If you think your account was taken over

Each step is a sensitive change, so the page may ask you to confirm with a passkey or an authenticator code first, and you will receive security alert emails about your own changes. That is expected. See What a security alert email means.

If you got a New sign-in to your account email, you can also use its Review this sign-in link and choose No, secure my account. That ends every session, sign-in token and personal access token and forgets your devices. It does not change your password, so still do step 3.

Someone may have changed your sign-in methods. Use another method you have, such as a passkey on another device or a recovery code. If nothing works, start account recovery from a browser you control. See If you are locked out. Recovery signs you out everywhere and lets you set new sign-in methods. Recovery can have a wait, and the platform emails every verified address with a Cancel recovery button, so check that nobody else started one. If an attacker started recovery, cancelling it stops it.

Your account keeps a record of security events. Two places show it.

• Notifications, Inbox: security events newest first. Events worth a second look carry a Review or Review now badge. Mark all as read clears the markers.
• Your data, Activity: security-relevant events on your account from the last 90 days, newest first.

Also look at Overview, which counts sign-ins over the last 30 days, with any failed or blocked attempts, and lists recent activity. Devices lists every session with its device, location, address, when it was signed in, last active and sign-in method. A session you do not recognise may be a sign of a takeover. The method column shows whether it used a Passkey or Password.

Things to look for:

• a sign-in at a time and place you were not at,
• a passkey, password or authenticator change you did not make,
• a new address or a changed primary address,
• an app you did not allow,
• a data export request you did not make (Data export requested.).

• Tell your organization's administrator if the account belongs to an organization.
• Tell any services that rely on this account that you changed your sign-in methods.
• If you gave a secret to a fake page, assume it is known. Change it everywhere it is used.
• Report a weakness. If the way in was a flaw in identity itself, tell us. See Reporting a vulnerability.

• Add a passkey and make it your main way in. See Add a passkey.
• Keep recovery codes somewhere safe. See Keeping recovery codes safe.
• Add a second verified email address so an alert still reaches you if one mailbox is lost.
• Run the Checkup on the Security area and clear what it lists.

The steps end your sessions and cut off the credentials you can see. They cannot undo what someone did while they had access, such as data they read. The platform does not publish a response commitment for individual accounts. For how TDACorp handles security incidents in general, see Incident response.