iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Act immediately, but use only the real service from now on. Stop using the scammer’s link or phone number, write down exactly what you disclosed, then open the account through its official app, a bookmark you already trust, or a verified website. Change the exposed password and every reused copy, sign out other sessions, enable multifactor authentication (MFA), inspect account activity and recovery details, and contact your employer, school, bank, or card issuer if their information was involved.
Sharing a password does not by itself prove that someone signed in, took over the account, or installed malware. Treat those as possibilities to check, not established facts.
1. Stop interacting with the scam and preserve the details
Do not click another link, call another number, install software, or disclose a verification code because the message tells you to. A scammer may try to keep you in the same conversation while you attempt to “fix” the problem.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems- Close the suspicious page or call. Do not use a recovery link, QR code, phone number, or email address supplied by the message.
- Record what happened while it is fresh. Note the service or account name, the sender, the website or app used, the date and time, the username or account number, the password you shared, and any other information you entered. Save the message, screenshots, and relevant headers if available.
- List every detail disclosed. Include security questions, one-time codes, recovery email addresses, phone numbers, payment details, identity numbers, or information about your workplace or school. The response depends on what else the scammer saw.
Microsoft’s phishing guidance recommends writing down the details of the attack, including usernames, account numbers, passwords, and where the incident occurred. Keep the evidence for your provider, IT department, or financial institution; do not forward it to other people as a warning if doing so would expose your password or personal data.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Change the exposed password through the real service
Use a saved bookmark, the provider’s known mobile app, or a web address you enter yourself. Check the spelling of the domain and the browser’s address bar. If you are uncertain, navigate from the organization’s main website or use contact information on a statement, card, or other trusted account material.
- Open the account’s security or password settings.
- Set a new, long, unique password that you have not used anywhere else.
- Do not reuse a variation of the disclosed password, such as adding a number or changing one character.
- Save the new credential in a reputable password manager or another secure method so you do not have to reuse it.
Microsoft advises changing the password on every affected account and anywhere else the same password was used. The Federal Trade Commission (FTC) likewise recommends unique passwords. A password change blocks use of the old credential, but it does not necessarily end a session that is already open, so continue with the next steps.
Prioritize accounts that can unlock other accounts
Start with the email account used for password resets, then accounts that can reach money, identity records, or your workplace or school. Next address banking and payment services, shopping accounts, social networks, and any other account where the password was reused. This is a practical order based on how accounts depend on one another, not a universal sequence published by every provider.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →3. Sign out other sessions and inspect the account
In the account’s security settings, look for options such as Sign out of all devices, Sign out everywhere, Manage sessions, or Where you’re signed in. Use the broad sign-out option if it is available, then sign in again only on devices you control.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review recent sign-ins, devices, locations, and security alerts. Look for activity you do not recognize, including a new device or a password change you did not make. Also verify that the recovery email address and phone number are still yours and that other security settings have not been altered. Remove unfamiliar recovery methods or sessions after you have confirmed they are not yours.
If the provider offers a security log, save a copy of suspicious entries. An unfamiliar sign-in does not prove that the scammer used the password, because location and device information can sometimes be inaccurate, but it is a reason to secure the account and follow the provider’s instructions.
4. Turn on multifactor authentication
MFA requires a second factor in addition to your password. The FTC identifies text or email codes, authenticator apps, and security keys as common choices; CISA recommends enabling MFA for email, banking, purchases, social media, and other important accounts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Method | What it requires | Independence and recovery considerations | Phishing resistance |
|---|---|---|---|
| Text or email code | Access to your phone number or email inbox | Convenient, but an email account or phone number that is itself compromised may not be an independent second step. Keep the provider’s backup recovery options current. | Codes can be tricked out of you on a fake sign-in page. |
| Authenticator app | An approved app on a phone or tablet | Separate from SMS delivery; store backup codes and follow the provider’s transfer or recovery procedure before replacing the device. | Generally safer than SMS for risks such as SIM swapping or email compromise, but a code can still be entered into a phishing site. |
| Security key | A compatible physical key, often using FIDO2 or a similar standard | Requires service support and a recovery plan if the key is lost. A spare key or another approved recovery method can prevent lockout. | Designed to verify the legitimate site, making it resistant to many phishing attacks. |
No method works identically on every service. Check which factors the account supports, whether the factor is separate from the compromised password and email account, and how you will recover access if your phone or key is unavailable. Never give an MFA code to a person who contacted you unexpectedly; a legitimate support agent should not need you to read a sign-in code back to them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Protect every other account that reused the password
Make a list of services where the same password, or a predictable variation, was used. Change each one through its official channel and give each account a different credential. Include old or rarely used accounts: they may still contain personal information or provide a route to reset another service.
