Account Takeover and Impersonation

The Pattern

← Safety Recovered Archive / Safety Account takeover means someone gains access to your email, social media, banking, or other accounts without your permission. Impersonation means someone creates a fake account in your name. Both are used to control, isolate, and damage survivors. An abuser who has your password — or who set up your account — does not need to hack anything. They already have the keys. What it is Account takeover can happen through password guessing (abusers often know your patterns), shared accounts from the relationship, phishing emails designed to steal your login, or spyware capturing your keystrokes. Impersonation is simpler: someone creates a new account using your name, photo, and details, then contacts your friends, family, or employer as you. How it is used against survivors ▌ Monitoring — the abuser reads your messages, contacts, and activity without your knowledge ▌ Isolation — the abuser deletes contacts, sends messages as you that damage relationships, or blocks people from your account ▌ Reputation damage — fake accounts post damaging content in your name, or your real account is used to send harmful messages to your contacts ▌ Financial access — banking or payment accounts are drained or used for fraudulent purchases ▌ Evidence destruction — the abuser deletes messages, photos, or records you need for legal action ▌ Lockout — the abuser changes your password and recovery info, locking you out of your own accounts Warning signs ▌ You cannot log into an account you own ▌ You get “new device” or “unusual activity” alerts you did not trigger ▌ Friends or contacts mention messages from you that you did not send ▌ Your password or recovery information has been changed without your action ▌ You see accounts using your name and photo that you did not create ▌ Your email forwarding rules have been modified to forward to an address you do not recognize ▌ Purchases or transactions appear that you did not make What you can do now ▌ Change passwords from a safer device — if the abuser may have access to your current device, use a trusted friend’s device or a library computer. Start with your email account — it is the gateway to everything else. ▌ Turn on two-factor authentication — use an authenticator app or a phone number the abuser does not control. Avoid SMS if the abuser has access to your phone. ▌ Check account recovery options — make sure the recovery email and phone number are yours, not the abuser’s. ▌ Review active sessions and connected devices — sign out of all devices you do not recognize. Most platforms have this in security settings. ▌ Check email forwarding and filter rules — abusers sometimes set up silent forwarding to monitor your email. ▌ Recover hacked accounts — use the platform’s account recovery flow. The FTC maintains links to major providers’ recovery pages. ▌ Report impersonation accounts — use each platform’s impersonation reporting tool. Provide proof of your identity. ▌ Tell your contacts — warn friends, family, and employer that fake accounts may contact them in your name. Ask them not to share information about you. ▌ Freeze credit if financial accounts were accessed — see the identity theft guide for credit freeze steps. ▌ Document everything — screenshot fake accounts, suspicious activity alerts, and any messages sent in your name. This is evidence. When to get outside help If your abuser has taken over your accounts, you may also be dealing with stalkerware, identity theft, or doxxing simultaneously. A domestic violence advocate or tech safety clinic can help you audit your devices and accounts safely. If financial accounts were accessed, file a report with the FTC and your bank’s fraud department. If your device may be compromised, see the stalkerware guide before changing passwords on that device. If private information is being shared publicly, see the doxxing guide. Browse crisis and legal resources → If you know a resource, law, or tool that should be added here, use contact .