Think someone got into your accounts? Lock them down on Mac

Steps

1. 01

   Start from a device you trust

   • Use a device that was not involved; if this Mac might be the problem, check it first
   • Type each address yourself; never follow a link from an email or text

   !Careful: Nobody genuine needs your password or a sign-in code — not Apple, Google, Microsoft, your bank, or Menda. A request for either one is the scam itself.

   Also see: Think your Mac has malware? What to check

2. 02

   Change your Apple Account and email passwords first

   Password resets arrive by email, so the mailbox comes first

   • Change your Apple Account password to a strong one used nowhere else, then your email password if that is separate
   • Then change every account that shared the old password
   • Locked out of your Apple Account? Start recovery at iforgot.apple.com
3. 03

   Turn on two-factor authentication

   • Apple:Apple menu›System Settings›your name›Sign-In & Security›Two-Factor Authentication
   • Google: myaccount.google.com›Security›2-Step Verification
   • Microsoft: account.microsoft.com›Security›Advanced security options›Additional security›Two-step verification›Turn on

   Why?

   The NCSC's reason for it: even if a criminal knows your password, they will not be able to get into your account. Keep any backup codes you are given on paper, somewhere safe.

4. 04

   Check your devices and sign out of the ones that aren't yours

   • Apple: account.apple.com›Devices, and remove any device you do not recognise
   • Google: myaccount.google.com›Security›Your devices, and sign out of anything unfamiliar
   • Microsoft: account.microsoft.com›Security›Advanced security options›Sign out everywhere›Sign out
5. 05

   Check email forwarding and rules

   A forwarding rule quietly sends a copy of your mail to someone else, and keeps working after a password change

   • In iCloud Mail on icloud.com, open Settings and check forwarding and rules
   • Gmail:Settings›See all settings›Forwarding and POP/IMAP; then the Filters and Blocked Addresses tab
   • Outlook.com:Settings›Mail›Forwarding, and clear 'Enable forwarding' unless you set it;then Mail›Rules, and delete rules you did not create

   Why?

   The NCSC describes setting up a forwarding rule as a common tactic once someone has been inside a mailbox, which is why this check is not optional.

6. 06

   Check for breaches, tell people, watch your money

   • Enter your email address at haveibeenpwned.com to see which known data breaches included it — it never needs a password
   • Change the password on any site it lists, and anywhere that shared it
   • Tell your contacts to treat recent messages from you with suspicion
   • Check your bank statements; if anything is wrong, phone the bank on the number on your card, then report it at reportfraud.police.uk

   Why?

   The NCSC names haveibeenpwned.com as a tool for checking whether your details appeared in a public data breach. A result there means a site you used was breached, not that someone is in your account today.