Skip to content
TrustDB
Log In

If it already happened

Safety guide · Updated 28 Oct 2026

Account taken over? What to do

If someone else controls your account, speed matters. Work in order: your email first, then the account, then the people who might be targeted through it.

Keep the security emails and alerts. They help the platform, and they help if your account was used to scam others.

Signs your account was taken over

  • Your password no longer works.
  • Login or security emails you did not trigger.
  • Messages you did not send, or friends asking about links from you.
  • A changed email, phone number or username.
  • Devices, connected apps or bots you do not recognise.
  • 2FA codes you did not request.

Do and don't

The short version. Skim this first.

Do

  • Secure your email first. Whoever controls your email can reset every other account.
  • Change passwords from a device you trust, using a different one for each account.
  • Sign out of all other sessions, and remove unknown devices and connected apps.
  • Turn on 2FA with an authenticator app or security key, and keep backup codes offline.
  • Use the platform's official recovery page or support, reached by typing the address yourself.
  • Tell contacts and server staff, from another account, to ignore messages from yours until it is recovered.
  • Save evidence: security emails, login alerts and timestamps.
  • Check linked payment methods and wallets for anything you did not do.

Don't

  • Don't pay anyone who promises to "recover" your account or get it back for you.
  • Don't use a recovery link from a DM or a comment.
  • Don't send your password, token or 2FA code to anyone, including someone claiming to be support or staff.
  • Don't reuse your old password with a small change.
  • Don't log in again from a device you think was infected.
  • Don't delete the alerts and emails while you sort it out.

If it already happened: recover the account

  1. Type the platform's address yourself, open its account recovery page and reset the password through your email.
  2. If you cannot get in, use the platform's support for hacked accounts. Give dates, the old username and the security emails you received.
  3. Once you are back in, sign out of all sessions, change the password, remove unknown apps and devices, update your recovery details and turn on 2FA.
  4. Check what was done: messages sent, items traded away, purchases, servers joined and payment methods. Report any loss to the platform.
  5. If it was taken through a link or a file, report it as phishing or account theft.
  6. If your hacked account was used to scam people and you are named in a TrustDB report, appeal it as a wrong person and attach your support ticket, the security emails and the dates.

Where to go next

The right page on TrustDB for the next step.

Questions

  • No. Accounts are run by the platform or game, so recovery goes through their support. TrustDB takes a phishing or account theft report, and an appeal if your hacked account has been named in a record by mistake.
  • You can appeal as a wrong person: wrong ID, impersonation or a hacked account, shown with a support ticket, security emails and dates. We confirm we have your appeal within 24 hours, and the decision comes within 7 days of filing, or up to 14 days if the appeal is complex. Wrong-person appeals can be filed at any time.
  • Look for logins, devices or messages you did not make, and for security emails you did not ask for. If in doubt, secure the account anyway. It costs little and covers both cases.

More answers in the FAQ.

General safety information, not legal or financial advice. TrustDB isn't a party to your deals. We don't hold funds, act as a middleman or get refunds for you.

Read next

All guides

Check before you send anything.

A lookup takes a second and no account. It's the cheapest insurance in trading.

Check someoneReport a scam