Phishing and compromised accounts¶

Phishing attacks trick individuals into revealing login credentials, credit card details, or security tokens through deceptive emails, text messages, or website clones. If an attacker gains access to your primary email account, they can reset passwords across all connected services.

Do this now¶

1. Attempt account recovery immediately: Use the official account recovery form provided by your email or cloud provider (such as Google, Microsoft, Apple, or Meta).
2. Log out of all active sessions: Once logged in, go to security settings and select the option to sign out of all devices, browsers, and mobile apps.
3. Change your password to a unique passphrase: Create a strong password containing at least 15 characters, numbers, and symbols that you do not use on any other website.
4. Inspect account recovery settings: Verify that the recovery phone number, recovery email address, and security questions belong to you and were not modified by the attacker.
5. Check email forwarding and filter rules: Attackers often set up hidden email forwarding rules to intercept password reset emails. Remove any unrecognized forwarding addresses or rules.

Securing connected services¶

• Revoke third party app permissions: Go to your account security dashboard and remove permissions for any unknown applications or websites.
• Enable multi-factor authentication: Activate two-factor authentication using an authenticator app (such as Google Authenticator, Authy, or 1Password) or a physical FIDO2 hardware security key.
• Notify your contacts: If your email or social media account was used to send fraudulent messages to your contacts, inform family and friends not to click links or send money.

Reporting phishing scams¶

Forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to the FTC at spam@uce.gov. If you disclosed financial information, contact your bank fraud department right away.