Short answer: To prevent account takeover, secure your email account first, then turn on passkeys or authenticator-app two-factor authentication on your shopping, banking, phone and social accounts. Remove devices and apps you do not recognize, check your recovery email and phone number, and consider a credit freeze. Most of this takes about 15 minutes, and it is worth doing before Black Friday (November 27, 2026).
Last reviewed: October 25, 2026.
Key takeaways
- Start with your email account. Whoever controls it can reset the password on almost everything else.
- Use a passkey or an authenticator app for sign-in codes where offered, and never turn two-factor authentication off.
- Check "devices logged in," connected apps, and your recovery email and phone on the accounts that hold money or personal data.
- A link in a delivery or gift card text is never proof of anything. Open the retailer or carrier app yourself.
- If an account is taken, act in the first hour: official recovery page, password change, then report it.
Why do this now?
Holiday shopping means new logins, saved cards, delivery notices and a lot of urgent-looking messages. That is a good moment to tighten the basics.
Two official figures give some context. According to the FTC (press release dated June 15, 2026), about $16 billion was reported lost to fraud in 2025, the highest on record, and people reported losing $3.5 billion to imposter scams. These figures cover all fraud, not only account takeover.
On account takeover specifically, the FBI Internet Crime Complaint Center (IC3) public service announcement I-112525-PSA, dated November 25, 2025, reported more than 5,100 complaints of account takeover fraud and losses exceeding $262 million since January 2025. We have not confirmed any 2026 holiday-season spike, so treat this as a reason to prepare, not as a prediction.
Source status as of October 25, 2026: both figures above were read directly from the FTC and IC3 pages. We did not use other reported alerts that we could not confirm from a primary source.
What account takeover actually is
Account takeover (ATO) means someone other than you signs in to your account and uses it. Typical routes are a reused password from an old breach, a phishing page that captures your login and code, a fake support caller who talks you into handing over a code, or a SIM or recovery-detail change.
The IC3 notice describes attackers impersonating institutions to get login details. Its advice lines up with the checklist below: unique passwords, two-factor authentication that you never disable, bookmarks for login pages, and calling back on a number you verified yourself.
The 15-minute checklist at a glance
| Step | Time | What you do |
|---|---|---|
| 1. Email account first | 3 min | New unique password, passkey or authenticator app, check recovery options |
| 2. Password manager | 3 min | Unique password for banking, shopping, phone carrier |
| 3. Devices and app access | 4 min | Sign out unknown devices, remove unknown apps |
| 4. Recovery details | 2 min | Confirm only your own email and phone are listed |
| 5. Credit freeze | Optional, 10+ min | Freeze at the credit bureaus in your country |
| 6. Text and delivery rules | 1 min | Decide now: no taps on links in unexpected texts |
Step 1: Secure your email account first
Your email inbox is the master key. Password reset links for your shopping, bank and social accounts all land there. If it falls, everything behind it is exposed.
- Change the email password to a long, unique one that you have never used elsewhere.
- Turn on two-factor authentication. Prefer a passkey or an authenticator app over text-message codes where your provider offers them.
- Look for mail forwarding rules or filters you did not create. Attackers sometimes hide copies of your mail this way.
- Check the recovery email and phone number (step 4 below).
If you already suspect your email is compromised, go to our email account hacked recovery guide instead of continuing here.
Step 2: Use a password manager and a passkey or authenticator app
A password manager lets you give every account a different password without remembering them. This matters because stolen passwords are tried on other sites automatically.
For sign-in codes, use an authenticator app or a passkey where available. Microsoft describes its Authenticator app as a way to verify sign-in, to use as a one-time code for two-step verification, or as a passwordless sign-in method by approving on your phone. Apple's support pages explain how to turn on two-factor authentication for your Apple Account.
The IC3 notice says to enable two-factor authentication or MFA on any account possible and never disable it. Text-message codes are better than nothing, so keep them if an authenticator is not offered.
For background on passkeys, read passkeys explained. Before you switch, save your backup or recovery codes somewhere safe, since losing the only device that holds your codes can lock you out.
Step 3: Check devices logged in and revoke unknown app access
Each major provider has a page that lists where you are signed in and which apps have been granted access. A password change alone may not remove an app you approved earlier, so check both.
- Devices: go to myaccount.google.com, choose "Your devices," then "Manage devices." If you see one you do not recognize, select "Don't recognize a device?" and follow the steps.
- Apps: go to myaccount.google.com/permissions, review the list and remove any app you do not recognize.
- Google also advises changing your password right away if you think someone else is signed in, and changing it anywhere else you reused it.
