Account hacked? A step-by-step recovery checklist
Secure your email account first, because it can reset every other password. Then change the hacked account's password from a clean device, sign out of all sessions, check the recovery email and phone, turn on two-factor authentication and look for forwarding rules or connected apps the attacker added.
The first hour
- Use the service's official recovery page if you are locked out. Never pay or trust someone who offers to recover it for you.
- Change your email password first, then the hacked account's password, each unique.
- Sign out of all other sessions on both accounts.
- Check the recovery email address and phone number, and remove anything you do not recognize.
- Turn on two-factor authentication with an authenticator app or security key.
Look for what the attacker changed
- Email forwarding rules and filters that hide security alerts.
- Connected apps, API tokens and OAuth permissions.
- New devices, recovery codes or passkeys you did not add.
- Messages the attacker sent from your account, to warn the people who received them.
Find out how it happened
Most takeovers come from a reused password that leaked in a breach, a phishing page, or malware that stole saved passwords and cookies. Check your email address in a breach index, and if passwords from several unrelated sites were taken at once, treat the computer as infected (see the infostealer guide).
Questions
- The attacker changed my email and phone. What now?
- Use the service's account recovery form and provide what proves ownership: old passwords, the original sign-up email, purchase receipts. Large services keep the previous recovery details for a while for exactly this case.
- Should I report it?
- Report it to the service, and to the police or your national cybercrime center if money was lost or the account was used for fraud.