Think your email or social media account was hacked? Learn how to recover access, secure your accounts, remove unauthorized access, and prevent future attacks.

Hacked Account Recovery: Steps to Secure Your Email and Social Media

You try to sign in and your password no longer works. Or a security alert says your email address was changed. Later, a friend asks why you sent them a strange link—or why your social account is asking for money.

These are stressful moments, but hacked account recovery becomes more manageable when you act calmly and in the right order. A compromised email account deserves particular attention because it can receive password-reset links for many other services. A compromised social-media account can be used to impersonate you and target friends, family, or coworkers.consumer.ftc+1

This guide explains how to regain access, remove an attacker’s remaining access, protect connected accounts, and reduce the chance of another compromise. Recovery options differ by platform and can change, so always use the provider’s official help or recovery process.ncsc

If you cannot sign in, do not panic and do not pay a stranger who promises guaranteed recovery. Start with the official service, use a device you trust, and preserve evidence where it is safe to do so.

Signs Your Email or Social Media Account Has Been Hacked

Common signs include:

• You cannot sign in, or your password was changed without your action.
• You receive an alert about a changed username, password, recovery email, or phone number.
• A login alert shows an unfamiliar device, browser, or location.
• You see messages, posts, comments, ads, or friend requests you did not create.
• Emails were marked read, deleted, forwarded, or sent without your knowledge.
• New email forwarding rules, filters, delegated access, or app passwords appear.
• Unknown applications have access to your account.
• Contacts report suspicious messages from your account.consumer.ftc+2

An unfamiliar location alone is not conclusive proof of hacking. VPNs, mobile networks, and inaccurate location estimates can affect security alerts. Investigate through the platform’s official security settings rather than assuming every alert means an account takeover.microsoft

First Steps to Take After Discovering a Hacked Account

Step 1: Use a trusted device

If possible, use a device you believe is secure and updated. If your computer may contain malware, avoid entering new passwords until you have scanned it or used another trusted device. The FTC recommends updating security software and running a scan before proceeding with recovery.consumer.ftc

Step 2: Secure your primary email account

Email often controls password resets for banking, shopping, cloud storage, and social media. If your email is compromised, secure it before relying on it to recover other accounts.consumer.ftc

Step 3: Use the official recovery page

Type the provider’s address yourself or use a trusted bookmark. Do not follow recovery links from unexpected messages, search advertisements, or social-media replies without checking the destination.ncsc+1

Step 4: Change compromised passwords

Choose a new, unique password that you have not used elsewhere. A long passphrase can be easier to remember than a short, complicated password.consumer.ftc+1

Step 5: End unfamiliar sessions

Use the account’s security settings to sign out unknown devices or sessions where available. This forces other signed-in sessions to authenticate again.consumer.ftc+1

Step 6: Review recovery and connected access

Check recovery email addresses, phone numbers, authentication methods, connected applications, and delegated access. Remove anything you did not authorize.consumer.ftc+1

Step 7: Warn contacts if necessary

If the account sent suspicious messages, contact friends, family, or coworkers through another trusted channel. Ask them not to click links or send money in response to messages from the compromised account.consumer.ftc+1

The order may change if you are completely locked out or suspect your device is infected.

How to Recover a Hacked Email Account

Email recovery deserves priority because an attacker may use it to reset access elsewhere. The FTC explains that someone with access to your inbox could request password-reset links and lock you out of other accounts.consumer.ftc

1. Open the provider’s official recovery process.
2. Follow its current identity-verification instructions.
3. Use a recovery method you control, such as a recovery email, phone number, passkey, or backup code.
4. Once access is restored, set a new unique password.
5. Review recovery details and remove unauthorized changes.
6. Sign out unfamiliar devices and sessions.
7. Inspect forwarding rules, filters, delegated access, app passwords, and connected applications.
8. Check sent, deleted, and security-notification messages for suspicious activity.
9. Secure accounts that use the compromised email for password resets.consumer.ftc+1

A changed password alone may not remove every form of access. A forwarding rule can continue copying messages to an attacker’s address until you remove it.ncsc

Recovering a Hacked Google Account

Use Google’s official account recovery page: https://accounts.google.com/signin/recovery. Follow the current verification process and answer questions as accurately as possible.google

After regaining access, use Google’s Security Checkup to review recent security events, devices, recovery information, and connected applications. Google notes that recovery contact information can help block unauthorized use, alert you to suspicious activity, and support account recovery.myaccount.google+1

Do not assume recovery will succeed if an attacker changed all recovery details. Follow the official process and avoid submitting inconsistent information repeatedly.

