Why these twelve
Almost every lost account comes down to one of three things: a lookalike page, a code handed to the wrong person, or a password used in more than one place. The first seven checks close those doors. The rest make the damage smaller if something slips through anyway.
What an honest site does not ask
A real service may ask for a password on its own sign-in page, and it may text you a code to type into that same page. What it does not do is ask you to read a code back to a person, send a password in a chat, or pay a fee to “unlock” an account. Treat any of those as a sign to stop.
This site goes further and asks for none of it at all. The sign-in page explains how a card can work without any of those details.
If you think an account was taken
- From a device you trust, open the service from your own bookmark and change the password at once.
- Turn on two-step sign-in if it was off, and sign out all other sessions if the service offers it.
- Change the same password anywhere else you used it.
- Check the recovery email and number have not been changed to someone else’s.
- Contact the service through the help page on its own site, never through a number found in a comment or message.
Make it a monthly habit
Come back once a month, clear your ticks and run through the list again. It takes about five minutes. Then reward yourself with a round of the key maze.
