Hacked account? How to tell, and how to get it back

You get a sign-in alert from another country, friends say you've sent them strange messages, or your password simply stops working. If you suspect someone has got into one of your accounts, act fast — the first hours matter most. This guide explains how to confirm it and what to do, step by step.

#Signs an account may be compromised

• Sign-in or password-change alerts you don't recognise.
• Your password no longer works.
• Sent emails or posts you didn't make.
• Changes to your recovery email or phone number.
• Email forwarding rules you didn't create.
• Purchases or transactions you don't recognise.
• Contacts receiving requests for money or strange links from you.

#Check whether your details appear in breaches

Sites such as Have I Been Pwned let you check whether an email address appears in known data breaches. If it does, the password you used on that service may be in attackers' hands: change it there and anywhere else you reused it.

Many password managers and browsers also warn you about leaked passwords.

#What to do in the first hour

#1. If you can still get in

1. Change the password to a new, long, unique one — from a device you believe is clean.
2. Sign out of all sessions: almost every service has a "Sign out of all devices" option.
3. Review and fix your recovery email and phone number.
4. Turn on two-factor authentication. See how to set up 2FA.
5. Review connected apps with access to your account and remove any you don't recognise.
6. For email: check forwarding rules, filters and auto-replies. Attackers use them to keep receiving your mail.

#2. If you're locked out

Use the service's official account recovery process:

• Google, Microsoft, Apple, Meta (Instagram, Facebook, WhatsApp) and most services have a recovery form on their help site.
• Do it from a device and network you've used with that account before — it helps prove you're the owner.
• Have details only you would know ready: old passwords, roughly when you created the account, frequent contacts.

#3. Protect everything that depended on that account

• If it was your main email, check every account it can reset, starting with banking and social media.
• If you reused the password, change it everywhere. A password manager makes a unique password for each service easy.
• If financial details are involved, contact your bank.

#4. Warn your contacts

If the attacker sent messages from your account, tell people through another channel that it wasn't you, and not to click links or send money.

#5. Check your device

If you suspect the break-in came from malware on your computer or phone:

• Scan it with an up-to-date antivirus.
• Review browser extensions and recently installed apps.
• If problems persist, reset the device after backing up your files.

#Get help and report it

• In the US, the FTC explains how to recover hacked accounts; if your identity has been misused, IdentityTheft.gov helps you create a recovery plan.
• In the UK, you can report fraud and cybercrime to Action Fraud.
• If there's financial loss, extortion or identity theft, report it to the police.
• Elsewhere, check your national cybersecurity or consumer protection agency.

#How to stop it happening again

• A unique, long password for every service, with a manager.
• Two-factor authentication or passkeys on important accounts. See what are passkeys.
• Learn to spot phishing — the most common way in.
• Keep your system and apps up to date.

#The bottom line

If you suspect unauthorised access, change the password, sign out of all sessions, check your recovery details and turn on two-factor authentication as soon as possible. If you're locked out, use only the official recovery process. Then change reused passwords, warn your contacts and get help if there's been harm.