PanicStation.org
UK USA
us Technology & digital loss

What to do if…
you get a notice that your two-factor authentication method was changed without your permission

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Treat this as possible account takeover. Go to the service directly, not through the alert link, then use official recovery or security settings to change the password, sign out other sessions, and restore only recovery methods you control.

Do not do these things

  • Don’t click “secure your account” or “verify now” links in the alert unless you are sure they are genuine; phishing messages often imitate security notices.
  • Don’t enter your password after arriving from an email, text, search ad, or social media link.
  • Don’t approve any login prompt, push notification, or verification request you did not start.
  • Don’t keep retrying the same password if it fails; switch to the provider’s official recovery route.
  • Don’t ignore your email account, because access to email can let someone reset other accounts.
  • Don’t rely on SMS codes if your phone number may have been moved, ported, or SIM-swapped.

What to do now

  1. Open the account directly. Type the service’s address yourself or use the official app. Go to the account’s security, sign-in, two-factor authentication, devices, and recovery settings.

  2. Regain control using only the official route.

    • If you can log in, change the password now to a long, unique password you do not use anywhere else.
    • If you cannot log in, use the provider’s official recovery process, such as “recover account” or “I can’t access my account.”
    • If there is an option to secure or lock the account while recovery is reviewed, use it.

  3. Remove the attacker’s access.

    • Sign out of all devices or sessions.
    • Remove unknown devices, trusted devices, connected apps, browser sessions, app passwords, and third-party access you did not add.
    • Check recent login activity for unfamiliar locations, devices, or times.

  4. Put your own two-factor authentication back.

    • Remove any authentication method, phone number, passkey, security key, recovery email, or authenticator app you do not recognise.
    • Add a method you control, such as an authenticator app, passkey, or security key when the service offers it.
    • Generate new backup codes and store them somewhere the attacker cannot access.

  5. Secure your email account next. Change the email password, sign out of all email sessions, check recovery email and phone settings, and remove any forwarding rules, filters, delegated mailbox access, or app passwords you did not create.

  6. Check whether your phone number is involved. If texts stopped arriving, your phone shows no service unexpectedly, or the account change used your number, contact your mobile carrier through its official app, website, or phone number. Ask whether there was a SIM change, eSIM change, port-out, number transfer, or account change, and ask what account PIN, number-lock, transfer-lock, or port-out protections are available.

  7. Act on money before investigating the cause. If purchases, transfers, bank access, crypto access, payroll access, or stored cards are involved, contact the company or financial institution’s fraud support through an official route. Ask them to freeze access, stop pending transfers, dispute charges, cancel cards or tokens, and preserve account records as appropriate.

  8. Report only where it fits the harm.

    • If there was cyber-enabled fraud, extortion, money loss, or account takeover tied to a crime, you can report it to the FBI’s Internet Crime Complaint Center.
    • If someone is using your identity, opening accounts, changing tax or benefits details, or creating credit problems, use IdentityTheft.gov for a recovery plan.
    • If the account is for work, school, healthcare, payroll, or business administration, tell the official help desk or security contact promptly.

  9. Write down the basics after you have started securing access. Record the service name, alert time, what changed, support case numbers, transaction IDs, and any unfamiliar devices or locations shown in logs. Take screenshots if you can do that without delaying account lockdown.

What can wait

  • You do not need to prove whether this was phishing, malware, a password leak, SIM swap, or a provider issue right now.
  • You do not need to secure every account at once; start with this account, your email, your phone number, and anything financial.
  • You do not need to message all contacts immediately unless the account sent messages, scams, or payment requests from your name.
  • You do not need to buy new security tools before using the provider’s official recovery and sign-out options.

Important reassurance

A two-factor authentication change notice is serious, but it is also an early warning. Direct recovery, session sign-out, and recovery-method cleanup can often stop further access before more damage is done.

Scope note

These are first steps only. Later decisions, especially for banking, identity theft, workplace systems, healthcare accounts, or business administrator access, may need help from the provider, your financial institution, an IT security team, or another qualified specialist.

Important note

This is general information, not legal, financial, technical, cybersecurity, or professional advice. Account recovery processes vary by provider and can change, so use only official sites, apps, and support channels.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us