Apple
Apple's two-factor page links to a separate article on trusted devices and trusted phone numbers (support.apple.com/en-us/122621). Open that official article to review which devices and numbers are trusted. We did not confirm the exact menu path for removing a device, so follow Apple's own page.
Microsoft and Meta
Sign in to your account security page on Microsoft's official site and review recent activity and devices there. For Facebook and Instagram, use the Help Center on the official Meta site. The exact menu names change often, so we do not list click paths here that we could not confirm.
For a hacked social account, see our guides for Instagram and TikTok.
Step 4: Review your recovery email and phone
Recovery options are what an attacker changes to keep control. On each important account (email, bank, shopping, phone carrier, Apple, Google, Microsoft), confirm that:
- The recovery email address is one you own and still read.
- The recovery phone number is current and yours.
- No extra emails, numbers or security questions have been added recently.
Also look at saved cards and shipping addresses on shopping accounts, and at your order history for anything you did not buy.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
Step 5: Consider a credit freeze
A credit freeze blocks new credit from being opened in your name. It does not stop someone using an existing hacked card or account, so treat it as an extra layer.
In the US, the FTC says to contact all three bureaus (Equifax, Experian and TransUnion). It states there is no cost to place or lift a freeze and that a freeze does not affect your credit score.
In Canada, Equifax Canada and TransUnion Canada are the main bureaus. In the UK and Australia, the credit reference agencies and their protection options differ. We did not verify current freeze or ban procedures for Canada, the UK or Australia in preparing this article, so go to each bureau's official site for current steps and any fees.
Step 6: Gift card and delivery text traps
Holiday scams often arrive as a text or email: a missed delivery, a failed payment, an account locked notice, or a boss or relative asking for gift cards. Set your rule in advance:
- Never tap a link in an unexpected text about a package or payment. Open the retailer or carrier app, or type the address yourself.
- Use bookmarks for banking and shopping logins, as the IC3 notice advises.
- Do not trust caller ID. If someone says they are from your bank, hang up and call the number on your card or the bank's verified site.
- Nobody legitimate needs gift card numbers to fix an account.
- Never read a one-time code to anyone who contacts you. A real company will not ask for it.
See what is smishing for how text phishing works, and tech support scam warning signs if a pop-up or caller wants remote access to your computer.
What to do the minute an account is taken
- Use the provider's official recovery page, reached by typing the address or using the official app. Do not use a link from a message or a search ad.
- Change the password from a device you trust, and change it anywhere you reused it.
- Sign out all sessions, remove unknown apps and devices, and fix recovery details.
- Contact your bank or card issuer if money or cards are involved, using the number on the card.
- If a computer may be infected, scan it before changing passwords on it. Our Windows support page and remote repair service cover that.
- Report it.
| Country | Where to report |
|---|---|
| US | FTC at ReportFraud.ftc.gov (named in the FTC release); IdentityTheft.gov for identity theft; IC3 for internet crime |
| Canada | Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca |
| UK | Action Fraud (check its official site for the current process) |
| Australia | ReportCyber and IDCARE (check their official sites for current steps) |
For identity theft aftermath, read our identity theft recovery guide.
Common mistakes
- Securing shopping accounts but leaving the email account on an old, reused password.
- Changing the password but leaving the attacker's app or device signed in.
- Turning off two-factor authentication because it is inconvenient.
- Calling a support number that appeared in a pop-up, text or search ad.
Frequently asked questions
How do I prevent account takeover?
Use a unique password for every account, secure your email first, turn on a passkey or authenticator-app two-factor authentication, and review signed-in devices and connected apps. Never turn two-factor authentication off.
Is an authenticator app better than SMS codes?
Generally yes, because it is not tied to your phone number. Use SMS if that is all a service offers, and add an authenticator app or passkey where possible.
Does changing my password remove an attacker?
Not always. Also sign out other sessions and remove unknown apps and devices from your account security pages.
Should I freeze my credit?
It helps against new accounts opened in your name. In the US, the FTC says it is free and does not affect your credit score. Check official bureau sites for other countries.
What do I do if I clicked a delivery text link?
Do not enter any details. If you did, change that account's password at once from the official site, contact your bank if a card was entered, and report the text.
Where do I report fraud?
In the US use ReportFraud.ftc.gov. In Canada use the Canadian Anti-Fraud Centre. In the UK and Australia use the national reporting bodies listed above, after checking their official sites.
Can a technician help me do this?
Yes. A technician can walk through these steps with you remotely, and you start the session yourself by calling us.