What to Do If Your Account Gets Hacked: Step-by-Step Recovery Guide
Act Fast but Stay Calm
If an account has been hacked, every minute counts. The immediate goal is to recover access and cut off the attacker’s access. Most hacks are not targeted attacks — they’re automated attacks testing passwords stolen from other data breaches.
Step 1: Recover Access
- Use the Forgot your password? link to receive a recovery link in your backup email or phone
- If the attacker changed the recovery email, use backup account options (security questions, backup codes, identity verification)
- If you can’t recover access any other way, contact official platform support
Step 2: Access Recovered — What to Do Immediately
- Change the password to a new, unique, strong one (use your password manager’s generator)
- Enable 2FA — preferably with an authenticator app rather than SMS
- Review connected devices — on most platforms you can see ‘Active sessions’ and close all except yours
- Check email forwarding rules — attackers often set up automatic forwarding before being expelled
Step 3: Assess the Damage
- Did the attacker send emails or messages from your account? Warn your contacts
- Did they access linked banking data? Contact your bank
- Did they change passwords for other accounts linked via ‘Sign in with Google/Facebook’?
- Did they post content on social media? Contact the platform to remove it
Step 4: Strengthen All Your Accounts
- Install a password manager (free Bitwarden, paid 1Password or Dashlane)
- Change passwords for all important accounts
- Enable 2FA on all accounts that allow it
- Check if your email is in any known breach at haveibeenpwned.com
How do I know if my account has been hacked?
Signs: can’t log in with your correct password, receive password change emails you didn’t request, your contacts receive strange messages from you, see unknown activity in account history.
Should I report it to the police?
Depends on the damage. If there’s financial loss, identity theft, or access to third-party sensitive data, reporting is recommended.
Is 2FA via SMS enough?
Better than nothing, but SMS can be intercepted (SIM swapping). An authenticator app is more secure. Physical FIDO2 keys (YubiKey) are the most secure of all.
Conclusion
Immediate priority: recover access and enable 2FA. Then: review active sessions, forwarding rules, and collateral damage. Long-term: password managers with unique passwords for each account is the only real way to prevent this from happening again.
