Account protection: what to lock down, and what to do when an account is taken

Account takeovers rarely announce themselves. The first sign is often small: a password reset email you didn’t request, a login alert from a city you’ve never visited, or friends asking why you messaged them about a crypto deal. Sometimes it’s a mail rule quietly forwarding your invoices to a stranger.

Protection starts before anything happens. Keep recovery phone numbers and backup email addresses current. Review which devices are signed in. Remove old apps that still have access to your Google, Microsoft or Apple account. These checks take ten minutes and make recovery far easier later.

When something does go wrong, order matters. Secure your email first, because it can reset everything else. Then sign out other sessions, check forwarding rules, turn on multi-factor authentication and contact the service through its official recovery page, never a phone number from a search ad.

This section covers personal accounts, social media, and the shared business accounts small offices depend on.

Coming up: a beginner’s guide to account protection and a printable recovery checklist.