Account Takeover, Identity Theft and Fake Technical Support

Account Takeover

Account takeover means someone gains control of an account without permission. This guide helps families recognise stolen access, identity misuse and fake technical support. For example, an offender may use a real account to send false payment requests to friends. However, a frightening warning does not by itself prove that someone controls your device.

If money or banking access is involved, contact your bank immediately through its official route. Stop responding to the caller or message. Also, use I think I have been scammed: what to do next to choose the response for what you shared.

Table of contents

Recognising account takeover

UK NCSC account recovery guidance lists signs such as unfamiliar messages, changed security details and transactions you did not make. You might also lose the ability to sign in. These signs warrant checking through the official service, rather than replying to a warning message.

  • Open the account independently. Use its established app or website to review recent activity.
  • Check changes you did not make. Look for altered recovery details, unfamiliar devices or unexpected purchases.
  • Ask affected contacts what they received. Use a separate trusted route if someone is impersonating you.
  • Record the timing and account involved. Keep relevant messages and transaction references safely.

A location label can be imprecise, and a failed login can have an ordinary cause. Therefore, explain the whole pattern to official support. You do not need to diagnose the exact method before securing access or asking the bank for help.

Account takeover can involve more than a password

A September 2026 FBI warning explains that approving a malicious connected app can give criminals lasting access even if they never learn the password. The FBI’s 1 September 2026 advisory on OAuth consent phishing describes false file-sharing invitations that lead to a real provider’s permission screen. If a user approves the request, the app may read email or stored files through an authorised token, and a password change alone may not revoke it. Review and remove unfamiliar connected applications and permissions in the provider’s security settings, and ask its official support team for help if necessary. This is US threat intelligence, while Irish reporting and consumer steps remain governed by Garda and NCSC guidance.

A stolen password is one route, particularly when the same password protects several services. Another request may seek a live login code or an approval on your phone. Read what the prompt actually authorises and decline an action you did not start.

The FBI’s consent phishing alert describes permission requests on a genuine provider screen. Approving a malicious app can grant access without revealing the password. Consequently, changing the password alone may leave that permission active.

Similarly, linking a messaging device can give another device access to the service. A request to scan a code may therefore do more than open a webpage. If you approved something, tell official support exactly what you selected or scanned.

Respond to account takeover

Check for access that survives a password change. Use the service’s official security controls to review active sessions, recovery email addresses, linked devices, authorised applications and automatic forwarding rules. Remove access you do not recognise and ask the provider for assistance when you cannot safely regain control. The UK NCSC account recovery guidance explains why checking email forwarding and account activity matters. Use Garda reporting routes if you are in Ireland.

  • Recover access through the provider. Open its official help page yourself if you cannot sign in.
  • Protect email early. It may receive recovery links for other accounts.
  • Change affected and reused passwords from a trusted device. Do not make these changes while an unknown person controls the screen.
  • Review sessions, linked devices and app permissions. Follow the service’s instructions to remove access you did not authorise.
  • Check recovery methods and email rules. Look for unfamiliar addresses, forwarding, filters or login methods.
  • Review payments and notify affected contacts. Ask the bank about unfamiliar financial activity promptly.

For example, Google’s compromised account guidance provides its own recovery route and checks for devices, security activity and Gmail rules. Other services have different processes. Use their current official help rather than copying Google’s menus into another app.

If a school or employer manages the account, contact its known IT team too. They may control recovery or app permissions. However, do not approve a new request merely because an unsolicited caller claims to work for that team.

Phone number loss and SIM related risks

FBI guidance on SIM swapping explains how criminals can move someone’s phone number to a SIM they control. That can expose calls or texted recovery codes. Unexpected loss of service deserves attention, although an outage alone does not prove a SIM swap.

Contact your mobile provider promptly through an independent route if service disappears or you receive an unexpected transfer notification. Ask it to check the number and account changes. Also, contact financial providers if the number protects those accounts. Use another safe phone or device when needed.

Do not give a caller an activation code or approve a number transfer to fix a supposed fault. Instead, verify the request with your real provider. Its available account protections and identity checks may differ, so ask what applies to your account.

Fake support and infection warnings

Beware of fake support numbers in sponsored search results. The FTC warned in January 2026 that criminals can pay for search advertisements displaying fraudulent customer-service telephone numbers. A caller requesting screen-sharing software, verification codes or urgent money transfers has not been verified because their listing looks official. Disconnect suspicious remote sessions and contact your bank or technology provider through its own official app or known telephone number. Legitimate remote-support programs can be misused by criminals.

US FTC technical support guidance describes fake computer warnings, search adverts and supposed renewal invoices. A caller may offer to remove an infection or refund an unwanted subscription. However, the story can lead to a demand for payment or remote control.

