Password Reset Priority Order Following Credential Theft

Change your email password first. Do it now. That single inbox controls password resets for every other service you use, so a phished email password is not one lost account. It is a master key. Within minutes, whoever took it can reset your banking, social media, and cloud storage logins, lock you out, and drain what they can reach. Breach analyses show that over half of people reuse passwords across services. That habit turns one stolen password into many account takeovers. Resetting in the wrong order leaves a recovery path open, and the intruder will use it before you finish.

Continue with the section overview or a closely related question:

• Secure accounts and devices
• How do I protect identity documents after theft?
• How does multifactor authentication help?

Change your email password before doing anything else. The inbox is the single point of failure in credential stuffing because every “forgot password” link from every other service lands there. Someone inside your email can search for financial statements, find linked accounts, and trigger password resets faster than you can type a new one. Most email providers keep session tokens alive for 24 to 48 hours, but a stolen token can be refreshed indefinitely if the intruder enables forwarding rules or sets a recovery phone number you do not control.

Lock Down Forwarding And Sessions

Immediately after changing the password, review the account’s forwarding rules, auto-reply settings, and associated recovery addresses. Phishing kits often run scripts that add a hidden forwarding address to collect reset links silently. Remove any app-specific passwords or third-party application connections you do not recognise. If your email provider logs active sessions, terminate all of them. This invalidates any session token theft that may have occurred alongside the credential harvest.

Add Two-Factor Authentication Correctly

Enable two-factor authentication now, not before the password change. A SIM swap can intercept one-time codes sent to a phone number, so use an authenticator app rather than SMS if the provider supports it. The two-factor bypass rate for SIM swap attacks is near total when the adversary controls both the phone number and the email inbox. That is exactly the situation you are trying to prevent.

After the email account is secured, move to the services where credential stuffing will cause the most financial or identity damage. Order matters. Automated tools test stolen credentials against dozens of services simultaneously. Detection can take minutes, but the typical victim notices days later when a bank alerts them. You do not have days.

Financial accounts are next. Banking, payment apps, and cryptocurrency exchanges must be reset immediately because they hold transferable assets. Change the password, then check for any linked external accounts or API keys that could provide a backdoor. A remote access trojan may have installed during the phishing attack, so perform these resets from a different device if possible. Modern info-stealers can survive a reboot through scheduled tasks or registry keys. No password change protects an already-compromised machine.

Social media and messaging accounts follow. These are vectors for impersonator attacks against your contacts and for gathering the personal details needed to bypass security questions elsewhere. After resetting, review recent messages for any that were sent without your knowledge. Fraudsters often use a compromised real account to reach the victim’s network with advance-fee scams or fake investment offers.

Reset banking first, then investment and retirement accounts, then credit cards, then payment services. The logic is asset transfer speed. A bank wire can clear in hours. A cryptocurrency withdrawal clears in minutes. Credit cards have chargeback protections that delay loss, and payment services often hold funds for review. Order by how fast money can leave.

For each financial account, change the password and then verify the contact phone number and email on file. An adversary who reached this step before you may have already changed the recovery phone number to one they control, a classic SIM swap tactic. If your mobile service suddenly dropped earlier, assume a SIM swap was attempted or completed and begin recovery with your carrier immediately. Request the porting record within days; carrier logs decay fast.

Enable transaction alerts for any amount, even a single dollar. This catches someone testing the account before a larger transfer. The same password may have unlocked a secondary account you forgot, and transaction alerts are your fastest detection method when you are not watching.

Lock down the phone numbers, backup email addresses, and security questions that can reset the accounts you just secured. An adversary who cannot get into your primary email will pivot to the recovery phone number next. A SIM swap against that number gives them the one-time code that resets everything. Contact your mobile carrier and add a port freeze or account PIN that must be provided in person or through a secondary verification channel.

Scrutinise Backup Email Addresses

Backup email addresses need the same scrutiny as the primary inbox. Change their passwords and review forwarding rules. If the backup address was compromised, the intruder may have already routed recovery messages to a folder you do not check. Session token theft applies here too, so terminate all active sessions on backup accounts.

