What is account takeover?

Account takeover is when someone gains control of an online account without your permission, perhaps through stolen passwords or tricks involving security codes. They may change its password, misuse saved payment details or message your contacts. It can affect email, shopping, social media and messaging accounts. 123

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. A criminal obtains a password, code or another way into the account. 123
  2. They sign in and may change recovery or security settings. 123
  3. They use the account for purchases, messages or further scams. 123

Real UK example

BBC reporting in January 2025 described Derbyshire Police’s warning about WhatsApp takeovers. In one reported case, a taxi driver’s account was used to request advance payments for booked journeys. Criminals were using an existing trusted account, not simply sending messages from a random new number. 3

Warning signs

  • You cannot sign in with your usual details. 123
  • Recovery details or security settings have changed. 12345
  • Your contacts receive messages you did not send. 123
  • Purchases or linked devices appear that you do not recognise. 123

What to do now

  1. Use the provider’s genuine account-recovery process. 12345
  2. If you regain access, check recovery details and sign out other sessions where offered. 12345
  3. Warn contacts through another channel if your account has sent scam requests. 123

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 678
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 79
  • If someone is in danger, call 999. 9

How to protect yourself

  • Give each important account a different password. 12345
  • Turn on two-step verification. 12345
  • Keep recovery details current and do not share sign-in codes. 12345

Frequently asked questions

How can I tell if my account has been taken over?

Unexpected settings, messages or sign-ins are warning signs. Check through the genuine service, not through a link in an alert. 110

Is changing my password enough?

Not always. The NCSC also recommends checking recovery details, forwarding rules and other sessions where the service allows it. 1

Should I warn my contacts?

Yes, if the account has been used to contact them. Use another channel so they know not to trust recent requests. 1

Read the longer guide

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  2. Which?, Rise in criminals opening mobile and savings accounts in victims’ name - Which?. Accessed 7 November 2026 (Europe/London).
  3. BBC News, Derbyshire Police warning over WhatsApp account takeover scam - BBC News. Accessed 7 November 2026 (Europe/London).
  4. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  5. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).
  6. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  7. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  8. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  9. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).
  10. NCSC, Data breach guidance for individuals. Accessed 7 November 2026 (Europe/London).