Hacked Account or Stolen Money? What to Do, in Order

In this final lesson, you learn what to do if an account is hacked, or if money or your identity is stolen. It can happen even to careful people. Acting calmly and in the right order limits the damage, so it helps to know the order before you ever need it. At the end, you will find the whole course on one checklist.

If an account is hacked: email first

If an account is hacked, start with your email, even if the problem began somewhere else, like a social media or shopping account. The reason is simple: whoever controls your inbox can ask your other services for password-reset links and pick them up there. So your other accounts can’t really be safe until your email is.

Step 1 of 4, Email first. An Email card with a key badge sends lines to three accounts, Social (marked Hacked), Shopping and Bank, each with a reset arrow. A label says Whoever has your inbox can reset the rest. — Your inbox is the key to your other accounts.

Use only the official help pages

To get back in, use only the service’s own help pages, which you reach through its app or website. Every big service has its own recovery page. Anyone who contacts you offering to recover your account for a fee, or who asks for your codes, is a scammer. It is a second scam, aimed at people who have just had the first one.

Step 2 of 4, Official help pages only. A phone shows an Account help page with a Get back in button and a blue check. Beside it, a crossed-out example message from a Recovery Expert: I can get your account back tonight for a small fee. Just send me the code you received. Red labels say Found you, Wants money, Wants your code and A second scam. — Real recovery never starts with a stranger who found you.

Close every door

Once you are back in, look for anything the intruder left behind to keep reading your mail or to come back later:

Forwarding rules. Delete any rule you did not set up. It quietly copies your new emails to a stranger, password-reset emails included.
Devices and apps. Remove any devices and connected apps you don’t recognize.
The password. Change it on this account, and anywhere else you used the same password.
Two-step verification. Turn it on, so a stolen password alone is no longer enough. See the two-step verification lesson earlier in this course.

Step 3 of 4, Close every door. A Security settings panel with a check mark shows a new Password and Two-step verification switched on. Beside it, Shopping and Food delivery accounts each get a key badge. — A new password shuts the front door; the other steps close the back doors.

Warn your contacts

Next, warn your friends and family. Do it by text or another way, not from the hacked account. Ask them to ignore any link or request for money that seemed to come from you. Intruders often use a hacked account to write to the owner’s contacts, because people trust messages from someone they know.

If money or your identity is stolen: bank first

If money was taken, or someone stole your identity to borrow or open accounts in your name, call your bank first. Use the number on your card, not one from a message about the problem. Your bank can stop payments and cancel cards before more money leaves. If a loan or account you don’t recognize appears, contact that lender too.

Step 1 of 3, Bank first. Cards for Money taken and Identity theft (your details used to borrow or open accounts in your name), and a crossed-out example: Call us on this number. A bank card's phone number links to a phone making the call, above a large pause symbol. — Call the number on your card, so the bank can stop payments.

Report it, and keep a record

Then report it to the police or your country’s fraud reporting service, and ask for a reference number. That number turns your word into a record that banks and lenders can check. Keep a written record of every call and letter: the date, who you spoke to, what they agreed and any reference number. A plain notebook is enough.

Steps 2 and 3 of 3. Report it: a Report card with a Reference number and a label that says Your country's official service. Keep a record: a notebook with the headings Date, Who I spoke to, What they agreed and Reference number, and the label A plain notebook is enough. — Leave every call with a reference number, and write it down.

For stolen money or identity

This lesson gives general steps only. If money or your identity has been stolen, contact your bank and the official agencies in your country, such as the police or your national fraud reporting service. They can tell you exactly what to do where you live.

The whole course on one checklist

Here is the whole course on one checklist. Use strong, different passwords, and a password manager. Add two-step verification or passkeys, starting with your email. Pause before you act on a message or call. Keep automatic updates on. And back up what you can’t replace.

A card titled The course checklist with five ticked rows: Strong, different passwords and a password manager; Two-step verification or passkeys, email first; Pause before you act on a message or call; Automatic updates on; Back up what you can't replace. — Five habits that guard the three doors most attacks use.

YOUR TURN

Hacked Account? The Recovery Steps, in Order: every step from your inbox to your bank, with where to find each big service’s official recovery page.
Identity Theft: The First Steps Anywhere in the World: what to do in the first hour, day and week, and where to report it in different countries.

You have finished Staying Safe Online. Well done, and thank you for learning with us: every habit you tick off makes you a little harder to fool.