Account hacked? Get back in and lock it down
Whether it's your email, social media or a work account, the steps are much the same. Work through them in order, starting from a device you trust.
Signs your account has been hacked
- Your password suddenly stops working
- Alerts about sign-ins, password changes or a new phone number that weren't you
- Friends receive messages or posts you didn't send
- Sent emails you didn't write, or emails disappearing
- New forwarding rules, recovery details or connected apps you don't recognise
- Purchases, subscriptions or payment changes you didn't make
If you can still sign in
- Change the password to a new one you've never used before. A password manager makes this easy.
- Turn on multi-factor sign-in. An authenticator app or security key is stronger than a text message code.
- Sign out of all other sessions and devices. Look in the account's security settings.
- Check your recovery email and phone number. Attackers often swap these for their own so they can get back in later.
- Remove connected apps and devices you don't recognise.
- For email accounts, check forwarding rules and filters. A hidden rule can quietly copy or delete your mail.
- Change the password on other accounts where you used the same one.
If you're locked out
- Use the official recovery page only. Type the company's web address yourself, or use "Forgot password" or "Need help signing in" in the official app. Don't use links from emails, ads or search results you're unsure of.
- Try recovery from a device and network you've used before, such as your usual phone at home. Services trust familiar devices more.
- Answer the recovery questions as fully as you can. Old passwords, when you created the account and contacts you email often all help.
- Be patient. Some recoveries take a few days, and repeated attempts can slow things down.
Watch out for recovery scams
People who reach out offering to "hack back" or recover your account for a fee are almost always scammers. Only use the service's official recovery process, or someone you chose and contacted yourself.
Once you're back in
- Tell your contacts to ignore recent messages from you, especially requests for money, codes or gift cards.
- Check linked accounts. If your email was taken, the attacker may have reset passwords on other sites using it.
- Check bank and card statements if payment details were saved in the account.
- Work out how it happened: a reused password, a phishing message or a compromised device. Fix that cause, or it may happen again.
Clicked something to get here? Our phishing help page covers what to do next.
Common questions
How did they get my password?
Most often it was reused from another site that had a data breach, or typed into a phishing page. Less often, malware on a device captured it. Using a unique password for every account, plus multi-factor sign-in, stops most of this.
Is a text message code good enough?
It's far better than nothing. An authenticator app or a security key is stronger, because text codes can be intercepted or redirected.
My work account was hacked. What should I do?
Tell your IT contact or manager straight away, even if you've already changed the password. Work accounts often have access to shared files and other people's data, so they may need to check more.
Can you recover my account for me?
Only the service itself can restore access, and we will never ask for your password. We can guide you through the official recovery step by step, then help you secure the account and anything linked to it.
Related help
Still locked out?
Tell us which account it is and what you've tried. The Errorfix AI Agent replies straight away and can offer a call. If it's happening right now, include the word urgent and we'll offer a call within 24 hours. We will never ask for your passwords.
Get help with my account