What to do if I think my account has been hacked?

1. How do I verify if my account has been hacked (RoboForm Extension)
2. How do I verify if my account has been hacked? (RoboForm Online)
3. If my account is hacked, what do I do?

How do I verify if my account has been hacked (RoboForm Extension)

To verify if your account has been hacked, follow these steps:

1) Open your browser and click the RoboForm extension icon. Click the 3 dots in the upper right corner. Then, select "Settings" from the menu.

 

2) Select "Devices & Activity" from the column on the left.

If you see a device that you do not recognize, select it and click "Remove this device" in the bottom left.

 

You should also turn on OTP and change your Master Password.

NOTE: When a user logs into RoboForm, we collect the IP address used for the login. To find out where this IP address might be located, we use the DB-IP solution. While this method usually gives us the right information, we can not be sure that it is accurate every time. We suggest that users cross-verify the IP address using other IP-to-geolocation services before making any decisions, such as suspending a user's access.

 

How do I verify if my account has been hacked? (RoboForm Online)

To verify if your account has been hacked, follow these steps:

1) Log in to your RoboForm Online account here.

 

2) At the top of the page, hover your mouse over the "My Settings" tab and select "Sessions" from the dropdown menu which will appear.

 

3) On the sessions page, you will see an Authorized Devices list and a list of Recent Device Activity.

Under Authorized Devices, review the devices listed and ensure that you recognize each of them. If you see a device which you are certain that you did not authorize, your account has been hacked.

Under Recent Device Activity, review the IP addresses listed and ensure that you recognize each of them. If you see an IP address which you are certain is not yours, your account has been hacked.

 

NOTE: To view a full list of the last 90 days of device activity, scroll to the bottom of the page and click the green "Download Detailed Log" button.

 

This will download a CSV file containing a detailed access log of your account. This access log provides you with the Date/Time of access, IP address, Device Name, Device Type, Operation Type, Operation, Operation Source, and Operation Destination. Unfamiliar access dates/times, IP addresses, and device names are the best indicators that your account has been hacked.

NOTE: When a user logs into RoboForm, we collect the IP address used for the login. To find out where this IP address might be located, we use the DB-IP solution. While this method usually gives us the right information, we can not be sure that it is accurate every time. We suggest that users cross-verify the IP address using other IP-to-geolocation services before making any decisions, such as suspending a user's access.

 

If my account is hacked, what do I do?

1) Turn on OTP if it is not already enabled. For step-by-step instructions on how to turn on OTP, click here.

2) Change your Master Password. For step-by-step instructions on how to change your Master Password, click here.

3) If you noticed devices in your Authorized Devices list which you did not authorize, remove them. You can do so by checking the box to the right of the unwanted device in your Authorized Devices list and then clicking the red "Delete Selected" button.

 

4) Change the passwords on all sites which you have saved Logins for, especially accounts which contain sensitive information (financial, insurance, email, etc.), using the RoboForm Password Generator.

For step-by-step instructions on how to use the RoboForm Password Generator to generate new passwords, click here and scroll down to the "Using a Password Generator to Update an Existing Password" section.