⚠ Account takeover can be used to impersonate you. If you've lost access to an account, contact the platform's support immediately.

Taking Over Your Accounts

Someone gains full control of one or more of your accounts — changing the password and recovery options so you can no longer access them.

What You Might Notice

You're suddenly locked out of an account
Your password no longer works and recovery options have been changed.
Friends receive messages from your account that you didn't send
The other person may be using your account to impersonate you.
Your account profile or information has been changed
Name, photo, bio, or linked accounts have been altered.

What You Can Do

This is not an exhaustive list. Every situation is different — use what applies to yours.

Contact the platform's account recovery support immediately
Most major platforms have processes for recovering hijacked accounts. Act quickly.
Notify your contacts
Let people know your account has been compromised so they don't trust messages coming from it.
Document everything
Screenshot any changes, messages sent from your account, and your attempts to recover it.
Report to the platform and to police
Account takeover is a criminal offence. File reports with both.

ID: SAFE-T-0083

Sub-techniques: No sub-techniques

Tactic: Account & Access Compromise

Created: 04 February 2026

Last Modified: 07 March 2026

Important: Always consider your physical safety first.

This resource provides general information, not personal advice. Every situation is different. The actions suggested here may not be safe in your specific circumstances particularly if the person causing harm could notice changes to your devices or accounts.

If you need personalised support, contact 1800RESPECT (1800 737 732) or your local specialist domestic violence service. If you are in immediate danger, call 000.

This framework is under active development. View full limitations & methodology.

Account Takeover

Gaining full control of victim's accounts including email, social media, banking, government services, or utilities by changing credentials and recovery options. Complete takeover denies victim access while giving perpetrator full control over the account, including stored data, communications, and financial functions.

ID: SAFE-T-0083

Sub-techniques: No sub-techniques

Tactic: Account & Access Compromise

Created: 04 February 2026

Last Modified: 07 March 2026

Mitigations

ID	Mitigation
SAFE-M-0040	Account Documentation Document all account details including usernames, associated contacts, and creation dates for recovery purposes.
SAFE-M-0041	Recovery Contact Security Change recovery email and phone to adversary-unknown contacts.
SAFE-M-0042	Platform Recovery Engagement Contact platform support for account recovery. Many platforms have DFV-specific recovery processes.

Detection Indicators

ID	Detection Indicator
SAFE-D-0038	Complete Account Lockout Unable to access accounts. Password reset attempts fail or redirect to unknown contacts.
SAFE-D-0039	Unauthorised Profile Changes Contacts report changes to profile content not made by account owner.
SAFE-D-0040	Recovery Option Modification Account recovery reveals changed backup contacts or security questions.

The TFA Matrix is a research framework under active development. Technique classifications, detection methods, and mitigations reflect current understanding and are subject to revision. This framework does not constitute forensic methodology, legal evidence standards, or clinical diagnostic criteria. Practitioners should apply professional judgement appropriate to their discipline and jurisdiction.

Full limitations, methodology & responsible use statement.