---
title: "I think my account has been compromised. What should I do?"
description: "Signs that an account has been compromised and immediate steps to take: notify Sarbacane, change your password, and renew your API keys."
url: https://help.sarbacane.com/en/articles/91-i-think-my-account-has-been-compromised-what-should-i-do
collection: "Login and security"
updated: 2026-11-03
language: en
alternates: [fr, es]
---

# I think my account has been compromised. What should I do?

Signs that an account has been compromised and immediate steps to take: notify Sarbacane, change your password, and renew your API keys.

If you notice a login, a send or complaints you cannot explain, alert Sarbacane support right away, then change your password and renew your API keys. These actions cut off access for anyone using your account.

Signs that should alert you:

-   your usual credentials no longer work;
    
-   emails you did not schedule have been sent from your account;
    
-   you suddenly receive a lot of complaints from your recipients;
    
-   a session you do not recognize appears in the session history (unknown device or location).
    

## Prerequisites

-   Have access to the mailbox linked to your Sarbacane account.
    
-   To view the session history and manage the Sarbacane Campaigns API keys: have the Owner or Administrator role.
    

## Steps

1.  Write to aide@sarbacane.com and describe what you noticed: date, suspicious send, error message.
    
2.  Change your password by following [How do you change or reset your password in Sarbacane?](https://help.sarbacane.com/en/articles/72.md)
    
3.  Enable two-factor authentication by following [I am a user. How do I enable or disable two-factor authentication?](https://help.sarbacane.com/en/articles/62.md)
    
4.  In the top-right corner of the screen, click your avatar, then click **Security** in the left-hand menu.
    
5.  At the top of the page, open the **Session history** tab.
    
6.  Use the filters above the list to choose the period and the user, then look for a row whose **Device** or **Location** does not match any of your users.
    
7.  In Sarbacane Campaigns, in the left-hand bar, click the **Settings** icon (gear), then click **API & Webhooks** in the submenu.
    
8.  Above the list of keys in the **API** tab, click **Create** to create a new key.
    
9.  Replace the old key with the new one in each of your connected tools (CRM, website, connectors).
    

> **Caution**: a deleted key stops working immediately. Make sure all your tools use the new key before you delete the old one.

10.  To the right of the old key, click **•••**, then delete the key. Repeat for each old key.
     
11.  Report the fraud to the competent authority in your country.
     

> **Note**: if you also use Sarbacane Sendkit, its API keys are managed separately in Sarbacane Sendkit. Renew them the same way.

> **Best practice**: restrict access to your account to your IP addresses with [How does access restriction by IP work?](https://help.sarbacane.com/en/articles/69.md)

## Expected result

The old password and the old API keys no longer work. Logging in now requires the new password and the two-factor authentication code.

## Troubleshooting

### My credentials no longer work

First check what you typed (capital letters, extra space). If the error persists, click **Forgot password** on the login page. If you do not receive the reset email, write to aide@sarbacane.com: someone may have changed the account's email address.

### Emails were sent that I did not schedule

Someone can use your account without changing the password, or through an API key. Follow all the steps above, including renewing the API keys.

### I'm suddenly receiving a lot of complaints

Check that the latest campaigns sent really come from you. If one of them does not, follow the steps above.

### I received an email warning me of a login from an unknown device

Sarbacane does not send this type of alert: this email does not come from us. Do not click any link in it, check the **Session history** tab to see the actual logins, then forward the email to aide@sarbacane.com.

### My connected tools no longer send anything

They are probably using a deleted API key. Create a new key in **API & Webhooks** and enter it in the tool.

### I can't see the Security menu

This menu is reserved for the Owner and Administrators. Ask the account owner to carry out these checks.

## Related articles

-   [How do you change or reset your password in Sarbacane?](https://help.sarbacane.com/en/articles/72.md)
    
-   [I am a user. How do I enable or disable two-factor authentication?](https://help.sarbacane.com/en/articles/62.md)
    
-   [How does access restriction by IP work?](https://help.sarbacane.com/en/articles/69.md)