Recovering a Hacked Microsoft or Outlook Account

Use Microsoft’s official compromised-account recovery resource: https://account.live.com/acsr. Follow Microsoft’s current instructions and provide accurate information.xbox

Microsoft recommends scanning the computer for malware before changing the password, then reviewing connected accounts, forwarding, and automatic replies after access is restored. Its Recent activity page can help identify unfamiliar sign-ins and account changes.microsoft+2

How to Recover a Hacked Social Media Account

Recovery procedures vary by platform. Use only the official help center or compromised-account flow for the service involved.

Facebook Account Recovery

Use Meta’s official hacked-account recovery page: https://www.facebook.com/hacked. Follow the prompts and complete identity verification if requested.meta

After recovering access, change your password, review recent login activity, and check contact information, connected apps, posts, messages, and profile changes. Meta says it sends a message to the previous email address when an account email is changed, which may include a link to reverse that change.meta

Instagram Account Recovery

Use Instagram’s official Help Center: https://help.instagram.com/. Look for its current hacked-account or compromised-account recovery flow rather than relying on third-party instructions.meta

Meta’s Account Recovery Hub covers Facebook, Instagram, and Threads. It directs users to Security Checkup and login alerts for identifying and addressing potential security risks.meta

Other Social Media Platforms

For TikTok, Snapchat, LinkedIn, X, or another service, start at its official website or Help Center. Recovery requirements and identity-verification options vary.

After access is restored, review active sessions, profile changes, messages, connected apps, payment methods, and administrator permissions. Do not assume that a menu path described for one platform applies to another.

What If the Hacker Changed Your Password, Email, or Phone Number?

If an attacker changed recovery information, begin with the platform’s official compromised-account recovery page. Some services send a security notice to the previous email address or phone number with a way to reverse an unauthorized change. Meta documents this approach for changed Facebook or Instagram email addresses.meta

Use any recovery method you still control: an older recovery email, phone number, passkey, backup code, or identity-verification process. Preserve security notifications and evidence, but do not share passwords, codes, or recovery links with anyone.

If your phone number stopped working or your mobile account shows unexpected changes, contact your mobile carrier through its official channel. A sudden loss of service can sometimes indicate SIM swapping, though it can also have ordinary technical causes.

Account recovery can take time. Use consistent, accurate information and avoid repeatedly submitting conflicting details.

How to Secure Your Account After Recovering It

Changing the password is necessary, but it is not always sufficient. Complete this checklist:

• Set a strong, unique password.
• Review recovery email addresses and phone numbers.
• Enable multifactor authentication.
• Prefer passkeys or hardware security keys where supported.
• Sign out unfamiliar sessions and devices.
• Remove suspicious third-party apps and connected services.
• Check email forwarding rules, filters, delegated access, and app passwords.
• Review recent messages, posts, transactions, and profile changes.
• Check unfamiliar administrator accounts in business services.
• Save recovery codes in a secure location.
• Update devices and applications.
• Scan for malware if suspicious downloads or device behavior suggest infection.consumer.ftc+2

MFA adds a second verification step after your password. CISA describes it as a layered approach that requires two or more authenticators before granting access.cisa+1

How to Protect Other Accounts Connected to the Hacked Account

One compromised account can create a chain reaction, especially when passwords are reused.

Secure your primary email first. Then change passwords for accounts that used the same password, beginning with financial, shopping, cloud-storage, workplace, and social-media accounts. The NCSC specifically advises changing passwords for hacked accounts and any accounts sharing the same password.ncsc+1

Review bank and payment services for unfamiliar transactions. Check shopping, cloud-storage, workplace, and social-media accounts for unusual activity. Revoke suspicious third-party access and review password-reset notifications.ncsc

A password manager helps maintain unique credentials without requiring you to memorize every password. Enable MFA on high-impact accounts rather than changing every password indiscriminately when there is no indication of exposure.consumer.ftc+1

What to Do If You Cannot Recover Your Account

Continue through the platform’s official recovery process. Use a secure device and a recovery method you control. Gather accurate information the service requests, such as previous passwords, account creation details, or recent activity.

Check legitimate security emails for recovery instructions. Contact official support only through the service’s published help process. Do not trust an unsolicited message claiming to be support.

Warn contacts that the old account may be controlled by someone else. Ask them not to click suspicious messages or send money. Review financial activity if payment information or banking access may have been involved.consumer.ftc+1

Be wary of recovery scams. Fraudsters may target people who just lost an account and claim to have insider contacts or guaranteed tools. No outside service should be trusted merely because it promises recovery.

If recovery fails, the NCSC advises creating a new account where appropriate, updating contacts, and updating banking, utility, and shopping details.ncsc

How to Report a Hacked Account or Identity Theft

United States

Report the compromise through the affected platform’s official process. Contact your bank or payment provider immediately if financial information or funds are at risk.

If personal information has been misused, use IdentityTheft.gov. It creates an FTC Identity Theft Report and a personal recovery plan.identitytheft+1

For suspected internet crime, the FBI’s Internet Crime Complaint Center accepts reports through IC3.gov. Reporting eligibility and the appropriate channel depend on the incident.

