I Gave My Password to a Scammer: What to Do in the First Five Minutes

Everyone likes to think they would never fall for a phishing link, but these attacks have become remarkably sophisticated. The fake login page looks identical to your bank, your email provider, or your social media platform. You enter your credentials, hit submit, and then you notice the URL is slightly wrong. Your stomach drops. You have just handed the keys to your digital life to a stranger.

Time is now your enemy. Most scammers work in automated batches, testing stolen credentials within minutes. If you act fast, you can often lock them out before they change your recovery settings or drain your accounts. Here is exactly what to do in the first five minutes.

Step 1: Change the Password from a Different Device

Do not close the phishing tab and type your new password into the same browser window. Malicious sites sometimes run scripts that capture keystrokes even after you realize the mistake. Grab your phone, a different computer, or a tablet.

Open the official app or navigate manually to the real website by typing the address yourself. Never use the back button or any links from your history. Change your password immediately. If the scammer has not yet logged in, this single action cuts their access.

Step 2: Sign Out of All Active Sessions

Most major services let you view and terminate active sessions. In your security settings, look for options labeled “Where you’re signed in,” “Active sessions,” or “Devices.” End every session except the one you are currently using.

This kicks out the scammer if they already entered your old credentials. It also prevents them from staying logged in via a cached session even after you changed the password.

Step 3: Enable Two-Factor Authentication Immediately

If you did not have two-factor authentication (2FA) enabled before, set it up right now. Choose an authenticator app or hardware key rather than SMS if possible, since phone numbers can be hijacked through SIM swapping.

If you already had 2FA enabled but the scammer somehow bypassed it or you entered a one-time code on their fake page, check your 2FA settings. Remove any backup codes you may have stored in your email or cloud accounts and generate new ones. Check that no new phone numbers or authentication apps have been added to your account.

Step 4: Check for Unauthorized Changes

Scammers often add their own email addresses or phone numbers as backup recovery options. Review your account’s contact information and security questions. Delete anything you do not recognize.

Look at your recent sent emails, social media posts, or financial transactions. Sometimes attackers use compromised accounts to phish your friends or initiate fraudulent transfers within minutes of gaining access.

If You Are Locked Out Already

If the scammer changed your password first and you cannot log in, head straight to the account recovery page. Select the option that says you were hacked or do not recognize recent changes. You will likely need to verify your identity through a backup email, a trusted contact, or by answering security questions.

While waiting for recovery, alert your contacts on other platforms that your account is compromised. This stops the scammer from using your identity to target your friends and family.

Tell Your Bank If Money Is Involved

If the compromised password protects a financial account, call your bank’s fraud line immediately after securing the login. They can place temporary holds on transfers and issue new cards if payment information was saved in the account.

Do not wait to see if unauthorized charges appear. Proactive alerts help your case if you need to dispute transactions later.

Prevention for Next Time

Once the crisis passes, install a reputable password manager. These tools generate unique passwords for every site and will not autofill your credentials into a fake domain. They make phishing almost impossible because they check the URL before entering data.

Finally, remember that legitimate companies rarely ask you to confirm your password via email or text. When in doubt, navigate to the site manually rather than clicking links. That five minutes of caution can save you from the frantic recovery scramble.