Your account was hacked: a step-by-step recovery plan

Realising someone else is in your account is frightening — but most hijacked accounts can be recovered, and the faster you act, the less the attacker can do. Work through these steps in order. If you only have a few minutes, do the first three now.

First, confirm it's really a hack

Not every scare is a break-in. Before you panic, check for the common signs of a genuine takeover:

You're suddenly signed out and your password no longer works.
You received an email about a password change, new login, or new device that you didn't make.
Friends report messages, posts, or payment requests you never sent.
Your recovery email or phone number was changed.
Unfamiliar transactions, sent emails, or app connections appear.

If you simply forgot your password, use the normal "forgot password" flow — that's not a hack. The steps below are for when someone else has control.

The first 10 minutes

Get to the real site. Type the address yourself or use a bookmark. Never use a link from the alarming email — that email may itself be the phishing attack that started this.
Change the password if you can still sign in. Pick something long and unique that you've never used anywhere else.
Use "log out all devices." Most services have a security page that ends every active session. This kicks the attacker out even if they still know the old password.

If you can still sign in

You're in the strong position. Move quickly:

Change the password to a fresh, unique one.
Turn on two-factor authentication if it isn't already — ideally with an authenticator app or a passkey, not SMS.
Review and remove unknown devices, active sessions, and connected/third-party apps.
Check that the recovery email and phone number are still yours. Attackers add their own so they can take the account back.
Look for mail filters or forwarding rules you didn't create — a classic trick is a hidden rule that quietly forwards your messages or deletes bank alerts.

If you're locked out

Go straight to the service's official account-recovery page (search for "[service name] account recovery" or find it in their help centre). Be ready to prove who you are: the recovery process may ask for an old password, a backup code, a linked phone, or details only you would know. Fill in as much as you can — partial matches still help.

If automated recovery fails, look for a "my account was hacked" or "I can't sign in" support path. For social platforms, having a government ID ready often speeds things up. Be patient and persistent; do not pay anyone on social media who promises to "recover" your account — that is a second scam.

Lock down the account that controls the others

Your email account is the master key. Password resets for almost everything else land there, so if your email was the one hacked, secure it first and completely before anything else. Once your email is safe, reset passwords on the accounts tied to it.

Contain the damage

Attackers rarely stop at one account. Because many people reuse passwords, a single breach can unlock several logins — this is called credential stuffing. Change the password anywhere you used the same or a similar one, starting with anything holding money or identity: banking, payment apps, primary email, and your phone-carrier account.

A password manager makes this far easier: it gives every account its own strong password so one breach can't cascade.

Check what they actually did

Once you're back in control, investigate calmly:

Sent messages and posts — delete anything the attacker sent, and warn contacts who may have received scam messages from "you."
Money — review transactions, saved cards, and any new payees or transfers. Report fraud to your bank immediately; most have a 24/7 fraud line.
Settings — recovery details, forwarding rules, linked apps, and auto-replies.
Downloads and exports — some services log when your data was exported. If the attacker downloaded your archive, assume they have that information.

Account-specific notes

Email: remove forwarding rules and filters, revoke app passwords, and re-check recovery options. This is the account to protect most.
Banking & payments: call the bank's official number (from the card, not the email), freeze cards if needed, and ask them to watch for fraud. Consider a credit freeze if identity theft is possible.
Social media: check for new "admins" on pages you manage, remove rogue connected apps, and post a brief note so contacts ignore scam messages sent in your name.
Crypto wallets: treat these as lost if the seed phrase may be exposed — move remaining funds to a brand-new wallet with a seed phrase the attacker never saw. There is no reset button.

Tell the people who need to know

A quick heads-up to friends, family, or colleagues stops the attacker using your trusted name to scam them. If the account is tied to work, tell your IT or security team right away — they may need to protect shared systems.

Stop it happening again

Give every important account a unique password, stored in a password manager.
Turn on two-factor authentication everywhere it's offered, preferring an app or passkey over SMS.
Keep your recovery email and phone number current, and save backup codes somewhere safe offline.
Check your email against a breach-notification service so you learn early when a password leaks.
Be sceptical of urgent "security alert" messages — the panic they create is the point.

Common questions

Should I delete the account and start over? Usually no — recovery keeps your history and contacts, and deleting can even be what the attacker wants. Only start fresh if recovery truly fails.

They changed my recovery email — is it hopeless? No. Official recovery can still verify you through other signals. Use the "my information was changed" support path and be persistent.

How do I know the attacker is really gone? After you've changed the password, ended all sessions, and confirmed two-factor is on with recovery details that are yours, the account is back under your control. Keep an eye on login alerts for a few weeks.