I gave a scammer my password or a verification code: what to do now

1. Change the password on the real site or app. Open the app or type the address yourself. Don’t use any link from the message. Make the new password long and unique.
2. Sign out of all other devices. Most accounts have a “sign out everywhere” option in their security settings. It kicks out anyone using your old password.
3. Turn on two-step verification, and remember: no real company will ever ask you to read a code back to them.
4. Change the same password anywhere else you used it, starting with your email account, since it can reset everything else.
5. If it was your bank or a payment account, call the fraud line on the back of your card or in the bank’s app, tell them your login details were stolen, and ask them to watch for transfers.

The scammer may have changed your password already. Use the account’s official recovery steps: the FTC keeps links to recovery pages for major email and social media accounts (opens in a new tab). Run a security scan on your computer first, in case anything was installed.

Once you’re back in, look for anything you didn’t set up:

• Recovery email addresses and phone numbers. Remove any you don’t recognize.
• Email forwarding rules and filters that send your mail to someone else or hide messages.
• Sent and deleted messages. Scammers often message your contacts asking for money.
• New payees, linked cards, or devices on bank and payment accounts.

If the scammer could reach your contacts, tell friends and family your account was taken over and not to act on any recent messages from it asking for money, codes, or gift cards.

Report the scam at ReportFraud.ftc.gov (opens in a new tab). If money was taken, also follow I sent money to a scammer: what to do now.