Get Help

I Entered My Password on a Suspicious Website — What Now?

You typed a password into a page that turned out to be fake, or you were notified that a service you use had a data breach. Either way, that password should now be treated as compromised.

What to do now

If you entered your password on a suspicious website, treat that password as compromised. Go directly to the real service, change it, turn on MFA, and check recent account activity.

Do this now

Change the password on the affected account right away, using a strong, unique password.
If you use that same password anywhere else, change it there too — reused passwords are one of the most common ways accounts get taken over.
Turn on multi-factor authentication (MFA) if it isn't already enabled.

Then do this

Check the account's active sessions or login history for anything unfamiliar.
Use our Password Generator to create strong, unique passwords going forward.

Check these things

Is this password reused on other accounts, especially email or banking?
Does the account show any unfamiliar recent activity?

Don't do this

Don't reuse the same compromised password with small changes like adding a number.
Don't ignore breach notification emails from services you use.

When should I get help?

Contact the service directly if you can't regain access to the account.
Contact your bank if the password was for online banking.

Related help

Your situation may involve more than one issue. These related guides can help you work through the next step.

Clicked a Suspicious Link? What to Do NowIf you clicked a suspicious link, don't panic. Close the page and work out what happened next: entering a password, banking details, an OTP, or downloading a file changes what you should do now.I Think Someone Has Access to My Account — What Do I Do?If you see activity you don't recognise, secure the affected account directly, change the password, enable MFA, review recent activity and linked devices, and contact the provider if necessary.I Entered My Banking Details on a Scam Site — What Now?If you entered banking or card details into a suspicious site, contact your bank immediately through its official app, website, or trusted contact number. Do not use details from the suspicious message.

Loading Cyber Conduct…

Please wait while the page loads.