What to do after regaining access and securing it again

Once you get back into an account, phone, or email, secure it right away before you do anything else. If there’s any chance someone else knew the password or passcode, change it first. Then check activity, sessions, recovery details, and forwarding rules so you can close any opening they might still have.

Prerequisites

• Access to the account, phone, or email you just regained
• A trusted device you control
• Any backup sign-in method, recovery email, phone number, or backup code you still have
• Enough time to review recent activity, devices, sign-ins, and settings before you move on

Change the password or passcode first

Before you touch anything else, set a new password, passcode, or device PIN if there’s any chance someone else knew the old one.

• Use a password or passcode that is new and not reused anywhere else.
• If the account offers it, sign out of other sessions after changing it.
• If this is a phone or tablet, update the device passcode too, not just the app or account password.
• If you used a shared device or a public computer to regain access, avoid saving the new password there.

If you suspect the old credential was exposed, don’t keep it around “just in case.” A changed password only helps if the old one can’t still be used. If the account supports it, choose the option that forces a reset for all active sessions after the change.

Turn on the strongest sign-in protection you can

Add extra sign-in protection right after the password change. The safest option is usually an authenticator app, a security key, or another method that does not rely only on text messages.

1. Open the account’s security or sign-in settings.
2. Turn on multi-factor authentication if it isn’t already enabled.
3. Choose the strongest method the account supports.
4. Set up backup access methods now, while you still have control.

For example, if you can choose between SMS codes and app-based codes, app-based codes are usually the better pick because they don’t depend on your phone number alone. If the service offers backup methods, set them up now so you still have a way in if your main device is lost or replaced. Keep those backup methods tied to you, not to anyone else who might still have access to the old setup.

Check where the account was used while you were locked out

Next, review recent activity so you can spot logins or actions you don’t recognize. Look at sign-in history, active devices, message logs, sent items, recovery changes, and account settings.

1. Open the recent activity or security history page.
2. Review the dates, locations, devices, and IP-based details shown there if the service provides them.
3. Check for messages, purchases, downloads, deletions, password changes, or profile edits you did not make.
4. Review account settings for changes to recovery details, forwarding, payment information, and connected apps.

If something looks unfamiliar, treat it as a warning sign even if the login location seems close to yours. Some services show only limited details, so the absence of proof is not the same as proof that nothing happened. If you see actions you didn’t do, move straight to session cleanup and recovery updates.

Log out of other devices and remove anything you don’t recognize

End every session you don’t trust. That usually means signing out of other devices, browsers, tablets, or apps that are still connected to the account.

1. Open the list of signed-in devices or sessions.
2. Remove anything you don’t recognize.
3. Use the option to sign out everywhere if the account offers it.
4. Revoke app access for unknown third-party apps connected to the account.

If you use sign-out everywhere, you may get logged out on devices you still need, including email apps, messaging apps, and work software. Be ready to sign back in on your trusted devices.

This step matters because changing the password does not always kick out every active session right away. If an attacker already has a valid session token, they may stay connected until you remove that session.

Update recovery email, phone number, and backup codes

Now fix the recovery options so the account points to you, not to old or exposed contact details.

1. Replace any recovery email address or phone number that you no longer use or do not fully trust.
2. Check that the recovery details belong to you and are current.
3. Generate new backup codes if the service supports them.
4. Store backup codes somewhere safe and separate from the account itself.

If backup codes are shown only once, save them right away. A password manager, a printed copy stored securely, or another offline place can work better than leaving them in the same email inbox you are trying to protect. If you changed phones or email providers, make sure the account can still reach you through the new setup.

Look for silent changes that are easy to miss

Some of the most important changes are the ones that do not trigger an obvious alert. Check for anything that could quietly route data away from you or give someone else future access.

• Email forwarding rules
• Auto-replies or vacation messages you did not set
• Password reset methods or trusted devices
• Payment cards, payout details, or billing addresses
• Shared access, delegates, connected apps, or linked accounts
• Mail filters that hide, archive, or delete messages

If this is email, forwarding rules and filters deserve special attention because they can send copies of your mail to someone else without making a scene. If this is a payment or shopping account, inspect saved cards, addresses, and one-click payment settings. For work accounts, also check delegates, shared mailboxes, and team access settings. Anything unfamiliar should be removed or reset before you move on.

Tell the right people if the account was used unexpectedly

If the account was used in a way you did not authorize, tell the people who could be affected. Use a simple rule: if the account could expose money, private messages, customer data, or work systems, report it.

For a personal account, that may mean notifying contacts if messages were sent from your account, and contacting your bank or card issuer if payment details were changed or used. For a work account, tell your employer, IT team, security team, or support desk as soon as you can, especially if the account had access to company files, email, or internal tools.

If the platform has a support or security report path, use it. Give them the basics: when you lost access, when you got back in, what looked wrong, and what you already changed. That makes it easier for them to check for abuse and, if needed, lock down related access.

Make a quick prevention checklist for next time

Save a short routine so the next recovery is faster and cleaner.

• Keep recovery email and phone details current.
• Use a password manager so each account has its own password.
• Turn on multi-factor authentication wherever it’s available.
• Review recent activity and signed-in devices about once a month.
• Keep backup codes in a safe place you can reach.
• Remove old apps, devices, and forwarding rules you no longer need.

If you repeat this check now and then, you’re less likely to get stuck for long the next time something goes wrong. The goal is not to overdo it; it’s to make sure you can get back in without giving anyone else an easy second chance.

What if you still see suspicious activity after you’re back in

Treat that as an active compromise, not a finished recovery. Change the password again, sign out of every session, remove unknown devices and app access, and check whether the attacker added a new recovery method, forwarding rule, or payment detail. If the account keeps locking you out, the problem may be tied to a linked email, phone number, or another account that still has access. In that case, secure the linked account first and contact the platform’s support team with the specific signs you found.

Completion

You know the cleanup worked when the account has a new password or passcode, stronger sign-in protection is on, recovery details point to you, unknown sessions and devices are gone, and any forwarding rules, apps, or payment details you don’t recognize have been removed. If the account was used unexpectedly, the right people have been told and any support or security report has been sent.

Conclusion

Once you’re back in, move through the cleanup in this order: password or passcode, stronger sign-in protection, activity review, session cleanup, recovery updates, and hidden setting checks. If you found signs of use you didn’t approve, tell the people who could be affected before you put the account back into normal use. Then save the prevention checklist so the next recovery is faster.

Frequently Asked Questions

Should I change the password before checking activity?

Yes. If someone else may know the old password or passcode, change it first so they can’t keep using it while you review the account.

Is text-message MFA good enough?

It’s better than no extra protection, but app-based codes, security keys, or other stronger methods are usually better when the account supports them.

Do I need to tell people if only my personal email was used?

If messages were sent from your account, contacts may need a warning so they don’t trust scams or strange requests from that address.