Report identity theft, phishing or account takeover
Accounts opened in your name, a mailbox someone else is reading, a social or banking login that is no longer yours. The order you do things in matters — securing the email first is what makes the rest stick.
Secure the email account behind everything else first. Recovering any other account while someone else controls your mailbox achieves nothing, because they will simply reset it again.
Free route first
Credit bureau fraud alerts are free in most countries, and national identity theft services provide free recovery plans. We will point you at yours before anything else.
What to do now
- Change the email password from a device you know is clean, and enable multi-factor authentication with an app rather than SMS.
- Check for forwarding rules, delegated access and recovery addresses the attacker may have added. This is the step almost everyone skips.
- Revoke active sessions and connected applications — a consent grant survives a password change.
- Place a fraud alert or protective registration with the credit bureaus in your country.
- Report to your national cybercrime authority and keep the reference.
What actually decides the outcome
These are the factors our assessment weighs. Two of them cannot be changed after the fact, which is why the honest answer is sometimes that little can be done.
- Whether the email account is genuinely secured, including rules and app grants, not just the password.
- How quickly fraud alerts were placed with the credit bureaus.
- Whether the same password was reused elsewhere.
- Whether multi-factor authentication was on before the incident, which usually limits the damage sharply.
What we do
- Give you a sequenced recovery plan, because doing these in the wrong order is why people get locked out repeatedly.
- Identify what was likely exposed and which accounts share that credential.
- Prepare the documentation credit bureaus and banks require to dispute accounts opened in your name.
- Check what of yours is exposed publicly and can be closed off.
We are a private company, not the police or a law firm. We do not guarantee recovery, and we will tell you when your outlook is poor rather than selling you hope. See our legal and verification page.
Questions people ask
I changed my password but it happened again.
Almost always a forwarding rule, a connected application, or a recovery address the attacker added. A password change does not revoke any of those. Check all three.
Someone opened an account in my name. Am I liable for the debt?
Generally not, once fraud is established — but you must dispute it formally with evidence, and the police or cybercrime reference is usually required.
Is it worth reporting if nothing was taken yet?
Yes. A report creates a dated record, and credit alerts placed before the damage are far more effective than afterwards.