Last updated: October 21, 2026

Quick answer: change your passwords in a priority order on a trusted device, and start with email first. If a scammer has tried to get into your accounts, follow the steps in How to Change Your Passwords After a Scam Attempt by securing email, then bank and payment accounts, then social media, then everything else you reused.

Key takeaways

• Change the passwords that can unlock other accounts before you touch the lower-risk ones.
• Use a password manager if you can; it makes unique passwords practical after a scare.
• Replace every password that was reused anywhere, even if the scammer only targeted one account.
• If the scam touched your email, treat that as the control room and secure it first, and consider checking with a qualified professional if you are unsure how to proceed.
• A password reset helps only if the account still belongs to you and you can sign in normally.

What to do before you start

You need a safe device, access to your main email account, and a list of the accounts that might have been exposed. A phone or laptop you normally use is fine if it is up to date and not shared.

Before you begin, write down the accounts that matter most: email account, bank account, payment apps, social media account, shopping logins, and any work or cloud services. If you use a password manager such as 1Password, Bitwarden, or KeePass, open it now. If you do not, consider making new passwords by hand and storing them in a secure place; if you are unsure, consult a professional and follow the account provider’s guidance.

Two things matter here. A scam attempt does not always mean a password was stolen, but it can mean the credentials may have been exposed enough to reuse. If you have reused the same password on more than one site, changing only the targeted account leaves the others open. That is the mistake that turns one bad message into a wider break-in.

If you are looking for the larger cleanup after a scam attempt, this page fits under the broader guide to how to secure accounts and devices after a scam attempt, and a qualified professional can help if the situation feels uncertain. Here, I am focusing only on the password order and scope.

Change the passwords in the right order

Change the passwords that control recovery first, then the accounts that move money, then the accounts that can expose your contacts.

1. Open your email account settings and change that password first. Use the account’s own password reset or change-password page, not a link from the suspicious message. When it works, you should still be signed in on your trusted device and the new password should require re-entry the next time you log in.

2. Update the password on your bank account and any payment account next, including cards, wallet apps, or transfer services tied to money movement. If a bank site signs you out after the change, that is normal; the new password should be the one that works when you sign back in.

3. Change social media account passwords after that, especially if the scammer could have used them to message contacts. When the change succeeds, check that old sessions are closed and that the new password is required on another device.

4. Move to shopping, streaming, cloud storage, and utility logins next. These often store addresses, saved payment cards, or private files. The sign that the step worked is simple: each site accepts the new password and no longer accepts the old one.

5. Finish with every other account that reused the same password or a close variation. If one password was used in 5 places, all 5 need to be changed, not just the one that was mentioned in the scam attempt.

6. Save the new passwords in your password manager as you go, or in a secure record if you are not using one yet; if you are not sure which method is safest, consult a professional. If you finish 10 accounts and cannot remember which is which, the process is not done.

This order matters because password reset links usually go to email, and email often sits at the center of account recovery. If the email account is still exposed, a scammer can undo the rest of your work.

How to use a password manager without making the problem worse

A password manager is often the fastest way to replace weak or reused passwords with unique ones, and it is usually safer than trying to invent and remember 12 new passwords yourself. The trade-off is that you now have one master password to protect carefully.

Start by opening the manager on a device you trust and changing the master password only if you already know the current one and the device is clean. If you are setting one up after the scam, create a strong master password that is long enough to resist guessing and that you do not reuse anywhere else. Then let the manager generate new passwords for each account. Most tools can create random passwords of 16 to 24 characters or more, which is exactly what you want for accounts that matter.

Use the manager to replace password reuse first. That is the main payoff. One reused password can expose several accounts at once, and the manager breaks that pattern. After each reset, save the new login immediately so you do not lose track of which site was changed. If the manager offers a browser extension, install it only from the official site or app store, not from a link in a message.

The downside is that a password manager is a single point of access. If someone gets the master password, the vault can become a map of your accounts. That is why the master password should be long, unique, and never entered on a suspicious page. If you are not ready to keep one strong password secure, the manager will not help much.

