What to do if you gave away a password

If you have shared a password with a scammer or typed it into a fake page, the fix is simple: change it quickly. Here is what to do, in a sensible order.

Step by step

1. Go to the real website or app by typing the address yourself, not by using the link you were sent.
2. Sign in and change the password to a new one. Choose three random words joined together, such as "TeaCupBicycle", then add a number or symbol if the site asks.
3. Turn on two-step sign-in on that account. This means a stolen password alone is no longer enough.
4. Look at recent activity or sign-in history for anything you do not recognise.
5. Sign out of all other devices if the site offers this.

Change it elsewhere too

If you used the same password on other accounts, change those as well. Start with the important ones:

• Your main email account, because it can be used to reset other passwords.
• Online banking and shopping accounts.
• Social media.

If you cannot sign in

Scammers may have already changed the password. Use the site's Forgotten password option. If that does not work, use the site's help page to recover the account. Our guide on a hacked account may help.

If it was your email password

Check your email settings for forwarding rules or other addresses you did not add. These are sometimes set up by a scammer to watch your mail.

Tell the right people

If it was a bank password, ring your bank on 159 or the number on your card. Forward scam emails to report@phishing.gov.uk. If money or accounts were affected, report it to Report Fraud (formerly Action Fraud) at reportfraud.police.uk or on 0300 123 2040, or to Police Scotland on 101.

Make it easier next time

A password manager can remember a different strong password for each site, so you only need to remember one. We can help you set one up.

When to get more help

If you are locked out or unsure what to change first, get in touch and we will go through it with you step by step.