What to do if someone hijacks an online account session

A person using your parent’s online account may not have guessed the password. A stolen session cookie can let someone use a browser session that was already signed in. The service may treat that person as authenticated, and some cookie-based sessions can bypass some forms of two-factor authentication. That alone does not tell you how access happened or prove the parent’s device has malware.

The goal is simple: use a trusted device, recover the account through the provider, and check what changed.

If malware might be involved, pause on that device

Stop entering passwords or other sensitive information on a device you suspect is infected. Use another device you trust for account recovery. A stolen session does not, by itself, prove malware is present. New browser toolbars or add-ons, unexpected redirects, and other unusual changes can be signs of malware; a security pop-up alone does not prove infection.

Before using the suspect device for sensitive accounts again, update its security software and run a scan. If you are not sure how, ask the device maker or a support service you already trust. Do not call a number shown in a pop-up.

Recover the account through the provider

Go to the service directly. Use its official app, a saved bookmark, or an address you type yourself. If your parent cannot sign in, follow the provider’s account-recovery instructions. Avoid recovery links in unexpected texts or emails.

For a bank or payment account, contact the institution using the number on the card or statement, or through its trusted app. Ask what steps to take and review recent transactions.

Change access, then close other sessions

From the trusted device, change the affected account’s password to a strong password your parent does not use elsewhere. Turn on two-factor authentication if the service offers it. If the email account used for password resets may be affected, secure it early too.

Look for the provider’s “sign out of all devices” or session-revocation control and use it if available. If you cannot find one, ask the provider’s official support how to end other sessions. Services handle sign-outs differently, so do not assume a password change or one sign-out action immediately invalidates every session. Clearing cookies on your parent’s browser is not a substitute for the provider’s session controls.

Check the account for changes

Review recent sign-ins, devices, recovery email addresses and phone numbers. Remove anything your parent does not recognize. In an email account, also check forwarding rules, sent messages, and deleted messages. If messages or payment requests went out from the account, warn the people who received them not to click links or send money.

Do one account at a time and keep your parent involved. A short written list of what you changed, what you checked, and which support team you contacted can make a stressful cleanup easier to finish.