Quick answer
Lock down the account that resets almost everything else.
- Start with: Change a reused or exposed password
- Finish with: Save recovery options safely
- Pause if: Do not reuse recovery passwords
Primary sources for this guide: CISA: Secure Our World account protection; FTC: Use two-factor authentication to protect accounts. Check the source that applies to your location and situation before acting.
Know when to escalate: If the situation involves immediate danger, suspected crime, serious health symptoms or a deadline with major legal or financial consequences, contact the appropriate local emergency service, official body or qualified professional.
A step-by-step plan
Change a reused or exposed password
Choose a new password that is unique to this mailbox. Changing a shared password elsewhere first can leave the email account exposed.
For a repeatable way to replace weak or reused credentials, follow How to Create and Store Strong Passwords.
Turn on strong two-step verification
Prefer an authenticator app, passkey or security key when the provider offers one. Store recovery codes somewhere separate from the inbox.
Review sessions and forwarding rules
Sign out devices you do not recognize and inspect forwarding addresses, filters and connected applications for changes you did not make.
Save recovery options safely
Confirm the recovery email and phone number are yours, then record the provider's official recovery page before another problem occurs.
If a suspicious message is part of the problem, use the Scam Message Red-Flag Checker.
Common mistakes and warning signs
Use these checks as reasons to slow down and verify the situation. One warning sign alone does not settle every case.
- Do not reuse recovery passwords
- Check filters attackers may hide
- Record backup codes offline
Progress checkpoints
| Checkpoint | What you should have |
|---|---|
| Before acting | Change a reused or exposed password |
| Before finishing | Save recovery options safely |
| Reason to pause | Do not reuse recovery passwords |
Final checklist
Checklist state stays in this browser tab and is not sent to Help.You.
Sources and further verification
Rules and official processes vary by country and can change. Use the responsible organization for your location and situation. These starting points may cover a different jurisdiction.
Help.You editors structured this page around the task sequence, reviewed it for avoidable risk and checked that its claims stay within general informational scope. Read our content process.