AOL Mail Security: 2-Step Verification, App Passwords and Hacked Accounts

These are the settings that keep an AOL account in your hands, from the most important down. Almost all of them live on the AOL Account Security page (login.aol.com/myaccount/security).

1. Keep your recovery info current

Your recovery phone number and alternate email address are how AOL lets you back in, and AOL sends notices of account changes to the recovery email. On the Account Security page, scroll to the bottom and use Add email or Add phone number. To replace one, add the new one first, then click Remove next to the old one. If your account still has security questions, AOL recommends removing them in favour of a phone or email.

2. Turn on 2-step verification

With your phone: on the Account Security page, next to 2-Step Verification, click Turn on, choose Phone number and follow the prompts. AOL then texts or calls you with a code at each sign-in — and the number it contacts you from may be different each time.

With an authenticator app (such as Google Authenticator or Microsoft Authenticator):

1. Next to 2-Step Verification, click Turn on 2SV, then Get started.
2. Choose Authenticator app and click Continue. (You need at least two recovery methods on the account to see this option, and AOL says it isn't yet available on every account.)
3. Scan the QR code with the app, click Continue, enter the code it shows and click Done.

To turn it off later: next to 2-Step Verification click Manage → Turn off.

3. Use app passwords for email apps — and clean them up

Email apps that don't use AOL's own sign-in page need an app password, a randomly generated code you enter once in the app:

1. On the Account Security page, click Generate app password (or Generate and manage app passwords).
2. Click Get Started, type the app's name and click Generate password.
3. Enter it in the app, then click Done.

Two things AOL's documentation makes clear: each app password works only for the app it was made for, and it stays active even if you change your main password — it stops only when you delete it. So review the list now and then and Delete any you don't use. AOL also notes that creation can fail in a browser you haven't used to sign in to AOL Mail for several days, or in incognito mode, and that customer care can't override this.

4. Check recent activity

The Recent activity page (login.aol.com/myaccount/activity) has up to three sections: devices and browsers that recently signed in, apps connected to your account, and recent account changes (the last three password changes). Click an entry to see its IP address, date and time. If something isn't yours, click Sign out or Remove next to it and change your password immediately. Unfamiliar locations aren't always sinister — a phone can report the wrong place, and some internet providers route through proxies.

5. If your account was hacked

Signs AOL lists: you stop receiving email, your contacts get spam from you, your Sent folder or inbox fills with messages or MAILER-DAEMON bounces you didn't send, you keep getting signed out, you see logins from unexpected places, or your settings or contacts have changed. Then:

1. Change your password immediately (or reset it if you're locked out).
2. Delete app passwords you don't recognise.
3. Undo changed mail settings — check filters, display name, signature, blocked addresses and the away message.
4. Make sure your antivirus software is installed and up to date.
5. Check your recovery options are yours and current.
6. Turn on 2-step verification.
7. If you gave a scammer financial details, contact your bank.

6. Spot fake AOL emails, sites and support numbers

• Real AOL sites have aol.com in the address. AOL never asks for your password or card numbers by email or phone.
• In AOL webmail, genuine AOL messages carry an Official mail or Certified mail icon. These icons don't appear in other email apps, so check the sender address there.
• Never reply to a text asking for your verification code, and don't give your 2-step code to any app — legitimate apps won't ask for it.
• Don't search the web for an AOL phone number. AOL warns that search results can lead to support scams; go to help.aol.com directly.
• Watch for look-alike senders: a missing letter, a 0 for an O, or a free email address posing as AOL.