What to Do If You Suspect Unauthorized Use

• By SMSPool Admin
• January 21, 2026
• Your Account

If you notice strange activity on your dashboard, such as orders you didn't place or your balance being drained, someone else may have access to your SMSPool account. If you can still log in, you must act immediately to secure your SMSPool account.

Please follow these steps in order to lock out the intruder and secure your account for the future.

Step 1: Clear All Active Login Sessions

The first priority is to force the intruder out of your account immediately. Changing your password alone might not kick the intruder out if they have an active login session.

1. Navigate to your Settings page.
2. Click the red button labeled Clear all sessions.

This action will instantly log out every device currently connected to your account, including your own. You will need to log back in, but the intruder and all other login sessions will be disconnected.

Step 2: Change Your Password

Once you have logged back in, change your password to prevent the intruder from simply signing in again.

1. Go to Settings.
2. Locate the Password box.
3. Enter Your Current Password.
4. Create a new strong, unique password that you do not use on other websites.

Step 3: Enable Two-Factor Authentication (2FA)

To ensure that even a stolen password cannot grant access to your account, you should enable Two-Factor Authentication.

• TOTP (Recommended): Use an authenticator app like Ente Auth or Aegis Authenticator to setup Two-Factor-Authentication
• Email OTP: If you have an email address linked to your account, you can enable Email OTP. This requires a code sent to your inbox for every login attempt.

Step 4: Update Your API Key

If you use our API for automation, or if you suspect your API key was leaked, the intruder could be draining your balance without ever logging into the website.

1. Go to Settings
2. Click Update API Key

Note: This will immediately break any scripts or software currently using the old API key. You will need to update your software with the new key, but it ensures the attacker can no longer place orders using your API key.

Important Note on Liability

Please be aware that account security is ultimately the responsibility of the user. SMSPool is not liable for any balance lost, data compromised, or actions taken on your account. It is up to you to ensure your account details and API keys remain private and secure from intruders.

Summary

By clearing login sessions, updating your password credentials, and rotating your API key, you effectively cut off all access points for the unauthorized user.

Locked out completely?
If the intruder has already changed your password and you cannot log in, please refer to our Account Recovery Guide to regain access to your account.

Return to knowledgebase