Hacked Email or Social Media Account? Recovery Steps to Take First

• If you can still sign in, change the password, sign out other sessions, and remove unfamiliar recovery details or connected apps immediately.
• If you are locked out, use the account provider's official recovery page rather than links sent by strangers or paid account-recovery services.
• After regaining access, check email forwarding, messages, payment activity, and contacts—and warn people who may have received scams from your account.

What to do first when an email or social media account is hacked

Move quickly, but don’t panic. The safest recovery order is to secure the device you are using, regain or confirm access through the provider’s official recovery process, change the password, remove unauthorized access, and then check what the intruder changed.

This guide applies to common personal accounts such as Gmail, Outlook.com, Apple Account, Facebook, Instagram, X, TikTok, WhatsApp, and similar services. Menu names vary by platform, but the recovery pattern is broadly the same.

Common warning signs include an unexpected password-reset message, a changed recovery email or phone number, unfamiliar login alerts, posts or messages you didn’t send, or an account password that suddenly stops working.

Before you start: protect the device and avoid recovery scams

If the account was compromised after you opened a suspicious attachment, installed an unfamiliar app, or gave someone remote access, don’t change passwords on that device until it has been checked. Run a full scan with updated security software, install pending operating-system updates, and use another trusted device for recovery if possible.

Never give a supposed helper your password, verification code, backup code, or remote access. Google says it does not work with services that claim to provide account or password support, and legitimate platforms will not need your one-time code sent through a random text, direct message, or phone call.

If money, banking information, a Social Security number, Social Insurance Number, or identity documents may have been exposed, treat this as more than a login problem. Contact your financial institution using a trusted number, review transactions, and report identity theft or fraud through the appropriate government service.

Quick checks if you can still sign in

1. Change the password now. Use a new, unique password or passphrase that you have never used elsewhere. If you reused the old password, change it on every other account that used it—especially your email, banking, payment, shopping, and password-manager accounts.
2. Sign out everywhere. Look for options such as “Where you’re logged in,” “Devices,” “Sessions,” or “Sign out of all devices.” Remove unfamiliar phones, browsers, apps, and locations. Changing a password does not always remove every existing session.
3. Check the recovery information. Confirm that the recovery email address, phone number, backup codes, security questions, and trusted devices belong to you. Remove anything the attacker added.
4. Turn on two-factor authentication. An authenticator app or security key is generally safer than text messages, although text-based 2FA is still better than using only a password. Save backup codes somewhere secure, not in the compromised account.
5. Review connected apps. Revoke access for services, browser extensions, and third-party apps you don’t recognize. An attacker may retain access through an authorized app even after you change the password.

After each step, open the account in a private browser window or on a second trusted device. Confirm that you can sign in with the new password and that no unfamiliar session or security alert returns.

If you are locked out of the account

Use the provider’s official recovery page, ideally from a device and location you have used before. Answer recovery questions as accurately as you can, and don’t keep guessing random information. If the attacker changed your email address or phone number, look for an earlier security notification that lets you reverse the change.

For Google accounts, the recovery process can be used when someone changed your password or recovery information. Google notes that recovery requests can sometimes be delayed for several hours or days as a security measure. Avoid paying anyone who promises instant access or asks for your verification codes.

For Microsoft accounts, Microsoft’s sign-in helper guides you to the appropriate recovery option. Microsoft also recommends scanning a Windows PC for malware before changing the password if the account may have been compromised through that computer.

For Facebook, Meta directs users with hacked accounts to its dedicated recovery page and recommends using a device previously used to log in. X provides a hacked-account support form for people who cannot regain access after a password reset.

Secure the account after you get it back

Inspect email settings carefully

Email accounts deserve extra attention because they can be used to reset passwords for your other services. Check forwarding rules, filters, automatic replies, email signatures, delegated access, recovery addresses, and recently deleted messages. Remove anything you did not create.

Search your mailbox for terms such as “password,” “security alert,” “verification code,” “new login,” and “receipt.” This can reveal password-reset attempts, account changes, or purchases made while the attacker had access.

Review social activity and private messages

Look for posts, comments, direct messages, new follows, new friends, profile changes, and deleted content you don’t recognize. Delete malicious posts where possible, but save screenshots first if they involve threats, fraud, impersonation, or financial loss.

