Account takeover often starts before you fully lose access. The early clues matter.

Watch for:

• password reset emails you did not request
• 2FA codes you did not trigger
• login alerts from strange devices or places
• messages saying your account details changed
• friends receiving odd messages from you

These do not always mean a takeover succeeded. But they do mean something is happening and it is time to act.

A quick example: you receive a text code for your email account while you are not signing in. Ten minutes later, someone claiming to be support asks you to read it to them. That is not help. That is the attack itself.

This is where Level 2 moves beyond setup and into pattern recognition. You are not only protecting the front door. You are learning to hear someone testing the lock.

What to do:

• Treat unrequested codes and reset messages seriously.
• Change the password from a trusted device if needed.
• Check whether account recovery email and phone details were changed.

This lesson is part of Email & Online Accounts from Lumoset Foundation, Fort Wayne, Indiana – free, always, with no account and no catch.