Lock the attacker out, then dispute or cancel anything they bought.
What to do
- Reset the password from a clean device and sign out all other sessions
- Remove any saved payment method, address or shipping option you don't recognise
- Cancel any pending order and contact the courier to refuse delivery if it has shipped
- Report unauthorised orders to the marketplace fraud team and request a chargeback on the card or PayPal funding source
- If the linked email is also compromised, recover the email account first (any reset link will go there)
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers