Act now, but use the genuine app or website.
Do not follow another link from the original message.
- Change the exposed password immediately.
- If you reused it, change it on every other account, beginning with email and banking.
- Use the account’s security settings to sign out other devices and sessions.
- Check recovery email addresses, phone numbers and email forwarding rules for changes.
- Turn on an extra sign-in check.
- Contact the account provider through its official support pages if you cannot sign in.
If the code came from your bank
Contact the bank immediately using its app or the number on your card or statement. A one-time code may have authorised a payment, a new device or a change to your account.
Tell people if messages were sent from your account
Warn contacts to treat recent messages from you with caution, particularly requests for money or security codes.