions. If you cannot sign in, start the provider’s recovery process. After you regain control, replace suspicious MFA methods, verify recovery details, inspect devices and account activity, secure every account that reused the password, and address any financial or identity exposure.
Why a disclosed MFA code changes the response
A password and a one-time MFA code together can give an attacker a path into an account, especially if you approved a sign-in prompt or entered the code on a phishing page. The code should be treated as part of the compromise even if it normally expires. Do not assume that waiting for expiration, changing only the password, or deleting one suspicious message removes an attacker who already established a session or added another sign-in method.
The exact buttons depend on the provider, account type, and whether you can still sign in. A consumer email account, a workplace account, and a school account may expose different recovery and session controls. Provider instructions take precedence; Google’s hacked-account checklist is an example of the checks to perform, not a universal menu path.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTake these actions in order
1. Stop giving the attacker more access
Do not answer further requests for a password, verification code, backup code, or sign-in approval. The Federal Trade Commission’s rule is direct: "No matter what the story is, don’t share your verification code with someone if you didn’t contact them first." Reject prompts you did not initiate and do not read a code to a caller who claims to be support.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use an address or app you already know for the provider. A link in an email, text, direct message, or pop-up can lead to a counterfeit login page. If you suspect the current computer or phone has malware, stop using it for recovery and move to a different device you trust.
2. Change the password and end existing access
If you can sign in, change the password immediately. Make it long and unique to this account; never reuse the exposed password. Use the provider’s security page rather than a link supplied by the person who requested the code.
Changing the password is only one part of the response. Look for controls labelled Sign out of all devices, Sign out everywhere, Revoke sessions, or Revoke tokens, and use them. An attacker may have an active browser session, refresh token, app password, or other access that is not removed simply because the password changed. Microsoft’s guidance for a compromised Microsoft 365 environment specifically calls for revoking active sessions; other providers expose equivalent controls under different names.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
After the change, sign in again only through the provider’s normal page or app. Record the time of the change and save any recovery confirmation, but do not store the new password in an unsecured note.
3. If you are locked out, use official recovery
If the attacker changed the password, recovery email, phone number, or MFA method, do not keep guessing credentials. Start the service’s official account-recovery flow from a known address or the provider’s app. Follow every identity-check step and provide an address the provider can use to contact you.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Recovery may require a previously used device, a familiar location, an older password, or other account history. Complete the process from a trusted network when possible. If the first attempt fails, read the provider’s instructions for retry timing and required evidence rather than using a third-party “recovery” service that asks for your password or payment.
4. Replace or remove compromised sign-in methods
Once you are back in, open the MFA or two-step-verification settings. Review every registered authenticator, phone number, security key, backup code, and app password. Remove registrations you do not recognize. Re-enroll a method that you control, following the provider’s instructions, and generate new backup codes if the service offers them.
Do not assume a password change removes an attacker-added authenticator or app password. Managed accounts may require an administrator to remove a device or method. For a workplace Microsoft 365 account, an administrator should review registered MFA devices, remove suspicious entries, and revoke active sessions; consumer account menus and permissions differ.
Keep the disclosed code private. Do not test it by sending it to anyone, and do not approve a new prompt merely because it appears after the password change. A prompt you did not start is still a warning sign.
5. Check recovery settings, devices, and connected apps
Attackers often change settings that let them return or hide their activity. Review these areas one by one:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Recovery email, recovery phone, alternate addresses, and security questions.
- Recent security events, sign-in history, locations, browsers, and signed-in devices.
- Applications and services with account access; revoke anything unfamiliar or no longer needed.
- New forwarding addresses, filters, delegates, automatic replies, signatures, and out-of-office messages.
- Sent, deleted, archived, and trash folders for messages you did not write or remove.
- Rules that mark messages as read, move them, or forward copies outside the organization.
Compare each device and event with your own activity. An unfamiliar location can sometimes reflect a mobile carrier, corporate gateway, or privacy service, so investigate before deciding; an unknown device, newly added method, or setting change you did not make is more urgent. Remove sessions and apps you cannot identify, then change the password again if you discover additional unauthorized changes.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →6. Inspect email especially carefully
Email access can become a control point for other accounts. A forwarding rule can silently send password-reset messages to an attacker, while a filter can hide security alerts. Check delegation and mailbox access as well as ordinary forwarding. Search sent and deleted folders for requests for money, links, attachments, or changes to payment details.
If the account is managed by an employer or school, tell the administrator promptly. They may need to review audit logs, revoke tokens, remove mailbox rules, and protect other users who received messages from the compromised account.
Protect every account connected to the exposed password
Change the same password anywhere it was reused, even if those accounts show no suspicious activity. Prioritize your primary email and any account that uses that email address for password resets. Work through accounts in risk order: email, financial services, identity and government services, cloud storage, work or school systems, shopping, and social accounts.
