Passwords can be reused elsewhere
Credential stuffing tries a username and password taken from one service against other services where the same combination may have been reused.
Technology, platforms and channels
Accounts, passwords and stolen login details
Stolen passwords and login details can expose more than one account, especially when sign-in details are reused. Criminals may also use phishing, stolen sessions, weak recovery routes, malicious software or approval fatigue to enter and remain inside an account.
Page T-004Guidance pageReviewed 29 August 2026
Key Guidance
If you still control the account, secure it from a trusted device: change compromised sign-in details, remove unfamiliar sessions and recovery details, then enable stronger sign-in protection. If you have lost access, use the provider’s official recovery process at once.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
Email deserves priority because it often resets other accounts. A criminal who controls email, a phone number or a recovery method may be able to regain access after a password is changed.
A session can outlive a password
A stolen session token may keep a device signed in. Signing out other sessions is therefore different from merely choosing a new password.
Recovery is part of security
An unfamiliar backup email, phone number, passkey or trusted device can give the intruder a route back into the account.
The account can become an impersonation Mask
Messages sent from a real account may reach people who already trust the owner, making the next scam harder to recognise.
Consequences and movement
What may happen next
The right response depends on what has happened: exposure without access, suspicious access while you remain signed in, full loss of control or compromise of the device itself.
Credentials exposed but no access seen
Replace the password anywhere it was reused, enable stronger authentication and monitor login activity.
Unfamiliar activity while still signed in
Secure the account, sign out other sessions, remove unknown recovery methods and review messages, forwarding rules and connected apps.
Locked out of the account
Start the provider’s official hacked-account recovery process and warn contacts through another route if the account is sending messages.
Device or browser compromise suspected
Contain and clean the device as well as changing sign-in details. Otherwise new passwords or sessions may be captured again.
Practical response
What you should do
Work in dependency order. Secure the accounts that can reset or approve others before spending time on lower-value services.
- Begin with email and recovery accountsUse a trusted device and an address you type or have saved. Check whether you can still receive recovery messages.
- Change exposed or reused credentialsUse a unique password or a passkey. Do not make a small variation of the old password across several services.
- End unfamiliar accessSign out other sessions, remove unknown devices, revoke suspicious connected apps and inspect mail forwarding or filtering rules.
- Repair recovery settingsRemove unfamiliar phone numbers, email addresses, passkeys and trusted devices. Confirm that your own details are current.
- Enable stronger authenticationChoose a passkey where supported or enable two-step verification. Store backup codes safely and do not approve prompts you did not initiate.
- Check what happened insideReview sent messages, purchases, account changes, downloads and security logs. Notify affected contacts or providers if the account was used.
Look more closely
A stolen account can make a false request look familiar
A criminal using a genuine email, marketplace or social account inherits its name, history and trusted relationships. The request may therefore look ordinary even though control of the account and the purpose of the conversation have changed.
The approach arrives through an account or conversation the recipient already recognises.
The real account supplies name, history and social proof.
The intruder redirects payment, recovery, files or conversation.
Contacts, linked accounts and records may remain affected after access is restored.
Selected history
Historical cases and lasting lessons
Large compiled credential datasets
Researchers described multiple exposed datasets containing billions of login records drawn from infostealer logs and earlier leaks, with duplication across the collection.
Lasting lesson: A record total is not a unique-person total. But reused current sign-in details can still turn one exposure into access across several services.
Credential stuffing
Automated attempts reuse sign-in details from one exposure against unrelated services.
Lasting lesson: The breach can occur elsewhere. The protection comes from making each important account’s credential unique and strengthening recovery and sign-in.
Transferable understanding
Patterns over time
A password change is necessary but sometimes incomplete
Sessions, recovery methods, malicious devices and connected apps can preserve access.
The most important account may not hold money
Email, mobile and cloud accounts can reset or verify many other services.
A valid sign-in is not always a valid person
Systems can accept the correct credential even when it was stolen, phished or replayed.
Passkeys reduce phishing risk but still require account care
The device or credential manager, recovery route and removal of old sign-in details remain part of the security picture.
Plain-language answers
Common questions
Should I use a password manager?
A reputable password manager helps create and store unique passwords and can reduce reuse. Protect the manager account strongly and keep its recovery information current.
Is SMS two-step verification useless?
No. It is generally stronger than a password alone, although passkeys and other phishing-resistant methods can provide better protection where available.
Why am I still seeing activity after changing my password?
An existing session, malicious connected app, forwarding rule, compromised device or altered recovery method may still be active. Review all of them.
Should I tell my contacts?
Yes, if messages were sent from your account or the account was used to request money, codes, files or personal information. Warn them through another route.
Recover through the provider—not through unsolicited help
Use the provider’s official hacked-account process. Anyone who contacts you unexpectedly and asks for codes, screen access, payment or a new recovery route should be treated as not confirmed.
Scamology Insights
Understand access, identity and route as separate problems
These apps, tools, books and courses can help you separate account access, identity claims and the way you were contacted—and understand why changing a password may be only one part of recovery. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency