Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Treat the warning as a prompt to verify and act—not as proof of exactly what an attacker accessed or whether an order was placed. Open the retailer’s known website or app yourself, avoid links and phone numbers in an unexpected message, and use the retailer’s own security and recovery controls.
If you find unfamiliar activity, assume the retailer account and any reused credentials need attention. Secure the account, inspect orders and payment settings, protect the email account used for recovery, and contact your bank or card issuer if financial access or transactions may be exposed.
First, verify that the warning is genuine
A compromised-account warning can arrive by email, text, phone call, or an in-app message. The message itself may be legitimate, but an unexpected security notice is also a common way to lure people to a fake sign-in page. The Federal Trade Commission (FTC) advises not clicking links in unexpected messages and recommends contacting the company through a phone number or website you already know is real.
- Close the message without selecting its links, attachments, or reply buttons.
- Type the retailer’s familiar web address yourself, use a bookmark you created previously, or open the retailer’s official mobile app from your device’s normal app store.
- Look for a security alert, account message, or help-center notice after signing in. Do not assume that a warning is confirmed merely because it uses the retailer’s logo or your name.
- If you need assistance, find the support number or chat entry on the independently opened website or app. Compare the address carefully with one you have used before.
Do not provide a password, verification code, full card number, or identity document to someone who contacted you unexpectedly. A genuine support representative should not need you to disclose a one-time sign-in code to “verify” the account.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Secure the retailer account while you can still sign in
If the retailer’s site or app accepts your current credentials, make the changes there immediately. The exact menu names differ, so look under labels such as Account, Security, Sign-in and security, or Privacy.
Change the password
Set a long, unique password that you have never used on another service. A password manager can generate and store one. Do not modify the old password by adding a number or punctuation mark; an attacker who obtained the old value may guess that variation.
End other sessions if the retailer provides that control
Some retailers show a list of signed-in browsers or devices and offer Sign out of all devices, Revoke sessions, or a similar command. Use it when available, then sign in again with the new password. Do not promise that every retailer has this feature; if no session control is visible, changing the password and contacting official support are still useful steps.
Turn on multi-factor authentication
Enable every MFA option the retailer supports that you can reliably use. MFA asks for an additional proof after the password, reducing the value of a stolen password. CISA’s guidance specifically includes online stores among the accounts where users should look for MFA.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check recovery details
Confirm that the recovery email address and phone number belong to you. Remove unfamiliar addresses, numbers, authenticator devices, or backup codes and regenerate backup codes if the retailer allows it. A changed recovery address can let an intruder take the account back after you reset it.
Inspect the account for changes you did not make
A warning does not establish whether an order was placed or what information was accessed. Your account’s own history can show signs of misuse, but the retailer’s investigation is the authority on breach scope. Review each area below and record anything unfamiliar before deleting messages or closing the account.
- Orders and returns: Look for purchases, cancellations, refunds, gift-card activity, or shipping changes you do not recognize.
- Payment methods: Check saved cards, bank accounts, wallets, and billing names. An unfamiliar payment method or a familiar card with a changed billing address warrants prompt follow-up.
- Shipping and profile addresses: Verify every delivery address, pickup location, and name on the account.
- Email and phone details: Confirm that contact information has not been replaced or supplemented with an attacker’s details.
- Security settings: Look for changed passwords, newly enrolled MFA devices, altered recovery options, app authorizations, or notification preferences.
- Account activity: If the retailer displays sign-ins, devices, IP locations, or timestamps, note entries that do not match your use. Location data can be imprecise, so treat it as a clue rather than proof.
Use the retailer’s official support channel to report unauthorized orders, profile changes, or payment activity. Keep the case number, dates, screenshots, and copies of relevant receipts. Do not send screenshots containing a full card number or a one-time code unless the verified support process specifically requires secure submission.
Recommended Free Tools
If you cannot log in
Repeatedly trying an old password can trigger additional lockouts. Start with the retailer’s account-recovery page reached from its known website or app, not from the warning message.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Choose the retailer’s Forgot password, Account recovery, or equivalent option.
- Use the recovery email or phone you previously controlled. Check spam and junk folders, but do not trust a reset message if it sends you to a domain you do not recognize.
- If the recovery details were changed, follow the site’s “I no longer have access” path or contact support using details published on the independently verified site.
