Assess possible signs correctly
A single sign-in error or unexpected email does not prove that someone else has accessed your account. Technical disruptions, an incorrect password or an accidentally triggered reset can cause similar symptoms. However, take the suspicion seriously if several signs occur together or you see changes that you did not make yourself.
Possible signs include:
- You receive a password-reset or security notification that you did not request.
- Your usual password suddenly stops working.
- Your profile name, profile photo, contact details or settings have been changed.
- Listings, messages, reviews or other activity appear that did not come from you.
- Other people report unusual messages or payment requests from your account.
- Paid services have been booked or payments initiated that you do not recognise.
- Your email or Google account displays unknown devices, sessions or security changes.
- You entered your password, a one-time code or a complete security link on a potentially fake page.
Further warning signs can be found in How do I recognise and prevent an Account Takeover (ATO)?
Use a trusted device
Open suchen.expert using an address that you entered yourself or your own bookmark. Do not use a link from an unexpected email, SMS or message. The article How do I recognise phishing attempts and fake messages? explains how to assess suspicious messages.
If you previously opened an unknown file, installed software, enabled macros or allowed remote access, do not enter new sign-in details on the affected device. Use another trusted and up-to-date device for the initial security measures.
Act quickly, but not hastily. Do not delete the account or important messages prematurely. First preserve the necessary evidence, provided that doing so does not unnecessarily delay securing the account.
Secure your email or Google account first
The email account associated with suchen.expert is particularly important because it can receive activation or reset messages. If third parties have access to it, they may be able to take over other accounts.
Open your email provider directly and:
- change the email password to a new, unique password,
- check signed-in devices and sessions and end unknown access, if the function is provided,
- check recovery addresses, telephone numbers and connected applications,
- check forwarding, filter and deletion rules for unknown changes,
- enable multi-factor authentication or a passkey if your provider supports it,
- also secure the device or telephone number used to receive confirmation codes.
Guidance can be found in How can I make sure my email address is protected?
If you sign in to your personal suchen.expert account through Google, secure the Google account that you use through the official Google page opened manually. Check its security events, devices, sessions and connected applications. If you have a specific reason for concern, follow the official guidance in Google's steps for a compromised account.
Continue to use the same Google account to sign in to suchen.expert. Do not change the association or set up an additional suchen.expert password unless such a function is explicitly displayed to you.
Change or reset the suchen.expert password
If you sign in with an email address and password and still have access, change the password through the official account function that you opened yourself. Use a long, unique password that you do not use for any other service. Further recommendations can be found in How do I create a secure password for my suchen.expert account?
If you can no longer sign in, use the official reset method. Instructions can be found in How do I reset my password? Use only the latest link that you requested yourself and treat it as confidential sign-in information.
If the previous password was also used for other services, change it there as well. Start with email, payment and other particularly important accounts. Change passwords only from a trusted device.
Do not repeatedly try different old passwords or create a replacement account to bypass a restriction or lost access. If recovery is unsuccessful, contact support.
Check existing sessions and access
Changing a password does not automatically end every active session with every service. If suchen.expert displays an overview of signed-in devices or a function for ending other sessions, use it and sign out unknown access.
If such a function is not provided or you are unsure, tell support. Do not disclose either your old or your new password. Support also does not need a one-time code, complete reset link or session cookie.
Check the sessions for your email or Google account as well. Continuing unauthorised access to the email account may jeopardise a successful recovery again.
Check the account and its content
After securing the account, check carefully whether anything has been changed or added. Pay particular attention to:
- the profile name, profile photo and publicly visible details,
- stored or displayed contact details,
- new, changed or deleted listings,
- sent and received messages,
- reviews and other public activity,
- settings and notifications,
- booked additional services or other paid transactions,
- for business accounts, company details and authorised contacts.
First record unknown content with the date, time, URL or listing ID before correcting or removing it. This makes it easier to trace the incident later. Then change only details whose correct form you know with certainty.
If messages containing links, payment requests or other fraudulent content were sent from your account, warn the affected people through a trusted contact method. Ask them not to click, pay anything or enter any data. Do not publish personal data or make unsubstantiated accusations when doing so.
Check the device for possible malware
Update the operating system, browser and security software. Run a full check with up-to-date security software. A scan that finds nothing does not provide complete certainty, but it may detect known malware.
If you installed an unknown application or remote-access software, see unusual system messages or the device continues to behave unusually, disconnect it from the network if it is safe to do so and seek expert help.
For a work or company device, inform the responsible IT team immediately. Until the matter has been clarified, do not use the potentially affected device for passwords, payments or other sensitive processes.
Check payments and financial consequences
Check whether payments, paid bookings or changes to payment details occurred in connection with the access. Check your bank, card and payment-service accounts directly through their official website or app.
If there is an unknown booking or payment information has been disclosed, contact the bank, card issuer or payment service immediately through its official contact channel. Ask what options are available to block, dispute or recall the payment. Recovery cannot be guaranteed.
Further guidance can be found in What should I do about suspicious PayPal or payment transactions?
Preserve evidence in its original form
Document the incident as precisely as necessary without taking further risks. The following may be helpful:
- the date and approximate time of the first unusual activity,
- your last known sign-in,
- affected profile, message and listing data,
- unknown changes or sent content,
- suspicious emails, SMS messages or links,
- displayed error messages,
- payment and transaction records,
- the device, operating system and browser used,
- screenshots in which unnecessary personal data has been obscured.
Keep original messages and files, but do not reopen suspicious attachments. Do not make secret audio recordings or publish the incident together with other users' personal data.
Contact suchen.expert support
Contact support using the official contact form, particularly if you no longer have access, cannot correct unknown content yourself or suspect other sessions.
Where possible, provide:
- the email address associated with the account or the known profile name,
- for a business account, the company name and your role as well,
- the date and time of the unusual activity,
- a factual description of the unknown changes,
- affected listing or message IDs,
- security measures already taken,
- a secure alternative contact method if email access is affected.
Do not send passwords, one-time codes, complete activation or reset links, session cookies, card PINs, TANs or unsolicited identity documents. If further details are needed for the review, support should state the purpose and provide a suitable transmission method.
Support can review the incident using the available information and take action within the applicable rules. A specific processing time, complete restoration of all content or a particular outcome cannot be guaranteed.
Information about the processing of personal data can be found in the Privacy Policy.
Special considerations for a business account
Internally inform the responsible management, IT or security team and the people authorised to use the account. Check who has access to the business email address and devices being used.
Do not share one password among several employees. If an employee or contractor has left the company or their authorisation has changed, adjust internal access and responsibilities. An authorised representative or person authorised to act should contact support; required company documents should be sent only in response to a specific request.
In cases of data misuse or suspected criminal activity
If personal data has been copied from the account, identity documents have been misused or third-party contracts or profiles have been created, also follow the guidance in What should I do if my personal data has been misused?
If there is financial loss, identity misuse, extortion, threats or suspicion of another criminal offence, you can contact the police. You do not have to report the matter to suchen.expert first. In an immediate emergency, call 110.
After recovery
Continue to check the account over the following days for unknown changes, messages or bookings. Use a separate password for every important account and a password manager if this suits the way you work. Enable additional sign-in security for your email or Google account if it is offered.
Be particularly alert to follow-up attacks as well. After an incident, attackers may pose as support, the police, a bank, a solicitor or an alleged recovery service and demand further sign-in details or payments. Verify every such contact through an official channel that you open independently.
