When something is not right in your account

An order confirmation for something you never ordered, a changed delivery address you do not recognise, or an email about a new password you did not set yourself: the fact that your customer account has been hacked usually shows up first through small but unmistakable signs like these. At that moment, what matters most is the order in which you react, because some steps are more urgent than others and should not wait until after a long search online.

The good news is that most cases can be contained with a few clear steps, even if the exact situation differs from case to case.

Signs that an account has been hacked

• An email about a changed password or email address that you did not request yourself.
• Orders in your account history that you do not remember, some with an unfamiliar delivery address.
• A newly added payment method, such as a card that does not belong to you.
• A sign-in notification from a device or location you do not recognise.

The first step: secure access immediately

As soon as one of these signs appears, changing your password takes priority over everything else, including the question of how it could have happened in the first place. If you can still sign in with your old password, change it straight away to a new one that you do not use for any other service. If you can no longer open the account with your usual password because it has already been changed, the "forgotten password" function is usually the quickest way to get back in, as long as the email address on the account still belongs to you.

What to check straight afterwards

After the password, look at everything in the account that might have been changed without your knowledge. That includes the email address, the phone number, the delivery addresses and above all the saved payment methods. An unfamiliar card or PayPal account that has been added should be removed as soon as you have access again. At the same time, it is worth checking your order history to see whether an order you do not know about has already been placed.

If an order has already been placed

If you find an order in your account history that you did not place, cancel it if that is still possible, and also contact the shop's customer service so the delivery can be stopped if necessary. If one of your own payment methods was used for the order, a chargeback through your bank also makes sense if the shop does not reverse the charge itself. If an unfamiliar payment method that is not yours was added instead, the order usually does not affect you financially, but it should still be reported so the shop can block it.

Contacting customer service: what to report

Tell customer service briefly but completely what has happened: since when you have noticed anything unusual, which specific changes you have found in the account, and whether an order has already been placed. The same principles apply to how you write this kind of message to customer service as to any other complaint, except that speed matters even more here. Also ask specifically whether other sign-ins to the account can be traced, so you can find out how long someone has had access.

How it could have happened in the first place

The most common cause is a password that was already used for another service and fell into the wrong hands there, or a phishing message that tricked you into entering your login details on a fake site. It is worth knowing what phishing messages about parcels and payments look like, because messages like these are often the first step towards an account being taken over. If you used the same password for other accounts too, change it there as well, not just with the shop affected.

Prevention, so it does not happen again

A unique password for each account is the single most effective measure, because a stolen password then does not automatically open other accounts. It is also worth setting up two-factor authentication for your shop account, which asks for a second proof of identity alongside the password and makes it much harder for anyone to get in with a stolen password alone. If you find it hard to remember lots of different passwords, you can use a password manager rather than spreading variations of the same password across several accounts.

After recovery: sign out of all other sessions

A new password alone does not automatically end every existing sign-in on other people's devices. That is why many accounts offer an overview of the devices or sessions currently signed in under their security settings, together with an option to sign out of all of them except your current one. Use this function straight after changing your password, because without it someone else's session could in theory stay active, even if nobody can sign in again with the old password.

If a family member has access to the same account

If several people in the same household use one account, it is worth quickly asking before you change the password whether any of the unusual changes might have come from someone else in the family after all, such as a changed delivery address for a present. Only once this obvious explanation has been ruled out should you assume that a stranger really has had access and react accordingly. After resetting access, it makes sense to share the new password only with the people who really need it, and only in a secure way.

Frequently asked questions

What is usually the first sign that my account has been hacked?

Usually an email about a change you did not make, such as a new password, a new address or an unfamiliar order in your account history.

What should I do first if I can no longer sign in?

Use the "forgotten password" function via the email address on the account. If that does not work either, because even the email address has been changed, the only option left is to contact customer service directly.

Do I need to tell my bank if my account has been hacked?

Only if one of your own payment methods was actually used through the account for an order you did not place. If an unfamiliar payment method was added instead, you are usually not directly affected financially.

Is a new password enough on its own?

As a first step, yes, but afterwards you should also check whether you used the same password for other services and change it there too. Two-factor authentication further reduces the risk that a single stolen password is enough to get in again.