Hacked Account? The Recovery Steps, in Order

The account you lost is often not the first one to rescue. If a stranger controls your email, they can ask your other services for password-reset links and pick them up from your inbox, so a hacked social media or shopping account can’t be secured until the inbox behind it is.¹

What to do if your account is hacked comes down to an order, with your email first. The UK’s National Cyber Security Centre (NCSC), in guidance reviewed in 2022, lists the core moves in this sequence: get back in through the service’s official recovery pages, delete email forwarding rules you never created, change the password there and on any account that reuses it, log other devices out, and switch on two-step verification.² The full list, with the checks that follow:

1. Start with your email account
2. Recover through the official route only
3. Clear forwarding rules, recovery details and connected apps
4. Change passwords and sign out other sessions
5. Add a check beyond the password
6. Warn your contacts
7. Check saved payment methods and your bank
8. Scan the device you use

If you are locked out right now, go straight to step 2 and its table of official recovery pages; the reasons for the order can wait until you are back in.

If nothing has gone wrong yet, the six digital safety habits that make a takeover less likely are the better place to start. This guide is for the day something already has.

Why speed and order matter after a takeover

Order matters because an intruder rarely stops at changing your password. A 2014 study of hijacked Google accounts, by researchers at Google and the University of California, San Diego, found that people who take over accounts by hand move fast, search the mailbox for money, write to the owner’s contacts and change settings to keep hold of the account, such as forwarding rules and new recovery details.³

Hacked messaging and email accounts show up in national crime figures. In England and Wales, the Office for National Statistics’ crime survey for the year to March 2025 found that when someone got into people’s personal information without permission, it was through a social media or messaging account in about a quarter of cases and through email in about one in six.⁴ Friends and family trust messages from those accounts, and that trust is what an intruder borrows.

The study

Moderate evidence

Hijacked by hand: inside Google account takeovers, 2011 to 2014

The researchers studied accounts taken over by people rather than by automated programs. When they planted fake logins on phishing pages, criminals tried about a fifth of them within 30 minutes. Once inside, hijackers spent about 3 minutes judging whether an account was worth exploiting, searched the mail for financial details and often used the contact list for scams. Owners with a recovery phone number on the account got it back about 81% of the time, against 14% for those relying on security questions or manual review.³

It can look like this. You find on a Sunday evening that your email password no longer works. By the time you are back in, a rule may be quietly copying your new mail to a stranger, the recovery number may no longer be yours, and a cousin may already have a message “from you” asking for an urgent transfer.

The intruder’s changes outlast the password, so a forwarding rule or a swapped recovery number is a way back in, and step 3 matters as much as step 4. Your contacts are next in line, so the warning in step 6 protects them. Keep the limits in mind: this is an observational studyobservational study: A study in which researchers record what people already do or are exposed to, rather than assigning anyone to anything. It can show that two things go together, not that one causes the other, because the groups being compared may differ in other ways as well.Full entry in the glossary of one company’s data, and it is more than a decade old.

What to do if your account is hacked: eight moves, inbox to bank

The eight steps take back the account that controls the others first, then close each door an intruder may have left open. They broadly follow the NCSC’s order, with details from the US Federal Trade Commission (FTC) and from Google, Microsoft, Apple and Meta.

1. Start with your email account

Check your email before anything else, even if the alert was about Instagram or a shopping site. Try to sign in, and if it works, glance at its security page: is the recovery phone still yours, and is there a device you don’t recognize?

If you can still sign in, change the email password now and go to step 3. If you can’t, step 2 is your way back in.

2. Recover through the official route only

Every major service has its own recovery page, and the process differs for each, so start on the provider’s own website or app. The FTC’s hacked-account guide links to the official pages for services including Instagram (instagram.com/hacked), WhatsApp, X and TikTok.¹ For the largest providers:

3. Clear forwarding rules, recovery details and connected apps

Once you are back in, look for anything that would let an intruder keep reading your mail or return after you change the password. The NCSC calls email forwarding rules a common tactic, because they send the criminal a copy of every message, password resets included, and it puts this check before the password change.² Look in three places:

• Forwarding rules and filters: delete any you did not set up, then confirm that the recovery email addresses and phone numbers are ones you entered and can reach.¹
• Connected apps and shared access: Google lists apps with access to your account, and Gmail’s mail delegation, among the settings to correct if they changed without you.⁹
• Devices and your phone number: on an Apple Account, remove devices you don’t recognize at account.apple.com, and ask your mobile carrier to confirm that no one has set up text-message forwarding on your number, as Apple suggests.¹⁰

After a break-in at home, new locks do little if the burglar also left a window on the latch. In a hijacked email account, the forwarding rule is that window, so close it before you trust the new password.

