What to Do If an Account Is Hacked
If someone gets into your email, social media, bank or work account, act quickly. The longer they have access, the more they can steal, the more people they can scam in your name, and the harder it is to get back in.
- Everyone
- Workers
Photo: security alert email about a sign-in from an unknown device
Signs of a hacked account
- You can’t log in, or your password was changed without you
- Alerts about sign-ins from devices or places you don’t recognize
- Friends get messages or posts from you that you didn’t send
- Emails in your Sent folder you didn’t write, or emails missing
- Purchases, transfers or password reset emails you didn’t request
Recovery steps
- Use a device you trust. If you think your computer has malware, use another device.
- Secure your email first. Email can reset all your other accounts. Change the password and sign out of all other sessions.
- Use the official recovery process if you’re locked out. Go directly to the company’s site; beware of fake “account recovery” services.
- Change the password to a new, unique one. Change it on any other account where you used the same password. See Strong Passwords.
- Turn on two-factor authentication and remove any phone numbers, emails or authenticator devices you don’t recognize. See Two-Factor Authentication.
- Check settings for changes: email forwarding rules, filters that hide messages, recovery email and phone, connected apps and linked payment methods.
- Check financial accounts and call your bank about unauthorized transactions.
- Warn your contacts not to trust messages that seemed to come from you, especially requests for money or codes.
- Report it to the company, and if money or identity is involved, to ic3.gov or IdentityTheft.gov. See Reporting.
Work accounts
Tell your supervisor or IT contact immediately if a work email, payroll or software account is compromised. Hackers use them to send fake invoices or change payroll details. See Payroll Scams.
Prevent it next time
- Use a password manager and unique passwords.
- Turn on two-factor authentication or passkeys everywhere you can.
- Never share verification codes.
- Keep devices updated. See Software Updates.
Standards & references
Last updated: