Hacked account: what to do now

Signs your account has been hacked

"Hacked" simply means someone else has got into your account without permission. Common signs include:

• You cannot log in, or your password suddenly stops working.
• Friends receive messages or posts from you that you did not send.
• You get emails about password changes, new logins or new devices that were not you.
• Your email address or phone number on the account has been changed.
• There are purchases, sent emails or deleted messages you do not recognise.

Tip: Be careful: some scam emails pretend to be "your account has been hacked" warnings. Do not click links in them. Go to the app or website yourself to check.

First steps: take back control

1. Try to log in and change your password on the official app or website. Use a new, strong password you have never used before (see strong passwords made easy).
2. If you are locked out, use the service's official "forgot password" or account recovery page. Search for it on the company's own help pages, not through ads or social media comments.
3. Sign out everywhere. Most services have a "log out of all devices" or "where you're logged in" option in security settings. Remove anything you do not recognise.
4. Turn on 2-step verification so the password alone cannot be used again. See turn on 2-step verification.
5. Check the recovery details. Make sure the email address and phone number on the account are yours. Hackers often change them.

Beware of recovery scams

When people are desperate to get an account back, scammers move in. Watch out for:

• Social media comments or messages offering to "recover your account" for a fee.
• Fake support phone numbers found in search adverts.
• Anyone asking for your password, a code sent to your phone, or remote access to your computer.

Genuine recovery always happens through the company's own website or app, and it is free.

Check your other accounts

Hacks rarely stay in one place. Think of it like losing a bunch of keys: you need to check every door they open.

• Your email first. If your email was hacked, the attacker can reset your other passwords. Secure it before anything else. Check its settings for forwarding rules you did not create, which can secretly copy your mail to someone else.
• Anywhere you used the same password. Change those passwords too, using a different one for each.
• Bank and card statements. If you see payments you do not recognise, call your bank on the number on your card.
• Your devices. Update your phone and computer and run a security scan, in case a harmful program stole the password.

Tell people and report it

• Warn your contacts that messages from your account may be fake, especially any asking for money or codes.
• Report it to the service using its help centre.
• If money was taken, contact your bank immediately and report the crime to the police or your national fraud reporting service.
• At work, tell your IT team straight away. It is not about blame; quick reporting limits damage.

Preventing it next time

• Use a unique password for every account, stored in a password manager.
• Keep 2-step verification switched on.
• Learn the signs of fake messages: spotting scam messages.
• Keep your phone and computer updated.

If you cannot get the account back, warn your contacts and focus on protecting everything else. That still limits the damage. Keep trying the official recovery process too, because some services can restore an account after checking your identity, even weeks later.

Tip: Make a short note now, kept somewhere safe at home, of which email and phone number each important account uses for recovery. If something goes wrong, you will know exactly where to start.