4. Change passwords and sign out other sessions

Change the password on the hacked account and on every account that used the same one, because criminals try a stolen password on other sites, the NCSC explains. Then log all devices and apps out of the account, so anyone still signed in elsewhere is asked for the new password; the option usually sits under settings, privacy or account options.²

A reused password is the thread to pull. If your email and a food-delivery app shared one, assume both were tried, and work through every account that shared it, starting with email and money. A password manager that gives every account its own password makes the clean-up faster and keeps one leak from reaching every account next time.

5. Add a check beyond the password

Two-step verification asks for a code, a prompt or a key as well as your password. The US Cybersecurity and Infrastructure Security Agency (CISA) explains why it belongs in recovery: if one credential, such as your password, is compromised, an intruder still has to meet the second requirement.¹¹

Set it up on the recovered account first, then on your email and bank, and keep the backup codes the service offers somewhere other than your phone, so a lost phone doesn’t lock you out next.

6. Warn your contacts

Tell friends, family and followers that you were hacked, and ask them not to click links in messages from you or answer pleas for help or money.¹ Use a channel the intruder doesn’t control, such as a text or a group chat, and keep it short: “My email was hacked this week. If you got a link or a request for money from me, it wasn’t me. Please delete it.”

7. Check saved payment methods and your bank

Look inside the hacked account first. Google’s guide, for example, says to report unauthorized charges, remove any card or bank account you don’t recognize, and contact your bank if you kept banking details in the account.⁹ Then read your bank statements and any shopping accounts that store a card, looking for payments you didn’t make. If you find one, the section on lost money below covers what to do.

8. Scan the device you use

Guides differ on timing here: Microsoft’s recovery guide puts a full antivirus scan before the password change,¹² while the NCSC lists updating your devices later. Run your security software’s full scan, install waiting updates and turn on automatic updates, which the NCSC calls one of the most important and quickest things you can do to stop your account being hacked.²

After a takeover, in this order

• Check I can still open my email
• Start recovery from the service's own help page
• Delete forwarding rules and filters I did not set up
• Check recovery email, phone, connected apps and devices
• Change the password there and anywhere it was reused
• Sign out all other sessions
• Turn on two-step verification and save backup codes
• Warn contacts through another channel
• Check saved cards, bank statements and shopping accounts
• Scan and update my devices

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

Fake recovery services are a second scam

Treat anyone who contacts you offering to recover your account for a fee, or who asks for your password or a verification code, as a scammer. Microsoft, for example, says its own support agents are not allowed to send password reset links or to access and change account details.⁶

That gives you a test for anyone offering to get your account back. If the company’s own staff can’t skip its checks, and Apple Support can’t shorten its recovery wait, a stranger promising a shortcut cannot deliver one.

The US FTC’s 2023 advice describes the money version of this trap as refund and recovery scams. Scammers buy and trade lists of people who have already been scammed, then get in touch posing as a government agency, a law firm or another organization and ask for an upfront fee. The FTC’s rule is blunt: anyone who asks for an upfront fee, or insists on payment by gift card, cryptocurrency or wire transfer, is a scammer, and paying only loses you more. In the US, it takes reports of such scams at ReportFraud.ftc.gov; elsewhere, the national services in the next section are the place to report.¹³

Say you post “My Instagram was hacked, can anyone help?” An hour later, a friendly-looking account messages you: it knows someone at Meta and can restore your profile tonight for a fee, if you send the code you just received. It found you, it wants money and it wants a code, so it fails the test three times over.

If money was taken, or you can’t get back in

If money left your account, contact your bank straight away and report the crime to the police or your country’s fraud-reporting service. The NCSC gives that advice to UK readers, names Report Fraud as the reporting centre (Scottish readers call the police on 101) and says to reach your bank through its official website or an address you type yourself, never a link in a message. If an account can’t be recovered at all, it suggests opening a new one, telling contacts the old one is abandoned and updating your details with your bank, utility and shopping websites.²

Outside the UK, look up your own national service. Some of them:

• In Australia, the government’s myGov service points to ReportCyber on the Australian Cyber Security Centre’s website and advises contacting your bank.¹⁴
• Canadian victims are asked by the Canadian Anti-Fraud Centre to go to their local police and also file a report with the centre.¹⁵
• In India, the Ministry of Home Affairs runs the National Cyber Crime Reporting Portal, which has a category for financial fraud.¹⁶

If the intruder used your personal details to open accounts or borrow in your name, that is identity theft, which needs steps of its own. In the US, the FTC’s IdentityTheft.gov gives a free personal recovery plan.¹⁷

The proof behind each step

This order rests on agreement between government agencies and the providers’ own help pages, not on trials: nobody has randomly assigned hacked accounts to different recovery orders and counted which stayed safe.

Refusing paid recovery help rests on US consumer-protection advice and the providers’ own rules, and the guides disagree on when to scan. That least settled point matters least: scan early if you can, and don’t skip it.

The bottom line

Start with your inbox and recover it through the provider’s own page and nowhere else. Then close the back doors (forwarding rules, recovery details, connected apps and open sessions), change reused passwords and turn on two-step verification. Anyone who offers to speed this up for a fee, or asks for your codes, is running a scam.