Losing control of an account can be stressful, especially when it affects email, social media, banking alerts, or work systems. The good news is that account recovery usually follows a clear pattern. The faster you move, the better your chances of stopping further damage and restoring access.
This guide covers the practical steps that matter most after unauthorized access. It is written for recovery and defense, not for bypassing someone else's account security.
First signs an account may have been hacked
- Password reset emails you did not request.
- Login alerts from unfamiliar devices or locations.
- Changes to recovery email addresses, phone numbers, or MFA settings.
- Messages, purchases, or posts you did not make.
- Locked access even though your usual password should work.
Step 1: Try the official recovery flow first
Go directly to the platform's official account recovery page instead of using links from email or messages. Most major platforms already have dedicated workflows for compromised accounts. These may include password reset, identity verification, session review, and help requests.
If the issue started with email, work on that account first. Email access often controls password resets for other services.
Step 2: Reset the password and revoke active sessions
If you can still sign in, change the password immediately and sign out of other sessions or devices. Use a long unique password that is not reused on any other site. A password manager makes this much easier to maintain across many accounts.
If you suspect password reuse, update the same or similar passwords on related services as well.
Step 3: Lock down recovery settings and MFA
Check whether the recovery email, backup phone number, trusted devices, or authentication app settings were changed. Attackers often modify these details to keep access after the original owner notices something is wrong.
- Restore the correct recovery email and phone number.
- Enable multi-factor authentication if it is not already active.
- Replace MFA methods you do not recognize.
- Save new backup codes in a safe place.
Step 4: Review activity for follow-on damage
Compromised accounts often affect more than one service. Review sent email, direct messages, billing changes, connected apps, forwarding rules, and recent purchases. In email accounts, check whether new forwarding rules or filters were added to hide messages from you.
If you think the compromise involved email spoofing or impersonation, this guide on how attackers clone or spoof email addresses can help you understand the warning signs.
Step 5: Secure the device used to access the account
Sometimes the problem is not only the account. Malware, browser credential theft, or a compromised phone can expose new passwords as soon as you change them. Run security checks, review installed apps and browser extensions, and update the device before assuming the problem is solved.
When to contact the platform or request professional help
If the attacker changed recovery settings, triggered repeated takeovers, or gained access to business systems, you may need a deeper review. That is especially true when multiple accounts were affected or when inbox rules, admin changes, or payment updates appeared after the incident.
You can contact us for help reviewing suspicious account activity, and you can learn more about our team on the about us page.
Quick recovery checklist
- Use the official recovery page.
- Reset the password and sign out of other sessions.
- Restore recovery settings and enable MFA.
- Check sent items, forwarding rules, billing, and connected apps.
- Secure the device used to sign in.
- Monitor other accounts that may share the same email or password history.
Frequently asked questions
What should I recover first if several accounts were affected?
Start with the email account tied to password resets, then move to banking, cloud storage, work systems, and social accounts.
Should I change passwords on other sites too?
Yes, especially if you reused the same password or a close variation elsewhere.
Why do some accounts get taken over again after recovery?
Repeated takeovers often point to unchanged recovery settings, stolen session cookies, or a compromised device.