For this topic, that is the best use case: one strong master password, many unique site passwords, no reuse. It is not the right choice if you cannot keep that master password private or you are using a shared device.

What to do about password reset links and breached credentials

Use password reset only when the account still belongs to you and you can reach the normal recovery path. A reset link is not a fix for a compromised account that you cannot access; it is the standard way to replace a password you still control.

If you receive a password reset email you did not request, treat it as a warning sign. Someone may be trying your email address and old password, or a site may have detected unusual activity. Do not click the link from the message itself if it came in during the scam attempt. Go to the site by typing the address yourself, then request a reset from there. If the site says your old password was breached or exposed, change it immediately and do not reuse any close variation.

Pay attention to breached credentials, which means a login pair has appeared in a leak or theft incident. Even if the scammer did not log in, breached credentials are enough reason to change passwords because attackers often try the same email and password combination on multiple sites. That is why the same password should never be reused across an email account, a bank account, and a social media account. For more detail, see guidance from the FTC and CISA.

There is one important limit here: if the scam attempt also took over your phone number, recovery can get messy because reset codes may go to the wrong place. In that case, the password change still matters, but it may not be the only step needed. This guide does not cover identity theft recovery, and that is deliberate. It is a different problem, and a qualified professional can help if you need that next step.

For the password job alone, the rule is simple: reset from the account site, not from the suspicious message, and replace any password that may have been in a breach.

Which passwords should you change first?

Change the passwords that can reach your money, your email, or your contacts before anything else. Start with the email account, then the bank account, then payment apps and any social media account that could message other people. If the same password was reused elsewhere, change those accounts next. A 10-minute delay on a low-risk site is less important than fixing the accounts that can be used to reset others.

Common mistakes that leave you exposed

Changing only one password is the most common mistake, and it leaves every reused login open. If the same password was used on 3 sites, the other 2 are still vulnerable. The fix is to list every place that shared the password and replace each one.

Using a password reset link from the scam message is another mistake. It can send you straight to a fake page, or it can train you to trust the wrong channel. The safer move is to open the site yourself from a bookmark or by typing the address.

Picking a “new” password that is only the old one with a number at the end is weak too. If an attacker guessed the old pattern, the new one is easy to predict. A password manager or a long random passphrase is better.

Skipping email is the mistake that causes the biggest mess. Email often controls password reset for other accounts, so leaving it unchanged means a scammer may still be able to reach your bank, social media, or cloud storage later. Fix that account first unless you have a specific reason not to.

Finally, saving new passwords in an unlocked browser profile or on a shared device defeats the purpose. If you must store them temporarily, use a password manager or a secure written record in a place only you can access.

Should you change every password after a scam?

No, but you should change every password that may have been exposed, reused, or linked to the scammer’s target. If the attempt touched your email, bank account, or a password you reused in 4 places, all of those passwords need to change. Accounts that were never shared, never reused, and never tied to the attack do not usually need immediate replacement. The exception is when you cannot tell what was exposed.

Finish the cleanup and keep the new passwords straight

After the password changes are done, sign out of other sessions where the site offers that option. Many services call this “log out of all devices” or “end all sessions,” and it helps push out anyone still connected. If you see a list of recent devices or browsers, review it for anything you do not recognize.

Then verify that your password manager reflects the new logins. If you are not using one, make a secure record of the sites you changed so you do not end up locked out later. The point is not just to survive today’s scam attempt; it is to avoid creating a new access problem next week.

If a site refuses the new password or your reset path is broken, stop and use the site’s official support channel. Do not keep guessing. Repeated failed logins can lock the account, and that turns a password job into a recovery job. That is a different task, and it takes a different path.

Is a password manager safe to use after an attack?

Yes, if you install or open it on a trusted device and protect the master password carefully. A password manager helps most when the scam exposed reused passwords, because it lets you replace them with unique ones quickly. It is not safe if you use a weak master password or sign into the vault on a device that may already be compromised.

Drafted with AI; not yet reviewed by a person.

Admin