If you typed a password into a page reached from a suspicious message, act as though someone else may know it. You do not need to prove the page was malicious before protecting the account. Start on a device you trust, and open the real service by typing its address yourself or using its app.
Do these first
- Change the password on the real site. Choose a new, unique password; do not use the link from the message.
- If you reused that password anywhere else, change it on those accounts too. Start with your email account, since it may be used to reset other passwords.
- Review recent sign-ins, connected devices and recovery email/phone. Sign out unfamiliar sessions using the service's own security settings.
- Turn on multifactor authentication (MFA) if it is available. Save recovery codes somewhere separate from the account.
Choose the right next step
Only typed a password? The account steps above are the priority.
Also entered a one-time code or approved a sign-in? Check active sessions and account changes promptly; the attacker may already be signed in.
Downloaded or ran a file? Update your security software and run a scan. If you still see suspicious behavior, use a clean device for account recovery.
Check the damage
Look for unfamiliar messages, purchases, forwarding rules and connected apps. Contact your bank directly if payment information or money was involved. If you cannot sign in, use the real provider's account-recovery page. Never pay a stranger who promises to recover your account. The
FTC's phishing guidance explains the separate steps for downloaded files and exposed personal data.
If the password reset fails
Use the provider's official recovery form from a trusted device. Search your email for genuine account-change notices, but open the service independently. Once back in, remove unfamiliar recovery methods and sessions, then check whether messages or payments were made while you were locked out.
