Step by step
Use a trusted route
Do not use links in the alert. Open the official app or type the service address yourself, then inspect recent sign-ins and devices.
Change access safely
From a trusted updated device, change the password to a unique one and sign out other sessions. Change reused passwords on other accounts too.
Strengthen recovery
Turn on two-step verification, verify recovery email and phone details, and remove unknown app passwords or connected apps.
Check the consequences
Review sent messages, forwarding rules, purchases, recovery changes and deleted items. Tell contacts if the account sent suspicious messages.
Ready-to-use checklist
- Official app or typed address used
- Unique password set
- Other sessions revoked
- Two-step verification enabled
- Recovery details checked
- Financial activity reviewed
Common problems
You cannot sign in
Use the provider’s official recovery page and secure the recovery email first. Do not pay an unknown “recovery expert”.
Money or identity data may be involved
Contact the bank or relevant provider through an official number and report fraud through the appropriate UK route.