My Account Was Hacked: What to Do First (Any Platform)

If your account was hacked, start with your email: secure it first, because it’s where password reset links go. Then use the platform’s own official recovery route (never a “recovery service”), change the password to one you’ve never used, turn on two-step verification, sign out of all other sessions and remove anything the hacker added. Finally, warn your contacts through another channel and check whether the same password was used anywhere else.

Those steps work on almost every platform. The details differ from one service to the next, so this page gives you the universal plan first, then links to a dedicated recovery guide for each major platform.

First, stay calm and work in the right order

Hacked accounts feel urgent, and scammers count on that. The order matters because accounts are connected. If you recover your Instagram but the hacker still controls your email, they can reset Instagram again in minutes.

Think of your accounts as a chain. At the top is your phone number and your main email account. Below those sit your bank, shopping, work and social accounts, most of which can be reset through the email or a text code. Fix the top of the chain first.

The universal first steps for any hacked account

1. Check your email account. Can you still get in? Look for security alerts, password-change emails and new forwarding rules or filters you didn’t create. If your email was hacked too, recover it before anything else.
2. Check your phone service. If your phone suddenly shows no signal and you can’t make calls, contact your carrier from another phone. A SIM swap lets a criminal receive your text codes.
3. Use the platform’s official recovery route. Every major service has one, usually a “Forgot password” or “Need help signing in” link on the real login page. Type the address yourself.
4. Look for a “this wasn’t me” email. Many platforms email the old address when details change, often with a link to reverse the change. Use it quickly, but confirm the email is genuine first.
5. Change the password to a long one you’ve never used anywhere else.
6. Turn on two-step verification, ideally with an authenticator app, passkey or security key rather than text messages.
7. Sign out of every other session and device from the account’s security settings.
8. Remove what the hacker added: unfamiliar recovery emails and phone numbers, connected apps, linked devices, admin users, payment methods, forwarding rules.
9. Warn your contacts by another channel. Hacked accounts are often used to message friends asking for money or codes.
10. Change every other account that shared the password. Criminals test stolen passwords on other sites.

Keep a short log as you go: what you changed, when, and any ticket or case numbers. It helps if you need to contact support or your bank later.

Recovery guides for each platform

Once you’ve done the universal steps, use the guide for the specific account. Each covers that platform’s official recovery route, what to do if the email or phone was changed, and how to stop it happening again.

Account	Guide	Why it’s urgent
Gmail or Google	Gmail hacked	Controls resets for many other accounts, plus Drive, Photos and Android.
Any email account	Email account hacked	Email is the master key for almost everything else.
Microsoft or Outlook	Microsoft account recovery	Covers Outlook, OneDrive, Xbox and Windows sign-in.
Yahoo	Yahoo account hacked	Yahoo Mail often holds resets for older accounts.
Apple ID	Apple ID hacked: what to do	Controls iCloud, Find My, saved passwords and purchases.
iCloud	iCloud hacked	Photos, backups, notes and Find My location.
Your phone	Phone has been hacked	Receives your codes and holds your logged-in apps.
Facebook	Facebook account hacked	Often used to scam friends and take over Pages.
Instagram	Instagram hacked	Common target for crypto and “giveaway” scams.
X (Twitter)	X account hacked	Public posts in your name spread fast.
TikTok	TikTok account hacked	Videos and messages reach your audience quickly.
YouTube	YouTube channel hacked	Hijacked channels are often renamed to stream crypto scams.
Snapchat	Snapchat hacked	Friends trust messages that appear to come from you.
Discord	Discord account hacked	Often used to spread scam links through servers.
WhatsApp	WhatsApp hacked: how to recover	Hijackers message your contacts asking for money.
LinkedIn	LinkedIn account hacked	Your professional reputation and network.
Reddit	Reddit account hacked	Spam and scam posts under your username.
Amazon	Amazon hacked	Saved cards, orders and gift card balances.
eBay	eBay account hacked	Fake listings and purchases under your seller name.
PayPal	PayPal account hacked	Direct access to money and linked bank accounts.
Venmo	Venmo account hacked	Payments to strangers are hard to reverse.
Cash App	Cash App account hacked	Balance, Cash Card and linked bank.
Roblox	Roblox account hacked	Robux, limited items and a child’s friends list.
Steam	Steam account hacked	Game library, inventory items and wallet funds.
Xbox	Xbox account hacked	Game library, Game Pass and saved payment methods.
PlayStation	PlayStation account hacked	Wallet funds, purchases and console sign-ins.
Epic Games	Epic Games account hacked	Linked consoles, V-Bucks and saved cards.
Fortnite	Fortnite account hacked	Skins and V-Bucks, often on a child’s account.
Minecraft	Minecraft account hacked	Signs in with a Microsoft account.
Spotify	Spotify account hacked	Playlists, profile and a paid plan.
Coinbase	Coinbase account hacked	Crypto transfers are very hard to reverse.
Your bank	Bank account hacked	Savings, cards and payments.
A business page or brand account	Hacked Facebook page and business accounts	Customers see whatever the hacker posts.