Tell contacts that the account was compromised and that they should ignore recent links, investment offers, emergency money requests, or messages asking for verification codes. If the attacker contacted coworkers or customers, notify them through another trusted channel.

Check financial and identity-related activity

Review bank, credit-card, payment-app, shopping, gaming, and cryptocurrency accounts connected to the compromised email or social profile. Look for new payment methods, changed shipping addresses, password resets, or purchases you don’t recognize.

In the United States, use IdentityTheft.gov if personal information may have been misused. In Canada, report fraud or identity theft to the Canadian Anti-Fraud Centre and contact your financial institutions and local police when appropriate.

When the usual recovery process does not work

The attacker changed your recovery email or phone: Search your original inbox and text messages for a security notice from the platform. Some providers include a short-term reversal link. If there is no reversal option, start the official recovery process from a familiar device and provide the oldest accurate account information you can.

You still receive password-reset emails: Secure the email account first, then change the affected account’s password again and revoke connected apps. Repeated reset messages can be an attempt to distract you or wear down your security.

The account keeps sending messages after the password change: Scan your devices, remove suspicious browser extensions, revoke third-party access, and check active sessions. Persistent unauthorized activity may indicate malware or a stolen session cookie.

You see unauthorized charges or identity fraud: Contact the bank, card issuer, payment service, or credit bureau immediately. Preserve emails, receipts, login alerts, usernames, dates, and screenshots. Do not delete evidence before reporting the incident.

The account is a work, school, or employer-managed account: Contact the organization’s IT or security team. Consumer recovery forms may not work for managed accounts, and the administrator may need to revoke sessions or reset authentication methods.

When to contact support or consider professional help

Contact the platform’s official support channel when the recovery email and phone number were replaced, the account was disabled after the hack, you cannot pass identity verification, or the intruder continues to regain access. Use only support pages linked from the provider’s official website or app.

Consider help from a reputable local computer professional if malware, remote-access software, SIM-swap activity, or multiple compromised devices may be involved. If your phone suddenly loses cellular service or your carrier reports a SIM change you did not request, contact the mobile carrier immediately from another phone.

Once the account is stable, store recovery codes offline, keep recovery information current, use unique passwords, and review account activity every few months. A password manager can make unique passwords much easier to maintain.

Helpful Links

• Federal Trade Commission account recovery guidance – Review the FTC's recovery steps and official links for popular email and social media services.
• Google Account recovery – Recover a Google Account or Gmail account when you cannot sign in or suspect unauthorized access.
• Microsoft hacked account recovery – Use Microsoft's sign-in helper and review the recommended malware scan and account-security steps.
• Apple Account Support – Reset an Apple Account password, regain access, and review account security options.
• Facebook hacked account recovery – Follow Facebook's official process for recovering a hacked account.
• X compromised account support – Submit an official X account-access request if a password reset does not restore access.
• IdentityTheft.gov – Report identity theft in the United States and receive a personalized recovery plan.
• Canadian Anti-Fraud Centre – Learn how to report fraud or identity theft in Canada and find victim-support guidance.
• How to recover your Google Account or Gmail – Official page referenced in the article.

Frequently Asked Questions

Q. Should I change my email password before my social media password?

A. Usually, yes. Email is often the recovery key for other accounts. Secure the email account first if it is still under your control, then change passwords on social media, banking, shopping, and payment accounts that use the same email address or password.

Q. Can I trust a person who says they can recover my hacked account for a fee?

A. Be extremely cautious. Unexpected offers of account recovery are commonly scams. Use the platform’s official recovery process, and never share your password, verification code, backup code, or remote access with an unsolicited helper.

Q. Does changing my password automatically remove a hacker?

A. Not always. Many services have separate active-session, device, or connected-app controls. Change the password, sign out unfamiliar sessions, revoke unknown apps, and review recovery information and security settings.

Q. What if the hacker sent scams to my contacts?

A. Warn your contacts through another trusted channel and tell them not to click recent links, send money, or share verification codes. Save screenshots and message details if there was fraud, impersonation, harassment, or financial loss.