Your friends are getting strange messages from you. There are posts you didn’t write, logins from places you’ve never been, or emails you didn’t send. Finding out an account has been hacked is unsettling, but acting quickly limits the damage. Here’s what to do, in order.
Signs your account has been hacked
- You can’t log in, or your password suddenly “doesn’t work.”
- You get password reset or new login alerts you didn’t ask for.
- Posts, messages or emails you didn’t send.
- Your recovery email or phone number has changed.
- In email: messages in your Sent folder you didn’t write, or replies going missing.
Step 1: Try to get back in
If you can still log in
Change your password straight away, to a strong one you haven’t used anywhere else. Then go to Step 2.
If you’re locked out
Use the service’s official recovery page, and only that: – Facebook: facebook.com/hacked – Instagram: instagram.com/hacked – Google / Gmail, Microsoft / Outlook, Apple: use the “Forgot password?” link on the real sign-in page.
Beware of “account recovery” services that contact you offering to get your account back for a fee. They’re scams. Real recovery is free.
Step 2: Kick the hacker out
Once you’re back in:
- Sign out of all other sessions. Look in security settings for “Where you’re logged in” or “Your devices” and choose sign out of all sessions.
- Check your recovery details. Make sure the recovery email and phone number are yours. Hackers often change them to keep access.
- Turn on two-factor authentication, preferably with an authenticator app or passkey.
- Remove unfamiliar connected apps with access to your account.
Step 3: Check for hidden changes (especially email)
Hackers often leave behind settings that quietly keep them informed:
- Forwarding rules that send copies of your emails elsewhere.
- Filters that delete or hide certain emails, like security alerts from your bank.
- Auto-replies or a changed email signature containing scam links.
Check your email settings for Forwarding and Rules/Filters, and delete anything you didn’t create.
Step 4: Change passwords on related accounts
- Anywhere you used the same password. Attackers will try it on other sites.
- If your email was hacked, check accounts that can be reset through that email, especially banking, shopping and social media.
A password manager makes it easy to give every account a unique password.
Step 5: Warn your contacts
Let friends and family know your account was hacked, and tell them to ignore any requests for money, gift cards or codes that appeared to come from you.
Step 6: Check your device
If you don’t know how the hacker got your password, run a malware scan. Password-stealing malware is a common cause. See our malware guide.
If money was involved
Contact your bank immediately if payment details were exposed or money was taken. In the UK, report fraud to Action Fraud. In the US, use reportfraud.ftc.gov and identitytheft.gov.
The bottom line
Recover the account through official pages only, change the password, sign out all other sessions, fix your recovery details and turn on two-factor authentication. Then check for hidden email rules, change reused passwords and warn your contacts. Fast action makes all the difference.
