Start with
the inbox.
An inbox often receives password resets for other accounts. Check its access paths as well as its password.
Sources reviewed 2026-10-31. Recovery Map cannot determine whether anyone accessed your account.
Check the signal
A failed login alone does not establish a takeover. An unexpected change to recovery details or messages sent without your knowledge warrants checking through the provider's known website or app. Do not use a link supplied by someone claiming to be a recovery agent.
A worked example
A friend reports a suspicious message from your email. You open the provider's official security page on a device you have reason to trust. You can still sign in, so you follow its compromised-account process, review sessions and settings, and change the password. Then you check accounts that receive reset messages at this address.
If sign-in is blocked instead, use the provider's recovery process. Do not assume the preparation steps in a checklist can create recovery options retroactively.
Once access is restored
Check recovery channels, email forwarding and sent messages. Remove unfamiliar access through the provider's controls. Warn contacts through a channel you trust if messages were sent as you. The FTC's recovery checklist explains these follow-up checks.
Google additionally describes reviewing security events, devices and connected access. A changed password does not substitute for that review. Read Google's compromised-account guidance.
Expect limits, not shortcuts
Microsoft says its recovery form cannot get around two-step verification when no alternate verification method is available. Apple account recovery may require a waiting period, with specific rules about continued account use. Microsoft's limits and Apple's recovery process.
If you suspect unauthorized payments, contact the relevant institution through its official app or a known number. For work or school accounts, use your organization's help desk. This site cannot recover accounts, inspect devices or resolve fraud.