Slow down and decide what is affected
Finding out that someone else has been inside your account is unsettling, and the urge is to click everything at once. A few minutes of calm thinking usually helps more than speed. Start by asking which account is involved and what else depends on it. A hacked email account is the most serious case, because many other services send password reset links to it. A hacked social or shopping account is less central, but it can still be used to trick your friends or spend your money.
Outcomes vary. Some takeovers are brief and cause little harm, while others take longer to untangle. This page is general information, not legal or professional advice, and the exact screens on each service change over time, so look for the described option rather than a specific menu name.
The first hour, in order
1. Try to sign in the normal way
If your password still works, you have the best possible starting point. Sign in on a device you trust, and go straight to the account’s security area. If your password no longer works, do not keep guessing; too many failed attempts can lock the account further. Use the service’s “forgot password” or account recovery option instead. How those requests are judged is covered in the explanation of how an account lockout is typically handled.
2. Change the password
Choose a new password that you have never used anywhere else. A long, unique password or passphrase is better than a short complex one. If you use password managers, let the manager generate it and store it. The reason uniqueness matters is explained by the risk of password reuse: when one site leaks a password, attackers commonly try that same combination elsewhere.
3. Sign out other sessions
Most services list the devices and locations currently signed in. Look for an option to sign out of all other sessions or devices. Changing a password does not always end sessions that are already open, so this step matters. If you see sign-ins you do not recognize, note them down before you remove them in case you need to describe the incident later.
4. Turn on or repair two-step sign-in
Adding a second step makes it much harder for someone to get back in with only a password. Read through two-step sign-in settings carefully. If an attacker already turned it on with their own phone number or app, remove it and set it up again with yours. Compare the available verification code options, and prefer an authenticator app or a security key over text messages where the service allows it.
5. Check the recovery details
Attackers often change the backup email address or phone number so they can return later. Make sure every recovery address and number listed is one you own. Also look for forwarding rules or filters in an email account that quietly copy or delete your messages.
Secure the other places that depend on this account
If the hacked account was your email, think about which services use it. Banks, shopping sites, social media, cloud storage and phone-carrier accounts may all send reset messages there. Work through the most important ones first: anything involving money, then anything holding personal documents, then social accounts.
If you used the same or a similar password on other accounts, change those too, starting with the most valuable. Be wary of any message that arrives during this time claiming to help you recover your account. Scammers watch for people in this situation, and phishing messages posing as support staff are a common follow-up. Use only the recovery pages you reach by typing the service’s address yourself or using its official app.
Look for money and identity problems
Review recent activity on any linked payment method. Good statement review habits help here: look for small, unfamiliar charges as well as large ones, because small test charges are sometimes made first. If you find anything, contact the card issuer or bank directly using the number printed on your card or on its official website, and tell them what happened. General online banking safety steps, such as turning on alerts, are worth doing afterward.
If personal documents or identity details were in the account, the risk of identity theft rises. A credit freeze is one option some people consider in that situation; whether it is available and how it works depends on where you live. Your local consumer-protection or identity-theft authority can explain your options.
Tell the people who may be affected
If the account sent messages, a short note to your contacts that says “ignore anything odd from me” can prevent further harm. If it is a work or school account, tell the IT or security team promptly, even if you are embarrassed. They have likely seen this before, and early notice limits damage for everyone. If money was taken or you believe a crime occurred, consider filing a report with your local police or your country’s fraud-reporting service. If anyone is in danger, contact local emergency services right away.
Check what else has access
Review third-party tools and apps that were granted permission to use the account. Connected app access can persist even after a password change, so remove anything you do not recognize or no longer use. Remove unused browser extensions and check your devices for problems too; the follow-up work of post-breach cleanup is covered separately.
Keep a short record
Write down the date and time you noticed the problem, what you changed, and any messages or charges you saw. Screenshots can help if you later need to contact a bank or a support team. This record also stops you from repeating steps or forgetting an account.
What not to do
- Do not pay anyone who offers to “recover” the account for a fee.
- Do not reply to a message from the attacker or follow instructions in it.
- Do not use the compromised device for important sign-ins until you are confident it is clean.
- Do not blame yourself too harshly. Skilled attackers fool careful people regularly.
After the first hour
Once control is restored, spend the next few days on the quieter work: review each device, update software, and set up better safeguards so a repeat is less likely. Many people also find the experience stressful afterward, and that is normal; talking to a friend or family member can help. If you cannot regain access at all, keep trying the official recovery process and be patient, as some services take days to respond.