iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume the password is exposed. Close the suspicious page, open the legitimate service through a saved bookmark, official app, or carefully verified address, and change the password immediately. Then change every reused copy—starting with your email and financial accounts—review sign-ins and recovery settings, revoke unfamiliar access, and enable multifactor authentication.
Act in this order during the first few minutes
- Close the fake page. Do not enter more information, download anything, or use a password-reset link shown there. Microsoft’s typosquatting guidance is direct: “Close that browser tab and start again.”
- Reopen the real service from a trusted route. Use a saved bookmark, the service’s official mobile or desktop app, or an address you verify character by character. Do not follow the original link or a follow-up message from the suspicious site.
- Change the exposed password. Sign in only through the legitimate service and create a long, unique password that you have never used elsewhere. If you cannot sign in, go directly to the provider’s official account-recovery page.
- Change every reused or similar password. Treat accounts using the same password, a close variation, or the same password with a different suffix as exposed.
- Secure the accounts that can unlock others. Change your email password first if it can receive reset messages, then protect financial accounts and services connected to that email address.
- Review account activity and turn on stronger sign-in protection. Check recent sessions, devices, recovery details, and security settings before enabling multifactor authentication (MFA).
Changing the password is urgent even if you see no suspicious activity. A fake site can capture credentials without immediately using them, and an absence of alerts does not prove that nobody has logged in.
Understand what happened: typosquatting
Typosquatting is the registration of a domain that contains a common misspelling of a legitimate organization’s domain. A criminal may copy the real sign-in page so closely that the only obvious difference is the web address. Variations include a substituted character, an added or missing letter, an extra word, a different punctuation mark, or a look-alike domain ending.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The copied page may be designed to collect passwords, payment details, or one-time codes. It may also offer a download containing malware. Entering a password is enough to require account remediation; you do not need proof that the attacker successfully logged in before taking these steps.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Change the password safely and remove reuse
Use a new password at the real service
From the legitimate site’s security or password settings, replace the exposed password with a unique one. A password manager can generate and remember a different password for each account, which reduces the damage from a future disclosure. Do not recycle a familiar phrase by changing only one character: attackers routinely test predictable variations.
Map every place the password was reused
Search your password manager, browser-saved passwords, or personal records for the exposed password and its variations. Change each matching account directly at that service. Prioritize in this order:
- Your primary email account: It can often reset other accounts and may receive security alerts.
- Accounts that use the affected email address for sign-in or recovery: This includes services where you log in with that email address.
- Financial and payment accounts: Banks, card issuers, brokerages, digital wallets, and shopping accounts with stored payment details deserve immediate attention.
- Work, school, cloud-storage, and administrative accounts: These may expose organizational data or provide access to other systems.
- Every remaining reused account: Finish the list even if those services appear unimportant; attackers can use them to impersonate you or send convincing messages.
Google’s compromised-account guidance specifically includes reused-password accounts, services that contact you through the affected Google email address, places where you sign in with that address, and locations where the password was saved. The same principle applies to any email provider.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you cannot sign in
Use the service’s official recovery process by typing its known address yourself or opening its official app. Follow the provider’s identity checks and change the password after access is restored. If recovery details have been replaced, contact the provider through its official help channel. Never send a new password, recovery code, or identity document to the typosquatted domain or to someone who contacts you unexpectedly.
Check whether someone accessed the account
Inspect recent sign-ins and devices
Open the account’s official security page and review recent sign-in history, active sessions, and registered devices. Look for devices, browsers, operating systems, applications, or times that you do not recognize. Where the provider offers the option, sign out or remove unfamiliar devices and revoke unknown sessions.
Review recovery and security settings
Check the recovery email address, phone number, authenticator registrations, security keys, forwarding rules, delegated access, and any newly created app passwords. Correct unfamiliar changes immediately. Attackers sometimes add their own recovery method so they can regain access after you change the password.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Interpret location alerts carefully
Location shown in a sign-in alert is usually approximate. Microsoft notes that mobile networks can make a legitimate login appear to come from a different place. Compare the location with the device, operating system, browser, application, and timestamp. A matching device and time may explain an odd map point; an unfamiliar device or application remains suspicious even when the displayed city is familiar.
Revoke access using the provider’s controls
Use the service’s own “sign out all sessions,” device-removal, connected-app, or token-revocation controls when available. Changing a password does not necessarily terminate an attacker’s existing session, so look for separate session controls. The exact labels and sequence differ by provider; Google and Microsoft publish account-specific workflows rather than one universal procedure.
