Password or code
Change the password, sign out other sessions, check recovery settings, and tell the real provider about the exposure.
Free response plan · no login required
If personal information was exposed
Start by identifying what was shared, then protect the accounts and organizations connected to it. You do not need to publish the information here.
Right now
Reduce further exposure
- Stop replying to the person or site that requested the information.
- Write down the category of information shared without recording the full secret in this guide.
- If a password or code was exposed, change it immediately from the real provider site.
What may be connected
Match the response to the information
Payment information
Contact the card issuer or financial institution through a trusted channel. Review activity and ask what protective options exist.
Identity information
Contact affected organizations through official channels. Consider identity-theft guidance or a credit freeze from official sources.
What to say
Provider security script
I believe personal information connected to my account may have been exposed. I am contacting you through this official channel to ask what protective steps, session review, credential changes, or monitoring options are available. I will provide sensitive details only through your secure process.
Common version
A fake form, support call, or breached account
If you entered information into a fake form, close it and do not return. If someone called asking for a code or password, end the call and contact the real organization. If the exposure came from a service breach, use that service’s official notices and security guidance, not links sent by strangers.
Do not panic-pay: identity thieves and recovery scammers often create a second urgent problem after the first disclosure.
Over the next few days
Monitor and document
- Review statements, login alerts, recovery settings, and active sessions through trusted channels.
- Use unique passwords and multi-factor authentication for important accounts.
- Keep a private timeline of what was shared, when, and with whom.
- Use official identity-theft and reporting guidance on Training.
Scope and uncertainty
Exposure does not automatically mean misuse occurred, and no checklist can predict what a criminal may do. The affected organization or official identity-protection service can explain the options that apply to your situation.