Start from a device and route you trust
Do not use a link inside the suspicious message that announced the problem. Open the service's official app or type the known website address yourself. If the device may also be affected by malware, use another trusted device for password changes and recovery.
Check whether the child can still sign in. If not, use the service's official account-recovery process rather than a phone number or support link supplied by an unexpected message or advertisement.
Change the password and remove unknown sessions
Once control is restored, set a new, unique password or passphrase that has not been used on another account. Then review active sessions or signed-in devices and sign out anything you do not recognise. If the service offers a 'sign out everywhere' option, it can be useful after an account takeover.
Also check whether the attacker changed the recovery email address, phone number, trusted devices or security questions. Recovery settings matter because they can provide a way back into the account even after the password changes.
Protect the email account first
Email is often the key to other accounts because password-reset messages are sent there. If the child's email account was compromised, secure it before relying on it to recover gaming, social, cloud or school services.
Turn on multi-factor authentication where practical and review forwarding rules, filters and connected apps. An attacker may create a rule that silently forwards or hides security messages.
Look for password reuse
If the stolen password was reused anywhere else, change those accounts too. Start with email, school systems, gaming platforms, cloud storage and any service that stores payment information or important personal data.
This is why unique passwords matter: one compromised service should not automatically unlock several others.
Check what happened while the attacker had access
Review recent messages, purchases, profile changes, friend requests, posts and login history. Tell contacts if the compromised account sent suspicious messages so they know not to trust unusual links or requests that appeared to come from the child.
If money was spent, personal information was exposed or school systems were involved, contact the relevant provider, financial institution or school promptly and keep records of what happened.
Recover through the real service, change the password, remove unknown sessions, secure recovery details and check every other account where the same password may have been used.
Continue with the Cyber Safety Hub, practise the ideas in Ranger Academy, or use the free printable resources at home or in the classroom.