Secure your accounts

If a scammer may have your password or a verification code, work through these steps in order. Most take a few minutes each.

Start with your email
Your email can reset every other password. Secure it first, from a device you trust.
Change the password
Use a long, unique password you haven't used anywhere else. A password manager makes this easy.
Turn on two-step verification
Prefer an authenticator app or passkey over text messages where offered.
Check recovery details
Make sure the recovery email and phone number are yours. Scammers often change these.
Sign out everywhere else
Use 'Sign out of all devices' or review active sessions and remove ones you don't recognise.
Check forwarding and connected apps
Remove email forwarding rules and third-party app access you didn't set up.
Repeat for banking, social and shopping accounts
Then any account that used the same password.