United Kingdom

Report the compromised account to the platform. Contact your bank or payment provider promptly if money or financial information is involved.stopthinkfraud

For fraud or cybercrime in England, Wales, or Northern Ireland, use Report Fraud or call 0300 123 2040. In Scotland, report fraud and financial crime to Police Scotland by calling 101.stopthinkfraud+1

GOV.UK’s identity-theft guidance can help you understand relevant next steps, but reporting requirements depend on the incident and location.stopthinkfraud

How to Prevent Future Account Hacks

• Use unique passwords for every important account.
• Enable MFA and prefer phishing-resistant passkeys or security keys where available.
• Keep recovery details current.
• Protect your primary email account first.
• Avoid entering credentials after following unexpected links.
• Review account activity and security alerts.
• Remove unused third-party applications.
• Keep devices and applications updated.
• Never share verification codes.
• Use a reputable password manager.
• Maintain secure backups of important files.
• Learn to recognize phishing emails, texts, and fake login pages.consumer.ftc+2

Account security works best as a combination of habits, secure authentication, updated software, and prompt action when something looks wrong.

Hacked Account Recovery Checklist

• Use a trusted device.
• Secure the primary email account.
• Start recovery through the official service.
• Change compromised or reused passwords.
• Review recovery email addresses and phone numbers.
• Sign out unfamiliar sessions.
• Remove suspicious apps and permissions.
• Check email forwarding and filters.
• Enable multifactor authentication.
• Inspect financial and connected accounts.
• Warn contacts if the account sent suspicious messages.
• Report financial fraud or identity theft when appropriate.consumer.ftc+1

Frequently Asked Questions

What should I do first if my account is hacked?

Use a trusted device and determine whether you can still sign in. If you can, change the password, sign out unfamiliar sessions, and review recovery details. If you cannot, start the provider’s official recovery process. Secure your primary email account first when possible.consumer.ftc+1

Can I recover an account if the hacker changed my password?

Often, yes—but not always. Use the platform’s official recovery process and any recovery method you still control. Some services can reverse certain unauthorized changes through security notices. Recovery may require identity verification and can take time.xbox+1

How can I recover a hacked email account?

Use the provider’s official recovery page, verify your identity, and set a new unique password after regaining access. Then remove unauthorized forwarding rules, filters, connected apps, and recovery changes. Finally, secure accounts that use that email for password resets.consumer.ftc+1

What should I do if my social media account has been taken over?

Use the platform’s official hacked-account or Help Center process. After recovery, change the password, review login activity, remove unfamiliar apps, and check profile and message changes. Warn contacts if the account sent suspicious messages.meta+1

Can I recover an account without access to my recovery email or phone?

Sometimes. Platforms may offer backup codes, passkeys, identity verification, or support-based recovery. Follow the official process and provide accurate information. There is no guarantee, especially if an attacker changed every recovery method.xbox+2

Should I change passwords on other accounts after one account is hacked?

Change passwords for the hacked account, any account using the same password, and high-impact accounts exposed to the compromise. You do not need to change every password indiscriminately, but prioritize email, banking, cloud storage, and workplace access.ncsc+1

How can I tell whether a hacker still has access to my account?

Review recent sign-ins, active sessions, recovery details, connected applications, forwarding rules, and recent messages or posts. Unfamiliar activity does not always prove a hack, but investigate it through official security settings. Changing the password and signing out sessions reduces remaining access.consumer.ftc+2

Is it safe to pay someone to recover a hacked account?

No. Avoid unofficial recovery agents, paid “hack-back” services, or strangers claiming insider access. They may be scams or may mishandle your credentials. Use only the platform’s official recovery and support channels, and never share passwords or verification codes.consumer.ftc+1

How can I protect my account after recovering it?

Set a unique password, enable MFA, review recovery details, sign out unfamiliar sessions, and remove suspicious connected apps. Keep devices updated and scan for malware if there is any indication of infection. A password manager can help maintain unique credentials.consumer.ftc+2

What should I do if a hacked account is being used to scam my friends?

Warn contacts through another trusted channel. Tell them not to click links, share codes, or send money in response to messages from the compromised account. Report the account through the platform’s official process and preserve relevant messages or screenshots.consumer.ftc+1

Conclusion: Take Control of Your Online Account Security

Hacked account recovery starts with official recovery procedures, a trusted device, and a focus on your primary email account. Replace compromised or reused passwords, revoke unauthorized sessions and connected apps, and enable stronger authentication.

Then check the accounts connected to the compromised one, especially financial services and accounts sharing the same password. Keep recovery details current and learn to recognize phishing messages before they become account takeovers.

Review your email and social-media security settings today. For more practical cybersecurity and online safety guidance, explore KnownAll’s account-security and privacy resources.