Account takeover recovery checklist
Work from the top of the dependency chain. Finishing one account completely is safer than changing several passwords halfway.
Recover accounts in dependency order
Start with the account that can reset the others. For many people, that is the primary email account.
Root account
Secure email and its recovery methods from a device you reasonably believe is safe.
Active access
End unknown sessions and inspect forwarding, app passwords, connected apps, and multifactor methods.
Connected harm
Review financial, work, cloud, and social accounts that reused credentials or received reset messages.
Map account dependencies before changing passwords at random. Primary email, mobile number, password manager, device account, and financial accounts can reset or approve access elsewhere. Secure the account with the greatest control first, then work outward while recording completed actions and unresolved provider cases.
Review persistence, not just the password. Unknown sessions, forwarding rules, recovery addresses, app passwords, connected applications, delegated access, and multifactor methods may keep access open. Use a device you reasonably trust and the provider's official recovery entry point. Tell affected contacts what happened without sending them suspicious content or exposing private evidence.
- Secure the account that can reset the others.
- Remove sessions and recovery methods you do not recognize.
- Check connected accounts for reuse, messages, or transactions.
Why email and recovery methods come first
- Changing only the password may leave a malicious forwarding rule or recovery method in place.
- Do not pay someone who contacts you unexpectedly and promises to recover the account.
- A password manager makes unique replacement passwords easier to maintain.
Evidence basis: The cited sources support the checks above. They do not replace current provider, property, workplace, authority, or local requirements. Federal Trade Commission: What To Do if You Were Scammed and CISA: Secure Our World.
Order matters
If a social account and email are both compromised, securing email first can stop the attacker from immediately resetting the social password again. Then each connected account can be reviewed from that stronger base.
Recovery tools differ by provider
Session controls, forwarding rules, connected apps, and recovery options vary. Work from a reasonably safe device and use the provider's official recovery path, not an unsolicited service promising to restore access.