I gave a scammer my password. What should I do?

Do this first, in this order.

1. Change the password on that account, from a device you trust. Type the website address yourself. Do not use any link from the message or the caller.
2. Sign out of all devices on that account. Look for "sign out everywhere", "log out of all sessions", or a device list.
3. Change the password anywhere else you used the same one, starting with your email.
4. Turn on two-factor authentication on that account and on your email.

Step two is the one almost everyone skips, and it is the one that removes the attacker. Steps three and four stop it happening again.

Why the first hour matters

Nothing here is complicated. It is just time-sensitive.

Agari studied this directly by putting more than 8,000 fake login pages in front of real attackers over six months and watching what happened to the credentials. Half of the accounts were opened by a criminal within 12 hours. Nine in ten were opened within a week. Almost a quarter of the phishing sites checked the password automatically, the moment it was typed.

So "I will sort it out tomorrow" is usually too late, and "I will sort it out now" is usually early enough. That is the whole reason this page starts with the steps instead of the explanation.

Why signing out matters more than the password

A password is how you start a session. It is not what keeps one running.

If the attacker signed in before you changed anything, they now hold a live session — the same thing that keeps you logged into a site for weeks without retyping anything. On many services, changing the password does not end it.

That is why the FTC's recovery guidance lists signing out separately, saying that this way "anyone who's logged in to your account on another device will get kicked out". The NCSC says the same thing: make sure any devices and apps that may still be logged in are logged out.

The three big platforms handle it differently, which is why it is worth doing deliberately rather than assuming:

Check what they left behind

An attacker who expects to lose the password will try to keep a way back in. These four checks take about five minutes between them, and they are the difference between recovering an account and recovering it twice.

Mail forwarding rules and filters

The most important one, and the least known.

A forwarding rule quietly sends a copy of your incoming mail somewhere else. It keeps working after you change your password. The FBI warned about this specifically, describing rules that auto-forwarded any message containing the words "bank," "payment," "invoice," "wire," or "check" to the criminal's own address. CISA has documented rules that dump security warnings into an RSS folder so the real owner never sees them.

• Gmail — Settings, then "Filters and Blocked Addresses", then "Forwarding and POP/IMAP", then "Accounts and Import" to check "Send mail as" and "Grant access to your account".
• Outlook.com — Settings, then Mail, then Forwarding, and then Rules.

Delete anything you did not create.

Recovery email and phone number

If they changed these, they can reset the password back whenever they like. The FTC's guidance is to make sure the recovery addresses and numbers listed are ones you entered and can actually reach. Apple additionally suggests confirming with your email provider and mobile network that those accounts are still yours.

Trusted devices and second factors

Look for an authenticator app you did not add, a phone number you do not recognise, or a device marked trusted. Remove them and set up two-factor authentication again from scratch.

Sent and deleted mail

Look at what was sent from your account while it was not yours. This tells you who else needs warning, and sometimes shows what the attacker was actually after.

What changes depending on the account

The password matters, but so does the account. Deal with these in order.

Email — always first. Nearly every other account offers "forgot password" to your inbox. Someone with your email does not need your banking password; they can ask the bank for a new one. If the password you gave away is also your email password, that is the emergency, and it comes before everything else.

Banking and payment. Change the password, then ring the bank on the number on the back of your card and tell them. Watch for small test payments, which often come before large ones.

A work account. Tell your IT team immediately, before you try to fix anything yourself. They can end sessions centrally and see things you cannot. Reporting fast is far more useful than looking careful, and IT teams greatly prefer an early call to a late one.

Shopping accounts. Check saved cards, saved addresses and recent orders, including any sent to an address you do not recognise.

Social accounts. Warn your contacts. A compromised account is used to message the people who trust it, and the NCSC and FTC both list telling your contacts as a real step rather than a courtesy.

If you cannot get in at all

If they changed the password before you did, you are into account recovery, which is slower and needs proof rather than speed.

1. Use the provider's official recovery page. Every major platform has one, and the FTC's recovery article links to them directly.
2. Try from a device and network you have used with that account before. Many services weigh that as evidence.
3. If the account is tied to a business or a bank, phone them. Human review exists precisely for this.
4. If you cannot recover it, tell your contacts the account is no longer yours, and change the password on anything that used the same one.

Report it

Reporting takes a minute, and it is how patterns are spotted at all. The FBI's complaint centre now averages nearly 3,000 reports a day, and reports are what let it act quickly on money that has just moved.

• United States — ReportFraud.ftc.gov and ic3.gov. If you also gave away a Social Security number, use IdentityTheft.gov.
• United Kingdom — forward the email to report@phishing.gov.uk, forward the text to 7726, and if you lost money report it at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
• Also report it inside your email app. It improves filtering for everyone.

Then make the repeat impossible

Once things are stable, three changes do almost all the remaining work.

• A password manager, so nothing is reused and one bad day stays one account. Reuse is what turns a single phished password into credential stuffing across your other accounts.
• Two-factor authentication everywhere, starting with email.
• Passkeys wherever they are offered, because a passkey cannot be typed into a fake site at all.

And if you are not certain what you handed over — a password, a code, card details, or only a click — work through I clicked a phishing link, which sorts the response by exactly that question.