- Tell support that you suspect unauthorized access, identify any unrecognized orders or changes, and ask what evidence they need. Never share a password or verification code over an unsolicited call or message.
- After access is restored, replace the password, review sessions and recovery details, enable available MFA, and inspect the account again.
If a retailer confirms that it cannot restore the account through its normal process, ask how to close or freeze the account and how to dispute unauthorized transactions. The available options depend on that retailer’s policies.
Change reused passwords and secure your email
If the retailer password was used anywhere else, change those other accounts immediately, beginning with email, financial services, cloud storage, social networks, and any account that can reset another password. Give each service a different password; otherwise, one stolen retailer credential can unlock several accounts.
The email account connected to retailer recovery deserves special attention. Someone who controls it may intercept password-reset links for other services even after you fix the retailer account. Review the email account’s password, MFA enrollment, recovery addresses and phone numbers, signed-in devices, forwarding rules, filters, delegated access, and connected applications. Remove anything you did not create. The FTC states: “If you get a verification passcode by email, use a strong password and two-factor authentication on your email account.”
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Check sent mail, deleted mail, and security notifications for reset requests or messages an intruder may have hidden. If the email provider offers a session-revocation or sign-out-everywhere option, use it after changing the password. Save recovery codes in a secure location that is not the compromised mailbox.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose an MFA method the retailer actually supports
Do not buy or configure a second factor until you have checked the retailer’s security settings. Availability varies by service, region, account type, and app version.
| Method | What it requires | Important considerations |
|---|---|---|
| Authenticator app | A code-generating app on a phone or tablet | Works without cellular service in many implementations; protect the device and keep the app’s recovery process available. |
| Text or voice code | Access to the enrolled phone number | Use it if it is the retailer’s available option, but treat it as less resilient than phishing-resistant methods because codes can be intercepted or tricked from a user. |
| Email code | Access to the recovery mailbox | Secure the email account first with a unique password and MFA; otherwise email compromise can undermine the second factor. |
| Security key | A compatible physical key used as the second factor | The FTC says, “Security keys are physical devices that you use as your second authentication factor.” Verify that the retailer supports security keys and that your account and device are compatible before purchasing one. |
Register a backup method only where you can protect it. Store backup codes offline or in a password manager, and never post them in notes shared with other people.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Respond when payment information may be exposed
Contact the bank or card issuer that maintains the affected account promptly if you see an unfamiliar transaction, believe card or bank-access information was stolen, or cannot determine whether a saved payment method was used. Use the number on the physical card, a statement, or the institution’s independently verified website—not a number in the unexpected warning.
- Ask what monitoring, replacement, freeze, or dispute steps apply to your situation.
- Review recent and pending transactions, including small authorization amounts that can precede larger fraud.
- Change the online-banking password if it was reused at the retailer, and enable MFA offered by the financial institution.
- Continue monitoring statements after the initial report; keep records of dates, representatives, and case numbers.
A retailer’s notice alone does not prove that your card number was stolen. Let the issuer determine whether a transaction is unauthorized and follow its deadlines for reporting it.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Escalate suspected identity misuse
If you believe personal information from the account is being used to impersonate you, open the FTC’s IdentityTheft.gov resource and use its reporting and personalized recovery plan. It can help organize actions such as documenting misuse and contacting relevant companies. The appropriate next step depends on what information was involved and what evidence you have.
Keep a dated incident file containing the original notice, retailer case details, account screenshots, transaction records, password-change dates, and correspondence. Do not include full passwords or complete payment numbers in that file.
Use this response order
- Now: Verify the warning independently and avoid its links and phone numbers.
- During the same session: Change the retailer password, end other sessions if offered, enable MFA, and restore your own recovery details.
- Next: Review orders, payments, addresses, contact information, security settings, and activity logs; report unauthorized changes to the retailer.
- Afterward: Change reused passwords, secure the connected email account, and inspect email forwarding and recovery settings.
- If indicated: Call the bank or card issuer about suspicious transactions or stolen payment access information.
- If identity misuse is suspected: Report it through IdentityTheft.gov and follow its recovery plan.
This sequence limits further access while preserving the records you may need for the retailer, your financial institution, or an identity-theft report.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
