Secure a LinkedIn account after an unfamiliar login or message

An unfamiliar LinkedIn session or message to your connections can indicate account access, but a fake profile imitating you is a different incident. LinkedIn says active sessions can remain open when a browser closes and can be ended from Settings & Privacy; changing the password also closes other active sessions. Contain the access, review contact and profile changes, then tell people who may have received fraudulent requests. If you are locked out, use LinkedIn's compromised-account reporting route.

Before you start​

Use a device you trust. Capture the suspicious message, profile or session details without forwarding private conversations to strangers. Check whether your email account and phone number still belong to you; account recovery depends on them. If money was requested in your name, warn contacts through an independent channel after you have evidence.

Do it step by step​

1. Open LinkedIn Settings & Privacy and inspect where you are signed in or active sessions. Identify your own phone and computer, then close unfamiliar or unneeded sessions.
2. Change the LinkedIn password to a unique one. Enable or review two-step verification using a method you control. Secure the associated email account and check its forwarding and recovery settings.
3. Inspect recent direct messages, invitations, job applications and changes to your profile or contact details. Preserve evidence of anything you did not authorize.
4. Notify affected connections that any payment, code or document request should be ignored and verified independently. Do not send a vague mass warning that repeats a malicious link.
5. If you cannot access the account, use LinkedIn's compromised-account form from an independently opened Help page. If the problem is an impersonating second profile, report that profile through its More, Report or Block route instead.
6. Recheck sessions and account details after recovery. Ask the payment provider or employer to review any transaction or application submitted by an intruder.

Check the result​

Only expected sessions remain, credentials and recovery routes are controlled, unauthorized changes are documented, and affected connections have a clear warning. A fake separate profile is reported under the correct category.

If something goes wrong​

If a session location looks odd, compare device and timing before assuming takeover; network location can be imprecise. If a password change fails because email access is lost, recover the email first. If a suspicious message came from a cloned profile, removing your sessions will not remove the clone.

Know the limit​

Session termination cannot undo messages already read or copies of a resume already submitted. Two-step verification does not prevent a connection from believing a fake lookalike profile. Platform reports are reviewed by LinkedIn, but the user must handle financial or identity exposure through the relevant provider too. LinkedIn session guidance LinkedIn compromised-account route LinkedIn fake-profile reporting