Samsung Galaxy · Recovery Guide

How to Tell If Your Samsung Account Has Been Compromised

Learn the signs of a compromised Samsung account and how to check them on your Galaxy phone and the web.

Unusual Activity on Your Samsung Account

If your Samsung account has been compromised, you might notice strange things happening. Pay close attention to these indicators, as they can be early warnings.

• Unexpected emails from Samsung about password changes or account access that you didn't initiate. Check your spam or junk folders too.
• New devices appearing in your registered devices list on your Samsung account webpage (account.samsung.com) that you do not recognise.
• Changes to your profile information, such as your name, date of birth, or contact details, that you did not make.
• Inability to log in to your Samsung account despite using the correct password, suggesting it might have been changed by an unauthorised person.

Unrecognised Activity on Your Device

A compromised Samsung account can sometimes manifest through unusual behaviour on your Galaxy phone itself. Look out for these signs directly on your device.

• Applications being installed or uninstalled without your knowledge. Check your app drawer regularly for unfamiliar apps.
• Unfamiliar purchases or subscriptions appearing on your billing statements linked to your Samsung account. Review these statements carefully.
• Your phone's settings being changed without your input, such as new language settings or altered security preferences. Go to Settings to review.
• Messages or calls being sent from your phone that you didn't send. Check your messaging and call logs for anything out of place.

Checking Your Samsung Account Security Settings

You can directly check your Samsung account's security status on the web to look for signs of unauthorised access. This is a key step in confirming a compromise.

1. Visit the Samsung account website at account.samsung.com and log in.
2. Navigate to Security and privacy or similar section.
3. Look at Activity history or Recent access to see a log of when and where your account has been accessed. Pay attention to unfamiliar locations or times.
4. Review the Registered devices list to ensure all devices linked to your account are yours and that there are no unknown additions.
5. Check your recovery email and phone number listed under Profile information to ensure they haven't been changed by an attacker.

Investigating Find My Mobile and Secure Folder Activity

If your Samsung account is compromised, attackers might try to access or manipulate features like Find My Mobile or Secure Folder. Always investigate these areas.

• Check the Find My Mobile website (findmymobile.samsung.com) for any unfamiliar location tracking, lock attempts, or data wipe commands that you didn't initiate.
• On your phone, go to Settings → Security and privacy → Find My Mobile and ensure its settings haven't been altered.
• Look for any new or unfamiliar apps within your Secure Folder, or if the Secure Folder itself has been unexpectedly removed or reset on your device.
• If you use Knox security, check its status and settings for any unauthorized changes or alerts within the Knox app or related settings.