us Technology & digital loss security questions changed • security questions reset • account recovery altered • account settings changed • password reset not me • suspicious login alerts • unauthorized account changes • account takeover • email account compromised • recovery email changed • recovery phone changed • two factor turned off • login from new device • unknown devices signed in • reset links you didnt request • cant access my account • locked out of account • hacked account help • scammer changed my details

What to do if…
your account security questions are changed or reset and you did not do it

Short answer

Assume your account is being taken over: secure your email first, then use the provider’s official account-recovery process to regain access and undo any security-setting changes.

Do not do these things

Don’t click “reset your password” links from unexpected emails/texts; open the provider’s official site/app yourself.
Don’t enter your password or codes on pages opened from unsolicited messages — lookalike sites are common.
Don’t keep trying passwords repeatedly; you can trigger lockouts that slow recovery.
Don’t reuse an old password or a password you’ve used anywhere else.
Don’t share verification codes, backup codes, or security-question answers with anyone (including someone claiming to be support).
Don’t assume it’s isolated — if your email or phone number is compromised, multiple accounts may be exposed.

What to do now

Move to a safer setup. If possible, use a different trusted device than your everyday one and a private connection (not public Wi-Fi) while you recover.
Secure your email account first (this often controls everything else).
- Sign in via the official site/app.
- Change the email password (strong and unique).
- Turn on multi-factor authentication (MFA).
- Check for forwarding, filters, or auto-rules that send mail to someone else or hide/delete messages, and remove them.
- Review recent sign-ins / security activity and sign out of other sessions if the provider offers it.
Use the account provider’s official recovery flow for the affected account.
- Navigate to the provider’s help/recovery page from their official website (type it in yourself or use the app).
- Tell support/recovery prompts that security questions/recovery options were changed without you if that’s an option.
After you regain access, lock the account down in one focused pass.
- Change the password (unique; long) and sign out of all other sessions/devices.
- Re-enable MFA and review recovery email/phone details.
- Set security questions/answers that are not guessable and not based on real personal facts; store them safely (password manager or secure record).
Check for phone-number takeover (SIM swap) if you use SMS codes.
- Warning signs: sudden loss of cellular service, “SIM change” notices, or SMS codes not arriving.
- Contact your mobile carrier and ask them to verify whether a SIM change occurred and to add extra account protections.
- Where possible, switch MFA from SMS to an authenticator app or security key.
Protect the most sensitive linked accounts next.
- Prioritize: bank/payment accounts, Apple ID/Google/Microsoft, social accounts, and any account that can reset others.
- Change passwords anywhere you reused the same one, and enable MFA.
If there’s financial loss, identity misuse, or a scammer is using your accounts, create an official report trail.
- Use IdentityTheft.gov if your identity information may be misused (for example: new accounts opened, tax/benefits issues, or your personal details used to pass security checks).
- If it’s a cyber-enabled crime (for example: money stolen through online fraud), you can file a report with the FBI’s IC3 — use the official site and avoid lookalike domains.

What can wait

You don’t need to diagnose the root cause right now (phishing vs breach vs malware).
You don’t need to delete accounts or factory-reset devices immediately.
You don’t need to contact or confront anyone you suspect.
You can postpone longer-term upgrades (new email address, full device audits, identity monitoring) until you’ve regained control.

Important reassurance

Attackers commonly change recovery settings (like security questions) specifically to keep you out. Focusing on email-first recovery, then quickly re-locking settings and MFA, is the fastest way to stop further damage.

Scope note

This is first-step stabilization guidance. Once you’re back in control, you can take slower, more thorough steps (device scans, password-manager rollout, long-term identity protection) with a clearer head.

Important note

This guide is general information, not legal, financial, or forensic advice. If you believe active fraud is happening, contact your bank/provider immediately and use official reporting channels.

Additional Resources

Support us

What to do if…your account security questions are changed or reset and you did not do it