Hacked Account: What to Do Right Away, Step by Step

A friend tells you that you sent them a strange message. You get a sign-in alert from a city you've never visited. Your password stops working. These are the typical signs of a compromised account. At that moment speed matters, but so does order: doing the right things in the right sequence stops the intruder from getting back in shortly afterwards.

The signs not to ignore

• Notification emails about sign-ins, password changes or phone number changes you didn't request.
• Messages sent in your name that you didn't write.
• Emails missing from your inbox or moved to folders you don't use.
• Posts, followers or purchases you don't recognise.
• Verification codes arriving when you're not signing in.

That last sign is particularly important: if you receive unrequested codes, someone knows your password and is trying to get past the second factor.

Step 1: work from a clean device

If you suspect the computer is infected, for example because you installed something odd shortly before, changing your password from it may be pointless: malicious software could capture the new one too. Use a device you trust, such as your up-to-date smartphone or another computer.

Step 2: regain access

If you can still sign in

Change the password immediately to a new, long one never used anywhere else. Then, in the same session, move on to the next steps without delay.

If the intruder has changed the password

Use the service's official recovery procedure, reached from the official website or app, not from links you receive. Major services ask you to prove your identity with your previous recovery email or number, the devices you usually signed in from, or information about the account. Try from the device and network you normally use: it improves your chances of being recognised.

Beware of "account recovery" offers from self-styled experts on social media or in comments: they are almost always scams asking for money up front.

Step 3: close the doors the intruder opened

Regaining access isn't enough. Whoever gets into an account often leaves ways to come back:

1. Sign out of all active sessions from the security settings.
2. Check the recovery email and phone number: if they've been changed, restore your own.
3. Turn on or reset two-step verification, removing any devices or authenticator apps added by the intruder.
4. Revoke apps connected to the account that you don't recognise, including those with access through "sign in with".
5. For mailboxes, check forwarding rules, filters and auto-replies: forwarding to an outside address would let the intruder keep reading everything.
6. For social media, check the admins of linked pages and business accounts.

Step 4: limit the damage around the account

• Change the password everywhere you had reused it. If the same password protected other services, consider them all at risk.
• Warn your contacts if messages went out in your name, especially if they asked for money or contained links.
• Check linked payments: saved cards, subscriptions, purchases.
• If the hacked account is your main email, also check the other services that send recovery emails to it: the intruder may have reset passwords elsewhere.

Step 5: work out how they got in

Without complex investigations, you can ask yourself a few useful questions:

• Had you used that password on other sites?
• Had you entered your credentials on a page reached through a link shortly before?
• Did you have two-step verification turned on? If so, what kind?
• Have you recently installed extensions, apps or programs from unreliable sources?

The answer tells you what to change: unique passwords, a stronger verification method, more care with links, a clean-up of the device.

When to involve others

• If it's a work account, tell whoever manages IT immediately: other accounts may be affected.
• If your data was used to scam other people, or there were financial losses, consider reporting it to the police, keeping the notification emails and screenshots.
• If the account held other people's personal data, customers for example, find out what obligations follow.

Preparing before it happens

Most difficult recoveries come down to how the account was set up before the incident. Today, calmly:

• check that your recovery email and phone number are up to date;
• turn on two-step verification and save the recovery codes;
• use a password manager with a different password for every service.

In short

• Unrequested notifications and unexpected verification codes are signs to take seriously.
• Act from a clean device and use only official recovery procedures.
• Once back in, shut down unknown sessions, connected apps, forwarding rules and recovery methods.
• Change the password everywhere you reused it and warn your contacts.
• Set up a recovery email, a second factor and emergency codes today.