If you’re thinking “my google account was hacked”, treat it as an email emergency, because Google usually controls your Gmail, your Android phone and every service where you use “Sign in with Google”. Likewise, if you’re thinking “my amazon account was hacked”, check your saved payment methods and orders first, then your email.

How to tell if it’s really a hack

Not every scary message means you’ve been hacked. Before you panic, check which of these you’re dealing with.

• A real takeover: your password no longer works, details were changed, or posts and messages appeared that you didn’t send.
• A failed attempt: you got a login code or “new sign-in” alert but nothing changed. Someone may have your password. Change it and turn on two-step verification, but you’re probably still in control.
• A phishing message: an email or text says your account is locked and links to a login page. This is the attack itself, not a sign you were already hacked. Don’t click it; go to the site yourself.
• An extortion email: a message claims someone hacked your device and recorded you, often quoting an old password. Most of these are bluffs built from breach data. See our guide to the “you’ve been hacked” email scam. If you see real signs someone is using your camera, see our guide to a hacked webcam.

A worked example

This is an illustrative scenario, not a real client. Theo, a freelance photographer, wakes to find he can’t log into Instagram and friends are asking why he’s promoting a crypto scheme. His first instinct is to hammer Instagram’s login page.

Instead he checks his email. He’s still in, but he finds a forwarding rule sending copies of every message to an unknown address, and an Instagram email saying his account email was changed. He deletes the rule, changes his email password, turns on app-based two-step verification and signs out of all other sessions.

Then he uses the link in Instagram’s genuine email to reverse the change, and follows Instagram’s recovery route. Once back in, he deletes the scam posts, removes an unknown connected app and posts a short note from his account and his website saying he was hacked and asking people to ignore messages sent that morning. He had reused the same password for a print shop account, so he changes that too.

After you’re back in: clean up the damage

Getting the account back is half the job. The other half is dealing with what the hacker did while they had it.

• Delete posts, stories, messages and comments the hacker created, and screenshot them first if you may need evidence.
• Tell your contacts plainly what happened and which messages to ignore. A short, calm note is enough.
• Check money-linked accounts: banking, PayPal, Amazon, app stores. Report unauthorized transactions to the platform and your bank quickly.
• Report fake accounts the hacker may have set up in your name. Our guide to online impersonation covers reporting.
• Search your name in a private browser window to see whether anything posted during the hack is showing up in search results.
• Watch for identity theft if the account held personal documents, your date of birth or your Social Security number. Our guide on what to do if your identity is stolen explains credit freezes and the FTC report.

If a hacked account was used to post damaging content that’s now circulating or ranking for your name, our social media reputation management team can help contain it, and personal reputation management covers cleanup of search results about you.

Common mistakes to avoid

• Fixing the social account before the email. The hacker gets straight back in.
• Clicking the “secure your account” link in the message that started it.
• Paying anyone who promises to recover the account.
• Using a slightly changed version of your old password. Attackers try those variations.
• Leaving connected apps and sessions in place. A third-party app with access can keep posting even after a password change.
• Staying silent. Contacts who don’t know you were hacked are the people most likely to be scammed next.

How to protect every account going forward

• Use a password manager and a unique password for every account.
• Turn on two-step verification everywhere that offers it, starting with email, banking, your phone carrier and social media. Use passkeys where available.
• Put a PIN or port-out protection on your mobile carrier account.
• Check whether your email appears in known breaches with Have I Been Pwned.
• Keep recovery phone numbers and backup emails current, so official recovery works when you need it.
• Be suspicious of any message asking for a code, a password or a quick login, however official it looks.

Frequently asked questions

What is the first thing to do if my account was hacked?

Secure your main email account first, because it receives password resets for everything else. Then use the hacked platform’s official recovery route, change the password to a new unique one and turn on two-step verification.

Can a hacked account always be recovered?

Not always. Most platforms can restore access if you can verify you own the account, for example through your original email, phone number or identity checks. If the hacker changed everything and you have no proof of ownership, recovery can be slow or unsuccessful, which is why keeping recovery details current matters.

Should I report a hacked account to the police?

For most social media takeovers, reporting to the platform is the main step. If money was stolen, you’re being extorted or threatened, or your identity is being used for fraud, report to your bank and local police, and in the US you can also report to the FBI’s Internet Crime Complaint Center (IC3).

How did my account get hacked?

The most common causes are phishing (a fake login page or message), a password reused from a site that was breached, malware on a device, or a SIM swap that lets someone receive your text codes. Knowing which one helps you close the right door.

Should I delete my account after it was hacked?

Usually it’s better to recover and secure it. Deleting can make it harder to prove the account was yours, and a deleted username may be taken by someone else. Delete only once you’ve recovered it and decided you no longer want it.