Use a different password for each service. If you cannot remember unique passwords, a reputable password manager can generate and store them, but do not install or configure one from a link sent by the suspected attacker. Secure the manager itself with a unique master password and the strongest MFA the provider supports.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review active sessions, recovery details, MFA methods, and connected applications on these related accounts as well. An attacker who learned one password may try it elsewhere, and an attacker who controls your email may be able to reset accounts that otherwise appear safe.
Assess financial and identity damage
Check bank, card, payment, tax, investment, and mobile-carrier activity if the compromised account contained payment details, identity documents, account numbers, or messages about transactions. Look for new beneficiaries, shipping addresses, transfers, password-reset notices, and changes to contact information. Contact the relevant institution through the number on its statement or official app if anything is unauthorized or if sensitive information may have been exposed.
In the United States, the Federal Trade Commission directs people who believe personal information was stolen to IdentityTheft.gov, which provides a recovery plan. Requirements and reporting channels differ by country, so use the identity-theft or cybercrime service for your jurisdiction when appropriate. Preserve relevant messages, headers, login alerts, and transaction records; do not forward malicious links to other people.
Warn contacts and contain impersonation
Tell contacts that the account was compromised and that they should ignore recent unusual messages, links, attachments, requests for money, or requests for verification codes. Use another communication channel if the account is still under the attacker’s control. Ask important contacts whether they clicked a link or shared information so they can begin their own response.
Free tools Windows power users keep installed
One-click scans. No signup required.
Review profile changes, automatic replies, and sent messages for impersonation. If the account was used for work, notify the organization’s security or help-desk team so they can warn recipients and check for unauthorized access to shared resources.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Check the device used during the incident
Credential theft can involve a malicious browser extension, infostealer, remote-access tool, or other malware. The FTC advises updating security software and running a scan during recovery. Microsoft’s consumer recovery guidance recommends a full malware scan before changing a password.
If you have a concrete reason to suspect infection, perform recovery from a different trusted device and network. Update the operating system, browser, and security software on the affected device, remove extensions and applications you do not recognize, and run a full scan. If the device still behaves unexpectedly, disconnect it from sensitive accounts and obtain professional or manufacturer-supported cleanup guidance before using it for sign-in again.
Choose stronger MFA after recovery
Future MFA selection can reduce the chance that a stolen password is enough for another takeover. The right option depends on what the account supports and whether you can protect the device or physical key.
| Method | Exposure and protection | Requirements and limits |
|---|---|---|
| SMS or email code | SMS codes can be exposed through a SIM swap. Email codes depend on the security of the mailbox that receives them. | Requires access to the phone number or mailbox; use a stronger method when the provider offers one. |
| Authenticator app | The FTC says authenticator apps are less exposed to SIM-swap or email compromise than SMS or email codes. | Requires a compatible app and a protected device; enrollment and account-recovery procedures vary by provider. |
| FIDO/WebAuthn security key | The FTC identifies security keys as the strongest method in its guide, and CISA describes FIDO/WebAuthn as phishing-resistant. | Requires a compatible account and device plus possession of the enrolled physical key. It must be enrolled correctly and kept available for sign-in. |
These choices are for hardening after the incident, not a reason to delay password changes, session revocation, or recovery. A security key cannot recover an account by itself, and it cannot protect an account that does not support the relevant standard.
Provider and account-type differences to expect
There is no universal sequence of menu names. One provider may place session revocation under Security; another may call it Devices, Where you’re signed in, or Access tokens. Some services separate consumer recovery from administrator controls, and some require a waiting period or additional verification before changing recovery details.
Use the provider’s current help pages and in-product security notices. For managed work or school accounts, involve the administrator early because the organization may need to revoke tokens centrally, inspect audit logs, reset MFA registrations, and check other accounts affected by the incident.
Decisions to avoid while recovering
- Do not continue a conversation with someone who asked for your code, even if they know personal details or claim to be support.
- Do not use a search ad, shortened link, or unexpected attachment to reach account recovery.
- Do not assume a password reset removed every session, token, app password, forwarding rule, or MFA registration.
- Do not delete all evidence before checking sent messages, security events, and financial activity.
- Do not install an unverified “cleanup” or “account recovery” tool that requests credentials.
When the immediate response is complete
You have contained the incident when you have regained control through the provider, changed the exposed password, ended other sessions where the provider allows it, removed unauthorized sign-in methods and apps, verified recovery settings, checked email rules and account activity, secured reused-password accounts, and addressed device, financial, identity, and contact risks. Continue watching security alerts and statements for delayed misuse, particularly on accounts whose recovery email was the compromised mailbox.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
