This account security audit checklist helps you find signs that a scammer, former device, compromised app, or reused password may still provide access to your accounts. Work through it after a phishing incident, suspicious login, device change, password breach, or as part of a regular security review.
Overview
Knowing your password is not the same as knowing whether someone still has access. An attacker may remain connected through an active session, a stolen browser cookie, a recovery email address, an old phone number, an email forwarding rule, a connected application, or an unfamiliar multifactor authentication method. Account takeover prevention therefore requires more than changing one password.
Use this audit one account at a time, beginning with your primary email account. Email is often the recovery channel for other services, so a compromised inbox can expose password-reset links, invoices, identity documents, and security notifications. Next, review financial, cloud storage, work, social, shopping, and communication accounts.
Use the provider's official website or app, reached through a bookmark or a manually entered address. Do not use a security link from a suspicious email, text message, QR code, or chat. If you recently clicked a phishing link, first review what to do after clicking a phishing link, and use a known-clean device where possible.
Quick risk-priority table
| Priority | Finding | Immediate action |
|---|---|---|
| Critical | Unknown active session, changed recovery method, unfamiliar MFA method, or evidence of financial access | Secure the account from a clean device, revoke sessions, change the password, remove unknown methods, and contact the provider or financial institution through an official channel. |
| High | Password reused elsewhere, unknown connected app, forwarding rule, browser extension, or unfamiliar device | Remove the access path, create a unique password, and review related accounts for the same exposure. |
| Moderate | Old devices, unused apps, outdated recovery details, or permissions you no longer recognize | Remove unnecessary access and update recovery information. |
| Routine | Everything is recognized, current, and protected with a unique password and suitable MFA | Record the review date and repeat it during your next security cycle. |
Checklist by scenario
If you suspect someone has access now
- Use a trusted device and a private network if practical. If the device itself may be infected, use another device for the first account changes.
- Change the password to a new, unique passphrase. Do not reuse a password from the suspected account or any other service.
- Choose the provider's option to sign out of all sessions or all other devices. Then inspect the active-session list for locations, browsers, operating systems, and recent activity you do not recognize.
- Remove unknown recovery email addresses, phone numbers, security questions, passkeys, authenticator entries, hardware keys, and backup codes. Generate new backup codes after removing any unfamiliar MFA method.
- Check recent security events, sent messages, deleted messages, profile changes, payment activity, and password-reset notifications. Save relevant evidence before deleting anything.
- Review linked accounts and connected applications. Revoke access for anything unfamiliar, unnecessary, or no longer used. To understand what to look for in suspicious messages, see how to analyze phishing email headers and links safely.
For your primary email account
- Password: Confirm it is unique and stored in a reputable password manager rather than in a document or message.
- Sessions and devices: Sign out unknown browsers, phones, tablets, mail clients, and remote sessions.
- Recovery: Verify every recovery address and phone number. Make sure they belong to you and can still be secured.
- MFA: Confirm the enrolled authenticator app, security keys, passkeys, and backup codes. Prefer a phishing-resistant method when the provider supports one and it fits your situation.
- Forwarding and filters: Look for automatic forwarding to an unfamiliar address, rules that mark security messages as read, filters that move invoices or password alerts, and delegated mailbox access.
- Connected mail apps: Review mail clients and applications with permission to read, send, delete, or manage messages.
- Delegation: Check shared inboxes, assistants, family access, aliases, and administrative roles.
For banking, payment, shopping, and crypto accounts
- Review logged-in devices, trusted browsers, beneficiaries, linked bank accounts, saved cards, withdrawal addresses, payment methods, and transaction limits.
- Remove payment permissions you did not create. For business accounts, independently verify any changed bank details or payment instructions using a known phone number or established contact.
- Check recent transactions, transfers, orders, refunds, gift-card activity, and account statements. Contact the provider promptly through its official app, website, or statement number if anything is unauthorized.
- Do not send additional money to someone promising to recover funds. If money has already moved, use the payment recovery decision guide and preserve transaction records.
For work, cloud, and social accounts
- Review administrator roles, organization membership, shared drives, public links, API keys, service accounts, and third-party integrations.
- Inspect email sending rules, mailbox delegates, OAuth permissions, browser extensions, and remote-access tools.
- On social accounts, check profile changes, linked phone numbers, advertising accounts, direct messages, active sessions, and applications allowed to post or read data.
- Tell your security or IT team through the established internal process. Do not forward sensitive evidence to an unverified address.
What to double-check
Security menus differ by provider, and the same access may appear under several names. Search the account's settings for terms such as security, privacy, devices, sessions, login activity, connected apps, authorized applications, delegation, mail rules, and forwarding. Record the date of your review because device and permission lists change.
Check browser extensions separately from connected web applications. A malicious or abandoned extension may read pages, alter payment details, or capture information even when the account's app-permission list looks clean. Remove extensions you do not recognize or no longer need, then review the browser's saved passwords and active profiles.
Also audit password reuse. If the compromised password appears on another account, change each reused account, starting with email and financial services. A password manager can help generate unique credentials and identify duplicates without requiring you to remember every password.
When contacting a provider, use this message as a starting point:
“I suspect unauthorized access to my account. Please review active sessions, recent security changes, recovery methods, connected applications, and account activity. I have secured the account as far as I can. Please tell me what additional steps are required and how to preserve or obtain relevant access logs.”
For a suspected payment or financial takeover, add the approximate time, transaction reference, amount, recipient, and the safest way to reach you. Never include a full password, one-time code, private key, or complete payment-card number in an email or support ticket.
Common mistakes
- Changing only the password: An attacker may still have an active session, recovery method, forwarding rule, or app token.
- Trusting a caller or message that offers help: Use the provider's official contact route. A fake customer-support scam may ask for remote access or a verification code.
- Deleting evidence too early: Save timestamps, sender addresses, URLs, screenshots, transaction details, and notification emails before cleaning up.
- Approving an unexpected MFA prompt: Repeated prompts can indicate that someone knows the password. Deny unrequested prompts and change the password through the official account interface.
- Keeping every old device connected: Remove devices that were sold, lost, replaced, shared, or reset without a documented reason to remain trusted.
- Assuming a familiar name means familiar access: Verify the specific email address, device, application, domain, and permission scope.
- Ignoring related accounts: If one password, recovery address, or device was exposed, audit accounts that share it.
If personal information or identity documents may have been exposed, document what was involved and consider the appropriate identity theft protection steps. If you need to preserve evidence or report the incident, use this scam reporting evidence checklist.
When to revisit
Repeat this account security audit after a phishing email, text scam, suspicious login, lost device, password breach, unexpected MFA prompt, payment fraud, or change to your recovery email or phone. Also revisit it when you adopt a new password manager, browser, cloud service, payment tool, or business workflow.
For routine maintenance, review high-value accounts at least during each major security or seasonal planning cycle, and review work accounts whenever roles, vendors, integrations, or payment processes change. Providers may move settings or add MFA options, so treat the labels and paths in this checklist as categories rather than permanent menu names.
To make the audit reusable, keep a simple record with the account name, review date, recognized devices, recovery methods, MFA methods, connected applications, and outstanding actions. Do not record passwords or backup codes in that document. Start with your email account today, revoke anything you cannot explain, change reused passwords, and schedule the next review before closing the checklist.
