Lockwell

If your account was hacked

Someone got into your account. Get back in through the official route, sign them out, check what they changed and warn the people they could reach.

  • 40 min
  • 10 steps
  • Reviewed

If someone got into one of your accounts, work through the items in order. The seven Essential items are the ones to do today. Do them from a device you trust: if you think your phone or computer itself has something installed on it, read Check the phone or computer first, or use another device. Not every account can be recovered. Some companies can't help if every recovery method is gone, so act quickly.

Essential

Companies send alerts when something changes in your account. A change you didn't make is the clearest sign.

All accounts

  1. Your password no longer works.
  2. You get an alert about a sign-in, a new device, or a change to your password, email address or phone number that you didn't make. Or you get a login code you didn't ask for.
  3. You find messages, posts or sent emails you didn't write, or friends say they got strange messages from you.
  4. Emails are missing and aren't in Trash, or new email has stopped arriving.
  5. Your recovery phone number or email address, your name, your profile picture or two-step verification was changed.
  6. You see purchases or payments you don't recognise.
  7. On Apple: your device was locked or put into Lost Mode by someone else.
Essential

If you can still sign in, skip to the next item. If you can't, use the company's own recovery page.

Google

  1. Go to accounts.google.com/signin/recovery and answer the questions as best you can.
  2. A wrong answer doesn't end the process. You can try as many times as you need.

Apple

  1. If someone changed your password, reset it. If you can't reset it or sign in, start account recovery at iforgot.apple.com.
  2. Recovery can take several days or longer. Apple Support can't shorten the wait. Don't send a second request: it can make the wait longer.
  3. If you started recovery on the web, turn off all your Apple devices while you wait. Using a device that is signed in to your account cancels the request. If you started it on an iPhone or iPad with iOS 17 or iPadOS 17 or later, or a Mac with macOS 27 or later, you can keep using that device.
  4. After the time shown in the confirmation email, go to apple.com/recover.

Microsoft

  1. On the Microsoft sign-in page, select Forgot my password, then I think someone else is using my Microsoft account.
  2. If that doesn't work, fill in the recovery form. Microsoft suggests trying its Sign-in Helper first, because the form can take time. You need a working email address to receive the answer; a friend's address will do. Microsoft says it replies within 24 hours.
  3. If two-step verification was on and you can't use any of your methods, Microsoft says it can't help. This is why saved backup codes matter: see Make sure you can get back in.

Facebook

  1. On a device you have used to log in to Facebook before, go to facebook.com/hacked.
  2. If your email address was changed, look in the old mailbox. Facebook sends a message there with a link that reverses the change.
  3. If you can't use your email or phone number either, go to facebook.com/login/identify on that device and select No longer have access to these?. If you don't see it, look for Forgot account? or Recover. You will need an email address or phone number that has never been used on your Facebook account.

Instagram

  1. In a browser, go to instagram.com/hacked.
  2. If you got an email saying your email address was changed, Instagram sends it from security@mail.instagram.com. Select secure my account in that email to undo the change.
  3. You may be asked for a short video selfie. Instagram says it is never shown on Instagram and is deleted within 30 days.

WhatsApp

  1. Put the SIM card with your number in your phone, open WhatsApp and tap Log back in → Continue. Enter your number and the 6-digit code you get by SMS or call. This signs out every other device.
  2. Entering the 6-digit code signs the other person out, even if they set a two-step PIN. Without that PIN, you will have to wait 7 days before you can use the account again.
  3. Changing your password or PIN doesn't remove them. Only registering again with the 6-digit code does.
  4. WhatsApp can't return an account without a SIM card with the same number.
  5. If they registered your number on their own phone, WhatsApp says they can't read your past chats. If they linked a computer or browser to your account, it received a copy of your recent chats. While they have the account, new messages to you go to them, and they can write as you.
Essential

If the device you use is infected, the new password can be stolen too. Microsoft tells you to scan your computer before you change the password.

All accounts

  1. Use a device you trust. If you aren't sure about yours, first follow Check the phone or computer, or use another device.
  2. If it is an email account, first turn off forwarding you didn't set up: see Remove forwarding and filters. A forward can let the other person reset your new password.
  3. Set a new password that you don't use anywhere else. A password manager can create one, or use the password generator.
  4. Then change the password on every account where you used the same one.
  5. If it was your email account, also change the passwords of accounts that use this email address to sign in. Whoever controls your email can reset them.
  6. If the account stored your other passwords, as a Google Account can, change those too.
Essential

Changing the password doesn't always sign out a phone or computer that is already logged in. Check the list and sign out what isn't yours. If you aren't sure, sign out all of them except the one you are using.

All accounts

  1. For Google, Apple, Facebook, Instagram and Microsoft, follow Sign out of devices you don't recognise.
  2. In WhatsApp, Telegram and Signal, check the linked computers and browsers: see Check which devices are linked.

