What to do if multi-factor authentication was disabled without your permission.
Short answer
Secure the account immediately by changing the password, reviewing sessions and recovery details, and turning multi-factor authentication back on through the official settings.
If you did not disable multi-factor authentication, assume the account may have been accessed or its security settings changed.
Change the account password from a trusted device and review active sessions and recovery methods.
Turn multi-factor authentication back on using an authenticator app, security key, or another method supported by the service.
Check recent account activity and other important accounts that share the same password.
Check it now
A simple checklist for setting up and reviewing multi-factor authentication.
Open the checkSomething already happened?
If you entered your password on a suspicious website, treat that password as compromised. Go directly to the real service, change it, turn on MFA, and check recent account activity.
If you see activity you don't recognise, secure the affected account directly, change the password, enable MFA, review recent activity and linked devices, and contact the provider if necessary.
Keep exploring