Turn on MFA, preferably a phishing-resistant method
MFA adds a second proof of identity, making a stolen password less useful. Enable it on the affected account and then on your email, financial, work, and school accounts. First review and revoke unfamiliar sessions; MFA protects future sign-ins but does not automatically remove an attacker who is already signed in.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Method | Phishing resistance | Compatibility and recovery considerations |
|---|---|---|
| Password only | None if the password is disclosed | Works almost everywhere, but provides no additional barrier after a phishing disclosure. |
| SMS or email one-time code | Provides an additional layer, but a scammer can sometimes trick you into giving the code to a fake site or attacker. | Often broadly supported; depends on phone or email access and can be difficult during account takeover. |
| Authenticator application | Stronger than SMS or email codes according to the FTC, but a user can still be deceived into entering a generated code on a phishing page. | Requires a compatible app and a recovery plan if the phone is lost or replaced. |
| Security key using FIDO/WebAuthn | Phishing-resistant. CISA says the protocol blocks an authentication attempt when an attacker sends you to a fake website. | Requires a service and device that support FIDO/WebAuthn, plus careful enrollment of backup keys or another recovery method. |
When the service supports it, choose FIDO/WebAuthn, such as a hardware security key or a compatible platform authenticator. CISA describes FIDO/WebAuthn as the only widely available phishing-resistant authentication and urges organizations to plan a move to it. Availability varies by account, device, browser, and organization, so keep the provider’s recovery options current.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Escalate when the account or information is sensitive
Work and school credentials
Tell your organization’s IT or security team promptly if the exposed password belongs to work or school. Include the approximate time, the suspicious domain, whether you entered a one-time code, and whether you downloaded anything. The team may need to invalidate sessions, reset additional credentials, inspect sign-in logs, or protect other users who received the same link.
Banking and payment information
If you entered a card number, bank login, security code, or other financial information, contact the relevant financial institution using the number on its official website, card, or statement. Ask what account-protection and monitoring steps it recommends. Do not use contact details supplied by the suspicious page.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Possible identity theft
If the incident includes evidence of identity theft, the Federal Trade Commission directs consumers to IdentityTheft.gov for the appropriate reporting and recovery process. Preserve emails, screenshots, the suspicious address, and timestamps for the provider or investigators.
What not to do after entering the password
- Do not keep testing the fake page. Additional entries give the attacker more information.
- Do not trust an incoming “security” call or message. A successful phishing attempt is often followed by impersonation. Start every support interaction from the provider’s known website or app.
- Do not assume a password change ended every session. Check and revoke active sessions separately.
- Do not rely on a location alert alone. Evaluate the device, browser, application, and time as well as the approximate location.
- Do not wait for proof of misuse. The practical response is the same whether or not an attacker has attempted a login.
Prevent the next typosquatting attempt
Use trusted entry points
Save bookmarks or favorites for banking, email, work, school, and other high-value services. Open those bookmarks or the official app instead of clicking unexpected links in email, text messages, social media, or search advertisements.
Read the entire domain
Before entering credentials, inspect the address bar. Confirm the organization’s exact domain, spelling, domain ending, and the position of each slash. A padlock or HTTPS connection encrypts the connection but does not prove that the site belongs to the organization you intended to visit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Let unique passwords limit the blast radius
Use a password manager to generate a separate password for every account. If one site is impersonated or breached, uniqueness prevents the same password from opening your email, finances, and other services.
Prefer phishing-resistant MFA
Enroll a FIDO/WebAuthn security key or platform authenticator where supported, and register a backup authenticator or recovery method according to the provider’s instructions. Keep recovery details accurate and store backup codes securely rather than in the same account they protect.
Quick Recap
A practical completion checklist
- The suspicious tab is closed and no further information was entered there.
- The legitimate service was opened through a trusted route.
- The exposed password was replaced with a unique password.
- Every reused or similar password was changed, especially email and financial accounts.
- Recent sign-ins, devices, recovery methods, connected applications, and security settings were checked.
- Unfamiliar sessions or devices were removed using official controls.
- MFA was enabled, with FIDO/WebAuthn selected where the account and device support it.
- Work or school IT was notified when organizational credentials were involved.
- The financial institution was contacted when payment or banking information was submitted.
- Evidence was preserved and IdentityTheft.gov was used when identity theft is indicated.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
