Think someone got into your accounts? Lock them down

Steps

1. 01

   Start from a device you trust

   • Use a phone or computer that was not involved; if this PC might be the problem, scan it first
   • Type each address yourself; never follow a link from an email or text

   !Careful: Nobody genuine needs your password or a sign-in code — not Microsoft, Apple, Google, your bank, or Menda. A request for either one is the scam itself.

   Also see: Think your PC has a virus? Scan it properly · Spot a phishing email before you click

2. 02

   Change your email password first

   Password resets arrive by email, so the mailbox comes first

   • Give your email a new, long password used nowhere else
   • Then change every account that shared the old password
   • Locked out? Use the provider's own recovery page
3. 03

   Turn on two-step verification

   • Microsoft: account.microsoft.com›Security›Advanced security options›Additional security›Two-step verification›Turn on
   • Google: myaccount.google.com›Security›2-Step Verification
   • Apple, on iPhone or iPad:Settings›your name›Sign-In & Security›Two-Factor Authentication; on a Mac, start from System Settings

   Why?

   The NCSC's reason for it: even if a criminal knows your password, they will not be able to get into your account. Keep any backup codes you are given on paper, somewhere safe.

4. 04

   Check sign-in activity and sign out everywhere

   • Microsoft: account.microsoft.com›Security›View my sign-in activity; for anything that was not you, choose 'Secure your account'
   • Microsoft:Advanced security options›Sign out everywhere›Sign out
   • Apple: account.apple.com›Devices, and remove any device you do not recognise
   • Google: myaccount.google.com›Security›Your devices, and sign out of anything unfamiliar

   Why?

   Microsoft's activity page covers the last 30 days. If an entry sits under 'Unusual activity', the button reads 'This wasn't me' instead. Signing out everywhere can take up to 24 hours and does not cover an Xbox console.

5. 05

   Check email forwarding and rules

   A forwarding rule quietly sends a copy of your mail to someone else, and keeps working after a password change

   • Outlook.com:Settings›Mail›Forwarding, and clear 'Enable forwarding' unless you set it;then Mail›Rules, and delete rules you did not create
   • Gmail:Settings›See all settings›Forwarding and POP/IMAP; then the Filters and Blocked Addresses tab
   • In iCloud Mail on icloud.com, open Settings and check forwarding and rules

   Why?

   The NCSC describes setting up a forwarding rule as a common tactic once someone has been inside a mailbox, which is why this check is not optional.

6. 06

   Check for breaches, tell people, watch your money

   • Enter your email address at haveibeenpwned.com to see which known data breaches included it — it never needs a password
   • Change the password on any site it lists, and anywhere that shared it
   • Tell your contacts to treat recent messages from you with suspicion
   • Check your bank statements; if anything is wrong, phone the bank on the number on your card, then report it at reportfraud.police.uk

   Why?

   The NCSC names haveibeenpwned.com as a tool for checking whether your details appeared in a public data breach. A result there means a site you used was breached, not that someone is in your account today.