Hacked Email or Social Media Account: What to Do in the First Hour and After

If your email or social media account has been hacked, first scan your device for malware, then use the provider’s own recovery page to get back in. Once you’re in, change the password, sign out of all devices, turn on two-factor authentication, check that the recovery email and phone are yours, look for forwarding rules or messages you didn’t send, and warn your contacts. That’s the FTC’s sequence, and it works for Gmail, Outlook, Facebook, Instagram and nearly everything else¹.

A friend rang me last year, locked out of her email and close to tears, with a message open from a stranger offering to “unlock” it for her. After my own scam I recognised the shape of that offer straight away. Don’t answer it. Everything you need to do, you can do yourself, from the provider’s own pages.

Signs your account has been hacked

The four common signs are being locked out, change alerts you didn’t trigger, login alerts from devices or places you don’t recognise, and messages to friends that you never sent. The FTC lists these as the main clues¹.

The last one is often how people find out. A friend texts asking why you’ve sent them a link, or why you’re stuck abroad and need money. Those messages are the hacker using your name to scam people who trust you, and they’re why warning your contacts quickly matters.

Not every security alert means a hack. Providers sometimes flag a login from a new phone you’ve just set up, or from your own laptop on a hotel network. If you recognise the device and time, you can usually confirm it. If you don’t, treat it as real.

The first hour: getting back in

Clean your device first, then recover the account through the provider’s official route. Doing it the other way round risks handing the new password straight to malware that’s still on your computer.

1. Update and run your security software. The FTC advises making sure your computer’s security software is up to date, running a scan, deleting anything suspicious, and restarting¹.
2. Go to the provider’s account recovery page. Every big provider has one. Type the address in yourself or find it through the provider’s official help centre, rather than clicking a link in an email, which could be phishing (see phishing emails and texts).
3. Follow every step it gives you. If the hacker changed the recovery email and phone, the process will ask for other evidence, such as a previous password or details about how you used the account. It can take several days. That’s frustrating but normal.

What not to do: don’t pay or reply to anyone offering to recover your account. People who’ve lost access are targeted by the same kind of “recovery” offers that follow a financial scam, and the FTC is clear that anyone promising to recover your losses for a fee is a scammer². The pattern is described in recovery scams, the second wave.

Once you’re back in: lock it down

Change the password, sign out everywhere, turn on two-factor authentication, and check the recovery details. In the FTC’s order¹:

• Change your password to a strong one you don’t use anywhere else³. A long passphrase or a password manager is easiest; how to create strong passwords explains both.
• Sign out of all devices. This throws out anyone still signed in.
• Turn on two-factor authentication, also called two-step verification. An authenticator app or security key is stronger than a text code⁴, as covered in two-factor authentication explained.
• Check your recovery email and phone number. They should be ones you entered and can still access. Hackers often add their own so they can get back in later.

Check what the hacker did

A hacker who had your account may have left things behind and used it to contact people, so look before you move on. The FTC suggests¹:

• Forwarding rules. Look in your email settings for any rule that forwards mail to an address you don’t know, and delete it. This is the step people most often miss, and it can keep sending your password reset emails to the hacker after you’ve changed everything else.
• Your sent folder, to see what was sent in your name and to whom.
• Your deleted folder, for emails the hacker may have read and then deleted, such as security alerts or reset messages.
• Your social media accounts, for posts or messages you didn’t send and for new friends or connections you don’t recognise.

Tell your contacts

Send a short message or post saying your account was hacked, and ask people not to click links or respond to requests for money that came from you. The FTC recommends exactly this¹. It feels embarrassing. It also protects the people most likely to trust a message from you, including older relatives, who are frequent targets of “I’m stuck, please send money” messages.

If anyone did send money, they should contact their bank or payment app straight away, and can you get your money back after a scam explains what’s possible for each payment method.

Why email matters most

Whoever controls your email can reset the passwords on almost everything else. The FTC points out that a hacker with access to your email can request password resets for your other accounts, read the reset links, and lock you out¹. That’s why your email deserves your strongest password and your best two-factor method, and why it’s often the first target in larger attacks such as SIM swaps.

So after any email hack, check the accounts that use that address, starting with banking and payment apps. If you used the same password anywhere else, change those as well. If the hacker could have seen personal details, like copies of ID, tax documents or your Social Security number in old emails, IdentityTheft.gov gives you a step-by-step recovery plan⁵, and identity theft: what to do covers the same ground. If the hack was part of a wider scam, report it at ReportFraud.ftc.gov⁶.

---

This article is general information about account security, not personal security, legal or financial advice. If you’ve lost money or personal information, contact your bank and the official reporting channels directly.