Google

  1. In your Google Account, open Security & sign-in.
  2. In the Recent security events panel, select Review security events.
  3. For any event you don't recognise, select No, it wasn't me.
Essential

Attackers often set a rule that sends them a copy of all your email. With it, they can reset your passwords again even after you change them. Other rules delete or hide messages so you don't see the alerts.

Gmail

These steps are for Gmail on a computer.

  1. Open Gmail and click Settings, then See all settings.
  2. Open the Forwarding and POP/IMAP tab (in some accounts it is called Forwarding). If forwarding is on and you didn't set it up, click Disable forwarding, then Save Changes.
  3. Open Filters and Blocked Addresses. Delete every filter you didn't create, especially those that forward, archive or delete mail.
  4. Google also tells you to check who has access to your Gmail (mail delegation), the vacation responder and the name on outgoing mail.

Outlook

  1. On Outlook.com, select Settings → Mail → Forwarding (on some accounts Forwarding and IMAP). If forwarding you didn't set up is on, turn it off (clear Enable forwarding, or select Disable forwarding), then select Save.
  2. Open Settings → Mail → Rules and remove every rule you didn't create, especially those that use Forward to, Forward as attachment or Redirect to.
  3. Mail sent on by Redirect to looks as if it came from the original sender, not from you.
  4. Microsoft also tells you to check connected accounts and automatic replies.

Other email

  1. Look in your email settings for forwarding, filters, rules and automatic replies, and remove anything you didn't set up.
Essential

If the other person added their own phone number or email address, they can use it to take the account back later.

All accounts

  1. Open your account's security settings and check the recovery phone number, the recovery email address and any other email address on the account. Remove anything you don't recognise. The paths are in Make sure you can get back in.
  2. Check that two-step verification is still on and that every phone and app listed is yours.
  3. On Google, for up to 7 days after you change recovery details, codes may still go to the old ones, including any the other person added. Watch your security alerts closely that week. Security Checkup shows what needs attention.
  4. Apple suggests asking your mobile operator whether SMS forwarding has been set up on your number.

Instagram

  1. Check that the phone number and email address in your settings are yours.
  2. In Accounts Center (or Meta Account settings), remove any linked account and any app you don't recognise.
Essential

Whoever had your account could write to your contacts and groups as you.

All accounts

  1. Tell your contacts, friends and followers that your account was hacked, and ask them to treat recent messages from it with suspicion. If you don't have the account back yet, use another app.
  2. On WhatsApp, warn your groups too.
  3. If you can't get the account back, create a new one. Give your contacts the new details and tell them you have left the old account. Update your bank, utility and shopping accounts with the new details.
Recommended

A hacked email account often leads to other accounts. This matters most if cards were saved in the account, or if it held passport or tax documents.

All accounts

  1. If cards were saved in the account, or you think someone is using your name, call your bank. Use the number on your card or in the bank's app, never a number from a message.
  2. Block the card in your bank's app if it lets you.
  3. Check your statements for payments you don't recognise in the coming weeks.
  4. For purchases on Google Play or Google Pay that you didn't make, Google lets you report them and ask for a refund.
  5. If you lost money, tell your bank and report it to the police.
Recommended

If something was installed on your device, it may see your new passwords. Check the device, then change the passwords again if you find anything.

iPhone

  1. Install the latest update: see Install updates automatically.
  2. Open Settings → Privacy & Security → Safety Check (you may need to scroll down). It needs iOS 16 or later and two-factor authentication.
  3. Manage Sharing & Access shows which people and apps you share with, and lets you stop. Emergency Reset stops all sharing at once and lets you review your devices and change your Apple Account password.
  4. Safety Check doesn't cover accounts and passwords outside Apple. If you stop sharing with someone, they may notice.
  5. Delete apps you don't recognise.

Android

  1. Install the latest update: see Install updates automatically.
  2. Open the Google Play Store app, tap your profile icon, then Play Protect, then the settings icon. Check that Scan apps with Play Protect is on.
  3. Delete apps you don't recognise.
  4. If you still think the phone is infected, a factory reset erases everything on it. Back it up first and make sure you know your Google Account password. If you just reset your Google Account password, wait 24 hours before a factory reset.

Computer

  1. Install the latest updates: see the computer guide.
  2. On Windows, open Windows Security → Virus & threat protection, then Scan options → Full scan → Scan now.
  3. In your browser, remove extensions you don't recognise: see Keep extensions few and trusted.
  4. Google says you can also reset the computer to factory settings and reinstall the operating system.
Recommended

Reporting can help the company stop the account being used against others. Take screenshots of the messages, alerts and dates first, in case they disappear.

All accounts

  1. Report through the recovery pages in Get back in through the official route.
  2. On WhatsApp, recover the account before you report it. WhatsApp says that if you report the account you are trying to recover, it may ban it, and you could lose the account and its data.
  3. If you lost money, someone is using your name, or you are threatened, report it to the police. The Ministry of Internal Affairs lists its contacts on police.ge. In an emergency, call 112.