A loud webpage, countdown or displayed error list does not establish an infection. Do not call the number in the warning, install its suggested tool or paste a command it supplies. Instead, leave the pressured contact and seek help through the software maker or a trusted professional.

Similarly, check a claimed renewal in your own account and bank records. An invoice email alone does not show that a charge occurred. If an unfamiliar charge is real, contact the bank through its official route rather than the number on the invoice.

If you allowed remote access

Australian government remote access guidance advises immediate bank contact after a criminal accesses a device. A legitimate remote support tool can still be misused. Therefore, the app’s familiar name does not verify the person asking to use it.

  • Disconnect the affected device from the internet if someone is controlling it now.
  • Use another trusted device to contact your bank. Explain what the person could see or do.
  • Arrange trusted technical help. Record the app name and seek help removing unwanted access and checking the device.
  • Secure important accounts separately. Review passwords, sessions, recovery methods and permissions through official instructions.
  • Keep evidence safely. Do not reconnect to the caller or reinstall their tool to collect more.

Uninstalling one app does not establish that every account or permission is secure. Also, avoid a rushed reset before discussing evidence and necessary backups with trusted support. Choose the response for the access involved, rather than accepting a paid guarantee that everything is fixed. Our Recovery Scams and Repeat Targeting guide explains how to check further offers of help.

Identity theft and impersonation

Someone can copy your name and photograph into a new profile without entering your original account. Report the impersonating profile to the platform and warn relevant contacts safely. However, changing your password cannot remove an entirely separate profile.

If documents or identifying details were exposed, use Protecting Personal Information Online for wider guidance. Contact the issuing organisation and any affected bank through independently verified details. Explain which information you shared and ask what precautions fit it.

Also, query unfamiliar accounts, debts or official correspondence with the real organisation promptly. Keep records of suspected misuse and report suspected crime to Gardaí. Avoid sending another identity document to a stranger who claims to verify the first one.

Account takeover prevention checklist

Ireland’s NCSC now includes passkeys as an account-security option alongside unique passwords and multi-factor authentication. Its account-security booklet advises using passkeys where supported and never sharing one-time login codes, PINs or passwords with someone claiming to be support staff. Passkeys can reduce phishing exposure when properly implemented, but they cannot prevent a user from being manipulated into authorising a payment, installing remote access or giving away sensitive information. Review the security settings available on each actual service rather than assuming all platforms provide the same options.

Ireland’s NCSC account security guide explains unique passwords, passkeys and extra login protection. These reduce risk, but no setting verifies every money request or app permission. Our personal information guide remains the place for general account protection and privacy advice.

  • Keep recovery details current and recovery codes secure.
  • Use supported passkeys or suitable extra login protection.
  • Review app connections and signed in devices periodically.
  • Install supported software updates.
  • Keep login codes private and decline unexpected approvals.
  • Verify a support request outside the channel that brought it.

Help a child or family member

Start with what happened and what access remains, rather than asking why they clicked. For example, offer to sit together while they contact the provider. Also, preserve their access to safe support instead of making disclosure feel like a punishment.

If a threat involves intimate material, use Sextortion and Financial Blackmail and seek Garda help. Do not ask anyone to forward sexual images of a child. If threats create immediate danger in Ireland, call 112 or 999.

Spot the pressure: account takeover

Fictional example: A parent receives a call after a warning appears on a laptop. The caller claims to be a technician and asks for remote access. They then say the bank needs a transfer to protect the family’s savings.

  • Claim: A technician and bank team can prevent an urgent loss.
  • Action: Give device access and move money.
  • Pressure: Fear and apparent technical authority.
  • Uncertainty: Neither the caller nor the claimed account problem has independent verification.
  • Safer response: End contact and use another trusted device to contact the real bank and trusted technical support.

Afterwards, discuss why a visible warning can make a caller seem credible. The Social Engineering guide explains that pressure. Use fictional exercises without sending deceptive messages to relatives.

Frequently asked questions

Does a new password end every form of access?

No. App permissions, linked devices and recovery changes can require separate action. Therefore, follow the affected provider’s complete recovery guidance.

No. A webpage can display a false warning. However, if you installed software, entered information or approved access, tell trusted support exactly what happened.

Who should I report account takeover to?

Contact the affected provider and your bank where financial access is involved. Also, report suspected fraud or threats through Garda reporting routes. Each report serves a different purpose.

Related CODA guides

References

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for families, schools and organisations. Our work connects practical cybersecurity with online behaviour and cyberpsychology. These guides support informed choices and appropriate specialist help.

Send a message

Contact Us about education, training or a parent session. This form is not monitored as an emergency service. Please do not send passwords, banking codes, identity documents or intimate images.

    Last updated: 26 October 2026