Friends are getting odd messages from “you”, or you can’t log in at all. Having an account hacked is stressful, but what you do in the first hour makes a big difference. Here’s the order to work through it.
Start with email — it’s the master key
Your email can reset the password on almost everything else, so secure it first.
- Reset your email password from a device you trust. Make it long and unique.
- Turn on multi-factor authentication so a stolen password alone isn’t enough next time.
- Check for sneaky changes attackers leave behind: forwarding rules sending your mail elsewhere, added “recovery” phone numbers or email addresses, and new app passwords. Remove anything you don’t recognise.
- Sign out all other sessions (most services have a “log out everywhere” button).
Then the account that was hit
- Facebook/Instagram: use Facebook’s “I think my account was hacked” recovery flow, change the password, remove unknown logins, and check that the linked email and phone are still yours.
- Banking or accounting: call the provider directly and tell them. Watch for transactions you didn’t make.
Clean up and warn people
- Change the password on any other account that shared the same password — then stop reusing passwords (a password manager makes this easy).
- Let contacts know not to click links “you” sent while compromised.
- Run a security scan on your device in case malware captured the password.
Why it keeps happening
Most account takeovers start with a reused password or a convincing scam email, not clever hacking. Multi-factor authentication and unique passwords stop the vast majority.
If you’re locked out, not sure the account is really clean, or a business mailbox has been breached, get in touch. We’ll help you lock it down properly and check nothing’s been left behind.