Account taken over checklist

In the first hour

1. Get back in the official way, from the owner’s usual device. End any call asking for a code.
2. Warn people on a channel the attacker can’t reach: don’t reply, click or pay.
3. Take screenshots of alerts, posts and changed settings, with the time showing.
4. Change the password, then sign every other device out.
5. Remove what the attacker added, then turn on two-factor.

If you can't get back in

• Win back the email account first.
• Use the service’s own recovery page, and answer every question.
• Ask Access Now’s helpline if the platform is slow.

Close the way in

• Work out how they got in, and fix that.
• Recovery email, phone and backup codes current and safe.

Write it down

When it was noticed

When access came back