Account Hacked? What to Do, Step by Step

When an account is taken over, the order of your actions matters more than the speed of any single one. Attackers who get into an account usually try to lock you out, change the recovery details, and use it to reach other accounts or your contacts. This guide gives the order that closes those doors, starting with the account that controls all the others: your email.

Signs an Account May Be Compromised

• Password-reset or “new sign-in” emails and codes you did not request
• Sent messages, posts or purchases you did not make, or friends telling you they received odd messages from you
• Your password, recovery email or phone number no longer works or has changed
• Unknown devices, locations or sessions in the account’s security page
• New email filters or forwarding rules you did not create
• Bank or card alerts after a suspicious login

One of these on its own can have innocent explanations, such as a new phone. Several together, or any account lock-out you did not cause, should be treated as a takeover.

Step-by-Step: Securing a Hacked Account

1. Use a clean device and network. Start from a phone or computer you trust, on your own connection rather than public Wi-Fi. If you suspect malware — for example after following instructions from a stranger or installing an unknown app — clean or reset that device first; otherwise the attacker may see your new password. See Fake CAPTCHA Scams for one common route.
2. Secure your primary email first. Change its password to a long, unique one. Whoever controls your email can trigger resets on everything else. Then open the provider’s security page and sign out of all other sessions: Google’s Security Checkup is at myaccount.google.com/security-checkup and Microsoft’s security settings at account.microsoft.com/security; for Apple, use the Apple Account page at account.apple.com.
3. Look for attacker settings in email. Check for forwarding addresses, auto-forward or filter rules (for example rules that move bank emails to trash or forward them out), unfamiliar “send as” addresses, and added recovery email or phone numbers. Remove anything you did not set.
4. Fix the hacked account itself. Change the password, sign out all sessions, and review connected apps and devices. Remove third-party apps you do not recognise. If you cannot sign in, use that service’s official account-recovery page, which you reach by typing the address or using its app, never via a message.
5. Turn on stronger two-factor authentication. Prefer an authenticator app, a passkey or a security key over SMS. Save backup codes somewhere offline. Do this on email first, then banking, then social accounts.
6. Change reused passwords. Any other account that used the same or a similar password is now at risk. Use a password manager to give each account a unique password. You can check whether an address appears in known breaches at haveibeenpwned.com.
7. Check money and identity accounts. Review bank, card, payment-app and shopping accounts for unfamiliar activity. If you shared an OTP during the incident, read what to do after sharing an OTP and contact your bank straight away.
8. Warn people who might be targeted. Tell your contacts through another channel that your account was hacked and to ignore requests for money, codes or links from it. Attackers often use a hijacked account to scam friends and family.
9. Report it. Use the platform’s own “report a hacked account” route in its help centre. If money or identity documents were involved, also report to your national authority (see our what to do after a scam guide).

If You Are Locked Out

Account recovery works best when you attempt it from a device and location you have used before, and the provider can see familiar signals. Try the official recovery flow several times calmly rather than creating new accounts. Be careful in the gap that follows: people locked out of social accounts are common targets for fake “recovery experts” on search ads, messages and comments who ask for payment, a code, or remote access. A genuine provider never asks you to pay a stranger to unlock your account. The pattern is covered in The Scam After the Scam.

How the Account Probably Got Taken

Knowing the likely route tells you what else to fix:

• A phishing page copied your password. Change it everywhere you reused it. See How to Spot Phishing Emails.
• A data breach exposed an old password. Unique passwords limit the damage; for what other leaked details can enable, see When Scammers Have Your Personal Information.
• A shared one-time code let someone log in or register your number. Review the code section in the OTP guide.
• Malware or a malicious browser extension read your sessions. Clean the device, remove unknown extensions, and sign in again.
• A caller with remote access to your device. Disconnect, uninstall the remote tool, and change passwords from another device.

Broader habits that lower the risk are in the Digital Safety Guide.

Key Takeaways

• Secure your email account first, then the hacked account, then anything sharing the password.
• Sign out all sessions and check forwarding rules, recovery details and connected apps.
• Use an authenticator app or passkey rather than SMS where possible.
• Use only official recovery pages; ignore anyone offering to unlock the account for a fee.
• Warn contacts and report the incident to the platform and, if money was lost, to your national authority.

Frequently Asked Questions

Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.