Why early signs matter
Account takeovers are not always dramatic. Sometimes the first clue is a single odd email or a notification you almost ignore. The sooner you notice, the less time an attacker has to read messages, change recovery details or contact your friends. Many signs also have harmless explanations, so the goal is not to panic but to check.
Signs inside the account
Messages you did not write
Posts, comments, direct messages or sent emails that you do not remember are among the clearest signs. Friends may tell you they received a strange link or an urgent request from you. Check the sent folder, the outbox and the account’s recent activity. Remember that spammers can also forge your address without entering your account, so an email bounce-back or a report from a friend is a reason to look, not proof of a hack. Spam email filtering often explains why some of these messages appear.
Unexpected sign-in alerts
Services commonly send a notice for a login from a new device or place. One you do not recognize deserves attention, especially if you have been home all day. A location difference alone can have innocent causes, such as a mobile network or a VPN, but a different device type or repeated alerts are more worrying. Be careful with the alert itself too: some fake “unusual sign-in” emails are phishing messages. Check the account by typing the website address yourself, not by following the link.
Changed settings
Look for changes you did not make:
- A new recovery email or phone number
- A changed display name, profile photo or bio
- New forwarding rules, filters or automatic replies in email
- A turned-off two-step sign-in
- A new signature or “send as” address
- Unfamiliar connected apps
Attackers often change recovery details so they can return, so these are strong signals.
Missing or unusual email
If you stop getting messages you normally receive, such as bank notices, a filter may be diverting them. Emails you did not open might appear as read. Messages in the trash or archive that you did not move are another clue.
Locked out of your own account
If your password suddenly stops working, or you are asked to verify when nothing has changed, someone may have altered it. The steps in how account lockout recovery works apply.
Signs outside the account
- Password reset emails you did not request. A burst of these may mean someone is trying to get in, and one successful reset means they may have.
- Purchases or charges you do not recognize. Regular statement review habits help here.
- Contacts reporting odd behavior. Friends receive strange messages, friend requests or invitations from you.
- Duplicate profiles. A copy of your profile asking your friends for money is a different issue, covered under fake social profiles, but both can happen together.
- Breach notices. A service might tell you your data was exposed. You can also use breach exposure checks to see whether your email appears in known leaks.
Device signs, with caution
Slow performance, pop-ups or programs you do not remember installing may point to unwanted software, but they also happen for ordinary reasons. Do not treat them as proof by themselves. If several signs appear together, such as odd device behavior and account changes, it is more convincing.
What to check in five minutes
- Open the account’s security or activity page and review recent sign-ins and signed-in devices.
- Check recovery email, phone number and forwarding settings.
- Look at sent messages and recent posts.
- Review connected apps and revoke any you do not know.
- Confirm that your password and second step are what you expect.
If everything looks normal, you can relax, but consider a stronger password and two-step sign-in as a precaution. A password you have used on multiple sites is a common weak point, which is why password reuse is a frequent cause of takeovers.
If you find something
Act in order: regain control, change your password, sign out other sessions, fix the recovery details, and tell people who may be affected. The first hour after an account is hacked is covered step by step in the main checklist. Do not try to confront the person behind it, and avoid clicking links in any message from the attacker.
Stay calm and keep watching
Not every strange event means a takeover, and not every takeover is obvious. Trust your instincts if something seems wrong, check calmly, and keep monitoring for a few weeks. Turning on alerts, keeping software updated and using unique passwords reduce both the chance and the impact of a problem.