Replace Security Question Answers

Security questions are a weak point that credential stuffing exploits across services. Change any answers that could be derived from information in your compromised inbox or social media profiles. Use answers that are not factually true, stored in a password manager, rather than real information someone can research. A phishing mirror that captured your credentials may also have captured the answers to “mother’s maiden name” during the same session.

Finally, review the account recovery settings on every service you reset. Remove any recovery methods you do not control. The takedown speed of a phishing domain is irrelevant if the intruder already used the credentials to register a new recovery path that outlasts the original attack infrastructure.

Reset Order	Account Type	Primary Attack Vector	Time to Damage
1	Email	Password reset interception, forwarding rules, session token theft	Minutes
2	Financial	Credential stuffing, SIM swap, remote access trojan	Hours
3	Social & messaging	Impersonator account creation, advance-fee fraud	Hours to days
4	Recovery phone	SIM swap, two-factor bypass	Hours
5	Backup email	Recovery loop compromise	Days
6	All other services	Credential stuffing, credential reuse multiplier	Days to weeks

Understanding the intruder’s timeline makes the reset order intuitive rather than a checklist to memorise. Within the first five minutes of a successful credential harvest, an automated phishing kit exfiltrates the credentials to a backend server. Within ten minutes, the phisher or a script tests the email account and locks out the victim by changing the password. Detection is near-instant on their side, but you may not realise for hours.

If the email account yields linked financial institutions, the phisher triggers password resets on those next. Session token lifespan on banking sites is often shorter than email, but a determined adversary works inside that window. An info-stealer infection that captured session tokens alongside the password eliminates the need for a reset at all; the intruder is already logged in. This is why terminating all active sessions during the email reset is the single highest-impact action you can take.

If money cannot be moved immediately, the phisher pivots to information gathering. The inbox is searched for identity documents, tax returns, and correspondence that reveal additional accounts. This reconnaissance phase feeds the credential stuffing prevention sequence later because the adversary now has targeted account names, not just random breach pairs from a public dump.

No password reset sequence works if a remote access trojan or info-stealer remains on the device you are using. A well-built loader can survive standard uninstall attempts and reinstall through scheduled tasks or registry entries. If you clicked a link and entered credentials on a phishing mirror, consider the device compromised until you can verify otherwise.

Perform the password resets from a different, known-clean device. A borrowed phone or a factory-reset tablet is safer than the machine where the phishing kit ran. If you must use the same device, run an offline malware scan first, ideally from bootable media rather than the installed operating system. The clipboard hijacker class of malware is particularly dangerous because it waits silently for you to copy a wallet address or account number, then substitutes one controlled by the phisher at paste time.

After the critical resets are complete, back up essential files and reinstall the operating system. Evidence volatility works against you here: the longer the infected system runs, the more credentials and session tokens an info-stealer can exfiltrate. Do not log into the newly secured accounts from the compromised device until the wipe is complete.

Resetting passwords does not mean you should discard evidence. The phishing email, the mirror domain, and any suspicious login alerts are all part of a report you can file with agencies like IC3 or Action Fraud. Before you change anything, screenshot the phishing message with full headers visible. Save the email as a .eml file rather than forwarding it, because forwarding strips the technical metadata that investigators need for attribution.

Handle The Phishing Domain Safely

Note the phishing mirror domain, but do not visit it again from a device you intend to keep using. Use a separate machine or a virtual machine that you can discard. A single domain report rarely triggers action alone, but combined with hundreds of other victims, it builds the pattern that justifies a takedown request.

Record Every Transaction Detail

If funds were transferred, record every transaction hash and wallet address. Blockchain records outlive websites, and these addresses are often reused across incidents. Phishing domains reappear constantly because cheap infrastructure makes re-registration trivial, but wallet address reuse is a durable signal that survives infrastructure churn. Provide these to the reporting agency even if they do not ask. Most intake forms are not designed for cryptocurrency theft, and attaching the details in a supplemental document improves the chance that an analyst sees a match.