What to do if you shared a code or password

Do these steps in order

1. 1

   Do this now Call your bank now if the code or password was for your bank

   Use the number on the back of your card or in your bank's official app. Never call a number the scammer gave you. Tell them you shared a code, so they can stop transfers and check for changes.

   What to say: “I gave a code to someone who contacted me. Please stop any transfers I didn't make and help me change my login.”

2. 2

   Do this now Call your phone company if your phone lost service or the code came from them

   No service, or only SOS, can mean a scammer moved your number to their phone. From another phone, call the number on your phone bill. Ask them to stop any number transfer or SIM change, and to add a number lock and an account PIN.

   • FCC: How scammers steal phone numbers
3. 3

   Do this now Change that account's password now, from a device you trust

   If someone you know or live with may have set this up, removing it or signing them out can alert them. If you’re worried about your safety, talk to a domestic violence advocate before you change anything. The National Domestic Violence Hotline is free and open any time: call 800-799-7233 or chat at thehotline.org. If you can, use a phone or computer they can’t check.

   Open the company's official app, or type its web address yourself. Don't use links in texts or emails. Pick a new password you don't use anywhere else. Locked out? Follow the company's account recovery steps. Used the old password elsewhere? Change it there too.

   • FTC: Recover a hacked email or social media account
4. 4

   Do this now Sign out of all other devices

   In the account's security settings, find the list of devices or sessions where you're signed in. Sign out of any you don't know, or choose to sign out everywhere. This kicks the scammer out if they got in.

5. 5

   Turn on two-step sign-in

   In the account's security settings, look for two-step sign-in. It may be called 2-Step Verification or two-factor authentication. Never read the codes it sends to anyone who contacts you.

   • FTC: Two-step sign-in, explained
   • Google: Turn on 2-Step Verification
   • Microsoft: Two-step verification
   • Apple: Two-factor authentication
6. 6

   Check your email for forwarding you didn't set up

   Scammers sometimes add a rule that quietly sends copies of your email to them. In your email settings, look at forwarding, filters, and rules. Delete any you didn't make. Make sure the recovery phone and email are yours.

   • FTC: Recover a hacked email or social media account
7. 7

   Hang up on anyone who calls offering to help

   Scammers often call back pretending to be support or a fraud team, and ask for another code. Anyone who asks for your code is a scammer. Hang up. Use the number on your card or bill, or the company's official app.