Account hacked: how to get it back and lock it down

Signs your account has been hacked

The UK's National Cyber Security Centre (NCSC) and the US Federal Trade Commission (FTC) list the same warning signs:

• you can't sign in, because someone has changed the password, email address or phone number,
• friends or family get messages or links you never sent – often asking for help or money,
• you get an alert about a sign-in from a device or place you don't recognise, or about a security change you didn't make,
• there are posts or messages on your profile you didn't write,
• money has been spent or moved without your permission.

1. Get back in – only through the official route

If you can still sign in, go straight to step 2. If you can't, use the recovery process run by the service itself. Type the address yourself; don't look for "support" in ads or on social media. Offers to "recover your account for a fee" are usually just another scam.

• Facebook: if the attacker changed the email address on the account, Facebook sends a message with a special link to the old address so you can undo the change. Check your previous inbox.
• Google: if Google spots a suspicious sign-in or recovery method, it disables it and tells you. You then have 30 days to confirm that you added it yourself; otherwise Google deletes it.
• If recovery fails and you still need the service, the NCSC suggests opening a new account, telling your contacts the old one is abandoned and updating your bank and shopping accounts with the new details.

2. Kick the attacker out: password, devices, two-step verification

1. Change the password to a new one you've never used anywhere else. A long passphrase of several random words is strong and easy to remember – you can create one with our password generator.
2. Sign out every device and app you don't recognise. Google lists them under Your devices; on Facebook it's Where you're logged in in the settings. When in doubt, sign out everything except the device in your hand – anyone else will then need the new password.
3. Turn on two-step verification (a code from an app or a prompt on your phone). The NCSC, the FTC and Google all recommend it: even with your password, the attacker can't get in. Do your email and bank accounts first.
4. Review recent security events. Google shows them under Security & sign-in. Anything you didn't do, mark as "No, it wasn't me" and follow the prompts.

3. Find the backdoors the attacker left behind

A careful attacker sets things up so they can get back in even after you change the password. Google and the FTC recommend checking:

• the recovery phone number and email – are they really yours?
• forwarding, filters and delegation in your email – the NCSC warns that attackers forward your mail to themselves so they can reset your other passwords, and a filter can quietly delete security alerts,
• sent and deleted mail – to see who was contacted in your name and what was said,
• apps with access to your account and browser extensions – remove anything you don't recognise,
• payments (Google Pay, Google Play and similar) – report charges you didn't make and remove unknown payment methods.

On social media, also look for posts, messages and new friends you don't recognise.

4. Change your passwords elsewhere – especially where they were the same

• If you used the same password on other sites, change it there too. Google adds sites that contact you at the hacked email address or let you sign in with it.
• Email comes first. The NCSC calls it the gateway to your other accounts: whoever controls your email can reset the password for almost everything else – your social media, online shops and more. Give it a strong password you use nowhere else.

5. Check your device

Your password may have leaked through a phishing page, a data breach at another service – or malware on your computer or phone. The FTC recommends updating your security software, running a scan, deleting anything suspicious and restarting. The NCSC adds: install system and app updates and switch on automatic updates. As a last resort, Google suggests backing up your files and resetting the computer to factory settings. Until you're sure the device is clean, change passwords from another one.

6. Warn your contacts – another way

Tell friends, family and followers that your account was hacked, so they treat recent messages from it with suspicion. The FTC suggests telling them not to click links and to ignore requests for help or money. If the attacker may still have access, use a different channel – a text, a call or a post from another account – rather than the hacked one.

7. Check your money and report it

• Your bank: look for transactions you didn't make in your bank and shopping accounts. Contact the bank through its official app, website or the number on your card – not via links in messages.
• The service: report the hack to the provider, even if you've already got the account back.
• The police: if you lost money or someone is blackmailing you, report it. In the UK, that's Report Fraud (in Scotland, call the police on 101); in the US, the FBI's Internet Crime Complaint Center (IC3). Elsewhere, contact your local police. Keep screenshots, security alert emails and the scam messages – don't delete anything.