My Account Was Hacked: What to Do First

Quick answer

Secure the email account first, even if the email itself looks untouched. Sign out all sessions, then change the password, then check for forwarding rules and altered recovery details. Only then move on to the social, shopping, or banking account where you first noticed the problem. Keep screenshots as you go.

Why the mailbox comes first

Email is the master key. Nearly every other service will send a password reset link there on request, which means whoever controls the mailbox controls the rest by default. This is why people secure a social account, feel relieved, and lose it again the same evening.

The mailbox may show no sign of intrusion at all. An intruder wanting sustained access is careful not to disturb it, because obvious changes prompt exactly the response you are having now. Treat the email account as compromised whenever a connected account has been taken, and verify rather than assume.

Sign everything out, then change the password

Order matters here too. Changing a password does not reliably terminate sessions already established on other devices, so an intruder with an open session can continue working and sometimes change the password back.

Do it in this sequence.

1. Step 1

   Find the option to sign out of all devices or revoke all sessions, and use it.

2. Step 2

   Change the password to something long and not used anywhere else.

3. Step 3

   Turn on two-step verification if it is not already on.

4. Step 4

   Generate and store backup codes somewhere physical.

5. Step 5

   Review the list of devices and sessions again to confirm only yours remain.

If you cannot complete step one because you no longer have access, the situation becomes an account recovery problem and should be handled as one.

Hidden rules are how access is retained

This is the step that is almost always skipped, and it is the step that matters most for lasting damage.

An intruder who has been inside a mailbox commonly leaves behind arrangements that survive a password change. Look for each of these specifically.

• Forwarding: mail copied automatically to an unfamiliar address.
• Filters or rules: messages containing words such as security, password, or alert moved to the trash before you see them.
• Auto-reply: an out-of-office message you did not write, often used to reply to your own contacts.
• Additional send-as addresses, aliases, or linked accounts that were added.
• Signature changes containing a phone number or a link.

A rule that deletes security alerts explains an important mystery: why you received no warning that anything had happened. Remove any rule you did not create, and note it down before you delete it.

Recovery details are the real prize

Once inside, an intruder often changes the recovery phone number and secondary email address, because that converts temporary access into ownership. Check both, plus any trusted phone numbers and security keys, and restore them to values you control.

Check the account's recent activity or sign-in history at the same time. Unfamiliar locations and times tell you roughly when access began, which in turn tells you what else was reachable during that window.

Connected apps and old app passwords

Modern accounts can grant long-lived access to third-party applications, and those permissions are separate from your password entirely. An authorization granted to a plausible-sounding app continues working after every password change until it is revoked.

Review the list of connected or third-party applications and remove anything you do not actively use and recognize. Do the same for app-specific passwords, which some accounts issue for mail programs and older devices; revoke any you did not create, and any you no longer need.

Money and identity exposure

Work through what the compromised account could reach, not just what was visibly used.

Saved payment methods, stored addresses, gift card balances, loyalty points, and any advertising account are all worth checking. Advertising accounts deserve particular attention because they can accumulate real spending very quickly and the charge appears legitimate to a bank.

If identity documents were stored in the mailbox, such as photographs of a passport, a driver's license, or tax paperwork, note that. It changes what you should monitor afterward, and it is information a fraud adviser or your bank will want.

Telling your contacts

Warn people, particularly if messages asking for money or containing links were sent from your account. Use a different channel from the compromised one: a phone call, a text message, or a separate platform.

Keep the message short and factual. Say the account was compromised, give the dates if you know them, and say that any request for money or any link sent during that period should be ignored. Avoid sending a link of your own, since a warning containing a link is hard to distinguish from the fraud it is warning about.

Do not tidy up too quickly

The instinct to delete the embarrassing messages sent in your name is strong. Wait until you have documented them.

Take screenshots showing dates and times of the sent messages, the changed settings, any unfamiliar sign-ins, and any charges. If money, a business page, or an advertising account is involved, that record is what supports a dispute with a provider or a bank. It is also useful if the matter needs to be reported to a police or consumer protection service.

People who offer to hack it back

An entire trade exists around this moment. Advertisements, comments, and direct messages promise recovery for a payment, and some request your password, a verification code, or identity documents.

Nobody outside the provider can restore an account, and requests that arrive shortly after you post publicly about the problem are a response to that post. Never share a one-time code with anyone, including someone claiming to work for the provider, because that code is frequently the only thing standing between an intruder and the account.

When the hijacked account is your second factor

If the compromised account is the one that receives your verification codes, the problem widens considerably, and the order of work changes.

Deal with financial accounts first. Contact the bank or card issuer directly and ask them to note the compromise on the account and to use an alternative verification method. Then move your second factor elsewhere, ideally to an authenticator application rather than to a phone number, since numbers can be transferred away from you.

Details worth recording

Note when you first noticed, what you saw that was wrong, the dates and locations of unfamiliar sign-ins, every setting you found altered and its original value if you know it, any rules or connected apps you removed, what payment methods and documents the account could reach, what you have already changed, and which other accounts use the same email address. Do not include passwords or codes.

When to bring in help

Independent help is worthwhile when the compromise touches money, an advertising account, or a business presence, when you are not sure which of your accounts to secure first, or when you cannot get back into the mailbox and need to plan around that. Banks, providers, and where relevant the police are the parties who can act; an adviser helps you decide the order and prepare what each of them will ask for.

Important disclaimer

This page is general independent information and is not official support for any platform or provider. Security settings, session controls, and recovery options differ by service and change regularly. Follow each provider's own current process, contact financial institutions directly about unauthorized charges, and never share passwords or verification codes.