Please help, account hacked

[LittleArrow]

When you log into a fake website, it asks for your OTP. Once you hand over your info, the website then immediately logs into your account and removes the OTP and sticks a new one on to keep you out of your account. Yes, the OTP changes every minute, but they only need that minute if you accidentally hand that number out.

Yes I understand that, but to remove it they need the confirmation which is only sent to the email which we got. I don't understand how they can remove it if they don't get the confirmation code to remove.

[Mosha]

Yes I understand that, but to remove it they need the confirmation which is only sent to the email which we got. I don't understand how they can remove it if they don't get the confirmation code to remove.

did he use the same password for both email and his SE account?

[DanielNegreanu_Adamantoise]

So they got his email too?

[Espon]

Yes I understand that, but to remove it they need the confirmation which is only sent to the email which we got. I don't understand how they can remove it if they don't get the confirmation code to remove.

They don't need the email. Logging into the account gives them the emergency removal code which they can then input to remove your OTP.