If you suspect your account or device has been compromised, act immediately. Speed matters: every minute of attacker access is another minute they can exfiltrate data, set persistence mechanisms, and escalate to other accounts. The first priority is containment — stop the bleeding before assessing the full extent of the damage.
The immediate response sequence for a compromised account: change the password from a clean device (not the potentially compromised one), enable 2FA if not already active, check for and remove unauthorized forwarding rules and connected apps, review recent account activity for actions you did not take, and notify the service provider through their official security or abuse channel.
If financial fraud is involved, contact your bank or card provider immediately. Most fraud protections have time limits — acting within hours rather than days significantly improves recovery prospects. Request a hold on affected accounts and initiate a fraud dispute through official channels.
Document what happened: when you first noticed the issue, what symptoms appeared, what actions you took, and what you found. This documentation is valuable for recovery, for police or fraud reports, and for understanding how the incident occurred so it cannot recur. Screenshots and timeline notes are worth the extra minutes they take.