Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Treat the password as exposed, but don’t assume the account has already been taken over. Go to the real service using a bookmark or its official address—not the suspicious link—then change the password, sign out other sessions, and replace it anywhere else you reused it. If you also shared a sign-in code, approved a prompt, or granted an app access, take the additional steps below.
Secure the account you used to sign in
- Open the legitimate service independently. Use a known-good bookmark or type its official address yourself. Don’t use the fake site or follow links in its messages to reach account settings.
- Change the exposed password. Use the real provider’s password-reset or account-security flow. OpenAI advises changing a password immediately if it may have been exposed. OpenAI’s account-security guidance gives steps for suspected unauthorized access.
- Sign out other sessions. In the official account settings, use the option to log out of all sessions or devices if available. Review recent sign-ins, devices, security events, recovery information, and account settings for changes you did not make.
Logout behavior depends on the provider. For ChatGPT, OpenAI says changing the password logs out current sessions within 30 minutes; do not assume that timing applies to other services. OpenAI’s session guidance explains its account-specific controls.
Change any reused password
If you used the same password on other sites, change it on every one of them. Start with your email account and any Google or Microsoft account used to sign in to other services or recover their passwords. Those accounts can provide a route into many other accounts.
Give each account a different password. A password manager can generate and store unique credentials; OpenAI and the FTC both recommend unique passwords. The FTC also advises changing every account that uses a password shared with a scammer. FTC guidance on phishing scams explains what to do after sharing information.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
If you signed in with Google or Microsoft
Secure the Google or Microsoft account used for sign-in, not just the AI service account. Change that identity account’s password through its official site, end unfamiliar sessions, and inspect its security activity and connected apps. OpenAI specifically advises users who authenticate with Google or Microsoft to reset that account’s password. OpenAI’s account guidance covers this distinction.
If you shared a code or approved a sign-in
Sharing a one-time code or approving an unexpected push prompt raises the risk that someone is actively trying to take over the account. Deny any sign-in prompt you did not initiate. From the real provider’s site, reset the password, revoke other sessions, review recovery methods and security settings, and contact support if you see unauthorized activity or cannot regain control.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Fake login pages can capture both passwords and MFA codes. MFA methods do not all resist phishing equally. CISA identifies FIDO/WebAuthn—used by passkeys and security keys—as a phishing-resistant approach that blocks a fake-site login attempt. CISA’s MFA guidance describes the differences between MFA methods.
Check app access and other credentials
Revoke access you approved
Review connected apps, third-party access, and consent grants in the real provider’s security settings. If you approved an app or consent screen on the fake site, revoke unfamiliar grants as well as changing your password. Password changes may not invalidate every access token: an FBI Internet Crime Complaint Center advisory from September 2026 describes consent phishing in which a token can preserve access after a password change. The IC3 advisory explains that threat.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Revoke a pasted API key
If you pasted an API key rather than an account password, treat the key as compromised: delete or revoke it in the legitimate provider’s dashboard, inspect API usage for activity you do not recognize, and contact support. OpenAI’s account-security guidance recommends those steps for a potentially compromised API key. OpenAI’s guidance is specific to OpenAI accounts.
Consider device security only if you downloaded or ran something
Entering a password alone does not establish that your device has malware. If you downloaded or opened a file from the fake site, or ran software it offered, treat that as a separate possible device-security incident and seek help appropriate to your device and organization.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
Turn on stronger sign-in after containment
Once you have reset the password and revoked sessions, enable MFA if the service offers it. Prefer a passkey or FIDO/WebAuthn security key where supported and practical; CISA says these methods are phishing-resistant. Check the provider’s available recovery options before relying on any one method. A new MFA setup does not necessarily terminate sessions already open—OpenAI explicitly notes this—so set it up after resetting the password and signing out other sessions. CISA’s MFA guidance discusses method strength, while OpenAI’s guidance covers its own account controls.
Contact support and report the phishing attempt
Contact the service through support reached from its genuine website if you find unfamiliar activity, cannot secure the account, or cannot regain access. For a work or school account, alert your organization’s IT or security team promptly.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
In the United States, the FTC advises reporting phishing to ReportFraud.ftc.gov. The FBI IC3 advisory requests reports related to the consent-phishing activity it describes; reporting routes and agencies vary by country.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
