Hacked account: what to do, step by step

Email, Facebook, Instagram or another account hacked? How to take back control, secure your other accounts and report the hack.

Someone has signed in to your account, changed your password or is sending messages as you? Act fast and in this order: every hour counts, especially for your email account.

1. Take back control of the account

• If you can still sign in: change the password immediately, then use the "sign out of all devices" option.
• If the password was changed: use only the service's official recovery process ("forgot password" or "my account was hacked" on the site or app). Never use a "recovery service" found on social media: they are almost always scams.

2. Check what the hacker changed

Hackers often leave a back door. Check:

• the recovery email address and phone number;
• forwarding rules and filters in your mailbox (a hidden forward to an unknown address is a classic);
• signed-in devices and apps allowed to access the account;
• saved payment methods.

3. Turn on two-factor authentication

With a code from an authenticator app (preferably rather than SMS), a stolen password is no longer enough. Start with your email account: it can reset all your other accounts.

4. Secure your other accounts

If you used the same password elsewhere, change it everywhere. Hacks often start with a password leaked by another site: check whether your address appears in a known breach, then read compromised password: how to respond.

5. Warn your contacts and report the hack

• Warn people close to you: the hacker may ask them for money or for a code received by text, pretending to be you.
• Report the hack to the service concerned.
• Report it to your country's cybercrime service, for example Action Fraud in the UK or cybermalveillance.gouv.fr in France.
• If you suffered a loss (money taken, blackmail, identity theft), file a police report.

What if the hacker accessed your data?

Assume that everything in the account (emails, attachments, contacts) may be reused. Watch out for phishing and, if it contained identity documents, read identity theft after a data breach.