- Email and identity hubs: Change these first because they commonly receive password-reset messages.
- Work and school accounts: Treat them as an urgent escalation, even if you rarely use them.
- Banking, payment, and shopping accounts: Change credentials and review transactions if payment information was exposed.
- Social and messaging accounts: Secure them before an intruder can impersonate you or contact your contacts.
- Other reused services: Replace the password everywhere it appeared, not only on the account named in the scam.
A password manager can generate and store long, unique passwords, which reduces the chance that one disclosure will affect multiple services. It does not replace changing a password that has already been exposed.
6. Recover the account if you can no longer sign in
If the password no longer works, or the recovery details were changed, use the provider’s official account-recovery flow. Start from the provider’s main website or known app rather than a link in the scam message. Recovery questions, identity checks, backup codes, and waiting periods differ by provider, so do not assume that another service’s procedure applies.
Use phone numbers and email addresses shown on the organization’s official site, your account documents, or a trusted statement. Do not pay a person who promises instant recovery or allow an unsolicited caller to control your screen. If you regain access, immediately set a new unique password, sign out other sessions, verify recovery settings, and enable MFA.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
7. Contact the right organization for what else was exposed
Work or school account
Tell your employer’s or school’s IT or security team promptly. Explain that you followed a scam instruction, identify the account, and state exactly what you shared. They may need to revoke sessions, reset credentials, check access logs, or protect other systems connected to the account. Do not hide the incident because a quick report can limit damage even when no unauthorized sign-in is confirmed.
Bank, card, or payment information
Contact the institution using the number on the back of your card, an official statement, or its verified website. State whether you disclosed a password, account number, card details, one-time code, or other information. Ask what monitoring, credential reset, card replacement, or transaction-review steps it recommends. Do not use contact information from the suspicious message.
Identity information or financial loss
If personal information was stolen or you lost money, follow the reporting and recovery process for your country. In the United States, IdentityTheft.gov provides a personalized plan for suspected identity theft. Keep copies of messages, dates, case numbers, and communications with providers.
Recommended Free Tools
8. Decide whether your device needs a malware scan
Entering a password into a fake website can expose the credential without installing anything on your computer or phone. A scan is therefore not an automatic requirement after every password disclosure.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Consider a device check if you installed software at the scammer’s direction, granted remote access, see repeated unexpected password-change prompts, or notice other signs that unwanted software may be present. Google recommends updating antivirus software, scanning the computer, and removing unwanted software when harmful software may be involved. Run those steps from the device’s legitimate security tools or a trusted provider, not from a pop-up that tells you to download a “fix.”
9. Verify messages while you clean up
After a scam, criminals may send follow-up messages pretending to be your provider, bank, employer, or a recovery specialist. Treat unexpected urgency, threats of account closure, requests for passwords or MFA codes, and demands for remote access as warning signs.
- Open the service yourself instead of clicking the message’s link.
- Check alerts inside the official app or account dashboard.
- Call a number from an official website, card, statement, or trusted account material.
- Never disclose a password or verification code to someone who contacted you unexpectedly.
- Report the original phishing message through the service’s built-in reporting option when available.
10. What to monitor after the reset
Keep the incident notes and watch the secured accounts for unfamiliar sign-ins, password-reset notices, changed recovery details, or transactions you do not recognize. Respond to each alert through the official service, not through the alert’s embedded link. If a provider confirms unauthorized access, follow its additional containment and notification instructions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The essential sequence is: stop the scam, document the disclosure, change the password through the real service, replace every reused copy, end other sessions, enable MFA, inspect activity and recovery settings, and escalate to the organization responsible for any work, school, financial, or identity information involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
