If someone may have got into your account
Do these in order. Each one takes a minute or two.
1. Change your password.
Go to Settings → Security → Sign-in details. Changing it signs you out on every other device.
If you can't sign in, use "Forgot password?" on the sign-in page. The link goes to the email address on your account.
2. Sign out everywhere else.
Go to Settings → Security → Where you're signed in. Look at the devices listed, then press "Sign out everywhere else". Every session except this one ends.
3. Turn on two-factor authentication.
Go to Settings → Security → Two-factor authentication. An authenticator app is the stronger choice; we can also email you a code instead. If you use an app, save your recovery codes somewhere other than your phone.
4. Check your payment methods.
Open Payment Methods and look at each one. If a handle or address isn't yours, correct it or delete it.
We email you whenever a payment method is added, changed or removed, so check your inbox for any change you didn't make.
5. Check the email address on your account.
It's under Settings → Security → Sign-in details. Changing it needs your password and a link sent to the new address, and we email the old address when it changes. If you got a notice about a change you didn't make, reply to that email.
6. Tell us.
Email [email protected] from the address on your account. Say what you noticed and when. If you've also lost access to that email account, tell us that too.
We'll never ask you for your password, a sign-in code or a recovery code. Anyone who asks for one by email, text or direct message isn't us.