What to do if an account gets hacked
If an account gets hacked, reset the password from a device you trust through the company's own website or app, never a link in a message. Next, log out every other session and add two-step login. Look for anything the intruder changed: recovery email and phone, forwarding rules, linked apps and payment details. Then warn your contacts and change that password anywhere you reused it.
About 15 minutes to learnTake care: injury or damage if careless
Mark it once you can do it without this page open.
How to do it
- Pick up a computer or phone you know is clean, and type the company's address in yourself.
- Reset the password, or use the company's account recovery form if you are locked out.
- Choose log out of all other sessions or devices in the security settings.
- Turn on two-step login and save new recovery codes.
- Check and fix the recovery email, recovery phone, mail forwarding, linked apps and saved payment methods.
- Change the same password on every other account where you used it.
- Tell your contacts to ignore recent messages from that account asking for money or codes.
- Watch your bank and card statements for the next month.
Stop and call a professional if
- The hacked account holds payment details or is linked to your bank: call the bank's number from your card and watch for new charges.
- Someone is using the account to threaten or blackmail you: report it to the platform and local police, and keep screenshots.
Common mistakes
- Resetting the password from the attacker's own lookalike email.
- Changing the password but leaving the attacker's recovery phone in place.
- Forgetting the other accounts that shared the same password.
Quick self-check
Three questions. Your last score is kept in this browser.
Teach this to someone
A one-page sheet for showing a friend, a roommate or a kid: what to say, what to show, and one question to check it landed.
Teach: What to do if an account gets hacked
What to say
If an account gets hacked, reset the password from a device you trust through the company's own website or app, never a link in a message. Next, log out every other session and add two-step login. Look for anything the intruder changed: recovery email and phone, forwarding rules, linked apps and payment details. Then warn your contacts and change that password anywhere you reused it.
What to show, in order
- Pick up a computer or phone you know is clean, and type the company's address in yourself.
- Reset the password, or use the company's account recovery form if you are locked out.
- Choose log out of all other sessions or devices in the security settings.
- Turn on two-step login and save new recovery codes.
- Check and fix the recovery email, recovery phone, mail forwarding, linked apps and saved payment methods.
- Change the same password on every other account where you used it.
- Tell your contacts to ignore recent messages from that account asking for money or codes.
- Watch your bank and card statements for the next month.
When to stop and call a professional
- The hacked account holds payment details or is linked to your bank: call the bank's number from your card and watch for new charges.
- Someone is using the account to threaten or blackmail you: report it to the platform and local police, and keep screenshots.
The check question
Ask: How should you reach the password reset page?
Related skills
- How to turn on two-step login
- How to start using a password manager
- What to do if your identity is stolen
- Every skill in Tech and Digital Safety
Words on this page
Sources
- National cybersecurity agency guidance for home users, 2026. Checked September 28, 2026.
Last reviewed . First published .