Account password changed by itself? Here's the fix

30-Second Fix: Check if it's a phishing email or a real change

First thing — don't panic. 9 times out of 10, that "your password was changed" email is a phishing attempt. I had a client last month who nearly clicked the "reset password" link in one of these. The email looked identical to Google's real notification, except the sender was no-reply@accounts-google.security instead of no-reply@accounts.google.com. Subtle, right?

Here's the 30-second check:

1. Look at the sender address — not just the display name. Hover over it. If it's anything other than the official domain (like @google.com, @microsoft.com, @facebookmail.com), it's fake.
2. Check for typos — real companies don't send password change confirmations with grammar errors. If it says "your passwrd has been changed", delete it.
3. Don't click any link in the email — not even the "report phishing" button inside the email. Close it and go directly to the service's website yourself.

If you can still log into your account normally, the email was a phishing attempt. Mark it as spam and move on. But if you actually can't log in, read on.

5-Minute Fix: Recover your account and enable 2FA

If your password actually changed — meaning you tried to log in and got "incorrect password" — you need to act fast. The attacker probably used a credential stuffing attack (they got your password from a data breach) and then changed it to lock you out.

Here's the step-by-step for the three big services:

Google / Gmail account recovery

1. Go to https://accounts.google.com/signin/recovery
2. Enter your email and click "Forgot password?"
3. Use the recovery email or phone number you set up. If you never set one up, you'll answer security questions. If you don't have those either, you're stuck — that's why I yell at clients to set recovery options.
4. Once inside, go to Security → 2-Step Verification and enable it. Use an authenticator app (Google Authenticator or Authy), not SMS. SMS can be intercepted.
5. Then go to Security → Your devices and sign out all other sessions.

Microsoft account recovery

1. Go to https://account.live.com/password/reset
2. Click "I forgot my password" and verify via recovery email/phone.
3. After resetting, go to Security → Advanced security → Turn on two-step verification.
4. Under "Sign-in activity", review any recent logins from unknown locations. Remove any device you don't recognize.

Facebook / Instagram recovery

1. Go to https://www.facebook.com/login/identify
2. Enter your email/phone. If the hacker changed those, use the "Identify your account" option with your name and friends.
3. Once back in, immediately change your password to something unique (use a password manager).
4. Go to Settings → Security and Login → Two-Factor Authentication. Enable it with an authenticator app.
5. Under "Where You're Logged In", click "Log Out Of All Sessions".

Important: After recovery, check if the hacker added a recovery email or phone number of their own. Remove it immediately. I've seen people recover their account only to get locked out again a week later because they missed this.

15-Minute Fix: Full malware scan and password manager audit

If your password changed without any obvious phishing trigger — no suspicious emails, no data breaches showing up on haveibeenpwned.com — then you likely have malware on your device. This is rare but happens. I had a client whose work laptop got infected with a keylogger from a fake invoice PDF. The attacker watched her type her password, then changed it while she was asleep.

Step 1: Scan for malware

• Windows: Run a full scan with Microsoft Defender Offline. Reboot, press F8 to boot into safe mode, then run it from there. Don't just run a quick scan — run the full offline scan. It takes 10-15 minutes but catches rootkits and bootkits.
• Mac: Download Malwarebytes for Mac (free version) and run a full scan. Macs aren't immune. I've seen fake Adobe Flash installers that install info-stealers.
• Android/iOS: Uninstall any apps you don't remember installing. Then run a scan with Malwarebytes mobile app. If you sideloaded an app outside the official store, that's likely the source.

Step 2: Check your password manager

If you use a password manager (you should), check if any of your passwords were leaked. Go to https://haveibeenpwned.com and enter your email. If any service you used shows a breach, change that password immediately — and every other account that uses the same password (please don't reuse passwords).

Step 3: Change your recovery options

After malware, your recovery emails and phone numbers might be compromised. Go into each account and:

• Remove any recovery options you don't recognize.
• Add new ones with fresh, unique passwords.
• Enable FIDO2 security keys if your accounts support them (Google and Microsoft do). A hardware key like a YubiKey is bulletproof against phishing.

Step 4: Change the passwords on other important accounts

Once malware is confirmed, assume every password you typed on that device is compromised. Change your email, bank, social media, and any financial accounts — in that order. Use a different device (like your phone or a clean laptop) to do this, so the malware can't capture the new passwords.

Real talk: If you got hit by a keylogger or infostealer, the bad guys already have your passwords. Changing them from the same infected device is like locking your front door while leaving the back door wide open. Use a clean device, or boot from a USB live Linux environment to change passwords safely.

When to nuke everything and start over

If you've done all the above and your password still changes again within a week, you're probably dealing with a persistent remote access trojan (RAT) or a session cookie stealer. In that case:

• For Windows: Back up your personal files to an external drive (after scanning them with Defender), then do a clean install of Windows 11 from a USB drive. Use Microsoft's Media Creation Tool. Don't use the "Reset this PC" option — that doesn't always remove rootkits.
• For Mac: Boot into Recovery Mode (reboot and hold Command+R), erase the main drive with Disk Utility, then reinstall macOS.
• For phones: Factory reset from the settings menu. Don't restore from a backup — you'll just reinstall the malware. Start fresh.

I know that sounds extreme. But I've seen too many small businesses lose weeks of productivity because they kept trying to patch around a deep infection. A clean install takes two hours and saves you a month of headaches.

Quick checklist to prevent this from happening again

• Use a password manager (Bitwarden, 1Password, or KeePass). Generate unique 20-character passwords for every account.
• Enable two-factor authentication on every account that supports it. Use an authenticator app (not SMS).
• Never click links in password change emails. Always type the website URL yourself.
• Keep your OS and browser updated. Malware often exploits known vulnerabilities. Windows Update and Chrome auto-updates are your friend.
• Use a DNS filter like NextDNS or Quad9 to block known phishing domains. It's free and works at the network level — no software needed.

That's it. If your password changed without your action, it's almost always a phishing attempt or a data breach. Act fast, enable 2FA, and don't reuse passwords. You'll be fine.