Find protection in the account you already use

Prepare and choose your service

This guide covers personal accounts. Follow your IT team’s instructions for a work or school account. If money is at risk, use the urgent first steps first.

Use your own trusted device and the official app. Enter the service address in the browser’s address bar. Enter passwords and codes only in the official process you started yourself; this website does not ask for them.

Choose Google / Gmail, Microsoft / Outlook, Apple / iCloud, Facebook and Instagram or WhatsApp. If you have already lost access, go to recovery.

Labels help you recognise controls. Their wording and arrangement vary with version and account type. If you are following this with a Serbian-speaking relative, the Serbian version explains these English labels alongside each step.

Google Account and Gmail

To add verification:

1. Open myaccount.google.com and check the email address shown.
2. Choose Security & sign-in.
3. Under How you sign in to Google, open 2-Step Verification.
4. Set up an offered method you can use. Our 2FA guide explains the differences.
5. Open Backup codes there, if available, and store the codes securely. Each used code stops working; a new set replaces the previous set.

For passwords and devices: open Password in security settings to replace it. Then review Your devices → Manage all devices. Open an unfamiliar session and choose Sign out. One phone may have several sessions; inspect details before concluding someone broke in. Check Recovery phone, Recovery email and connections to other apps too.

For email forwarding: open Gmail on a computer, the Settings cog, then See all settings. Inspect the destination under Forwarding and POP/IMAP or Forwarding. If you did not authorise it, choose Disable forwarding, then Save Changes. Review Filters and Blocked Addresses too: a filter can forward selected messages separately. Record a suspicious rule before removing it.

The review is complete when you recognise sign-in and recovery methods, have checked sessions and found no unapproved forwarding. An open app alone does not establish this.

Microsoft account and Outlook.com

These steps cover personal Microsoft accounts, including Outlook.com and Hotmail. The Outlook app may also display another provider’s email; use that provider’s account settings in that case.

1. Open account.microsoft.com/security.
2. Choose Change password if replacing an existing password.
3. For an additional check, open Manage how I sign in.
4. Under Additional security → Two-step verification, choose Turn on and finish setting up an offered method.
5. Create a Recovery code and keep it separately. A new code replaces the previous one.

Review the listed identity-verification methods. If someone else may have access, find Sign out everywhere in advanced security options and confirm. Microsoft says this can take up to 24 hours and excludes Xbox consoles; do not assume every access ends immediately.

In Outlook.com, open Settings → Mail → Forwarding and IMAP. Disable forwarding you did not set up and save the change. Check mail Rules too, since these can redirect messages separately.

Apple Account and iCloud

On an iPhone or iPad already signed in to your Apple Account:

1. Open Settings.
2. Tap your name, then Sign-In & Security.
3. Open Change Password if replacing the account password. This is different from the device unlock passcode.
4. Check that Two-Factor Authentication is on and that you recognise the trusted phone numbers.
5. Return to the screen with your name and review the device list. Open and remove a device you do not recognise from the account.

On Mac, start at Apple menu → System Settings → your name → Sign-In & Security. Apple may require additional verification or a security delay before a password change.

Apple’s trusted-device and phone-number checks differ from Google’s backup-code set. Review available recovery options while you still have access. If your iPhone was stolen, use the lost-device steps: do not remove it from Find My, as that removes Activation Lock.

Facebook and Instagram

Open your app and check you are managing the intended profile. Look for Security Checkup in settings. It guides you through sign-in activity, profile information and recovery contacts. Controls may be grouped in Accounts Center and Password and security.

1. Open the security checkup for the selected account.
2. Review login activity and sign out access you do not recognise.
3. Check that recovery phone numbers and email addresses belong to you and remain accessible.
4. Set up Two-factor authentication for that profile. If using an authenticator app, complete the linking and code confirmation the service requests.
5. Replace an exposed password through Change password in security settings. Store backup codes securely if offered by that process.

Check each Facebook and Instagram account separately. Availability on one profile does not confirm protection on another. If you cannot open the account, use the recovery route below; do not buy “profile recovery” from someone messaging you.

WhatsApp

1. In WhatsApp, open Settings → Account → Two-step verification. Android settings are also available from the three-dot menu.
2. Enable the additional check using the options shown. It may request a PIN or password, separate from the six-digit registration code delivered by message or call.
3. Check and confirm your recovery email when offered.
4. Open Linked devices, from the three-dot menu on Android or settings/profile on iPhone.
5. Tap a device you do not recognise and choose Log out.

If you have lost access, register your number again in the official WhatsApp app. Enter the registration code in the app; do not send it to anyone. If asked for an additional PIN or password you do not know, use the offered recovery method and observe the waiting period shown. Contact your carrier first if you no longer control the SIM or number.

After regaining access, review linked devices and warn contacts through another channel if someone sent messages in your name.

When you cannot sign in

Open the relevant official route from a trusted device. If a previously used device is safe, use it because the provider may recognise its earlier sign-ins.

Try another way offers an alternative verification method; Forgot password? starts a reset; I don’t have access indicates the offered method is unavailable. Choose the option that describes your situation. Do not claim control of an address or number you do not recognise. A request does not guarantee recovery. Continue with the account recovery guide.

Check the result before replacing a phone

Keep access on the old trusted device until you have tested sign-in on the new one. Confirm you can complete additional verification and know where your backup access is kept. Store codes securely somewhere accessible without the account they protect.

If a menu differs, use settings search for the feature name where available. Check the account and app version. When helping another person, show the step but let them enter their own secrets privately.