Signs that an account may be compromised
Account takeovers are not always dramatic. Common signs include a password that suddenly stops working, security emails about a sign-in you did not make, a password reset you did not request, messages sent from your account that you did not write, unfamiliar purchases, or changes to your profile, email address or phone number.
Sometimes it turns out to be a mistake, such as a forgotten password or a glitch. But if you suspect a takeover, it is wise to treat it seriously and work through the steps below in order. The order matters because each step protects the next.
Step 1: Stay calm and use a safe device
Start from a phone or computer you trust. If you believe the device itself may have been compromised, for example because strange apps appeared or the phone behaves oddly, use another device for the account steps instead. Avoid clicking links in messages claiming to help you recover your account; go to the app or the service’s official website yourself.
Step 2: Secure your email first
Email is usually the key to everything else, because most services send password resets there. If the hacked account is your email, begin with the email provider’s recovery process. If it is another app, still check your email account now: look for sign-ins you do not recognize and any forwarding rules or recovery addresses that you did not add.
Change the email password to something long and unique, and turn on two-step verification if it was not already on. Until the email account is safe, resetting other passwords can simply hand the new passwords to the person who has access.
Step 3: Reset the password on the affected account
If you can still sign in, change the password immediately. If you cannot, use the service’s official “forgot password” or account recovery option. Choose a new password that you have never used anywhere else. A password manager makes this easy, and it avoids falling back into old habits of reusing something familiar.
Step 4: Sign out other sessions and remove unknown access
Most services have a list of devices or sessions that are signed in. Look for any that you do not recognize and sign them out, or choose the “sign out of all devices” option if one exists. Then check for:
- Third-party apps or connected services that you did not authorize, and remove them
- A changed recovery email address or phone number
- New forwarding or auto-reply rules
- Saved payment methods or shipping addresses that you did not add
Doing this after the password reset matters. If you sign out sessions first and the attacker still has the old password, they can just sign back in.
Step 5: Turn on stronger sign-in protection
Once you are back in, enable two-step verification if it was off. If the service supports passkeys, consider setting one up. Save any backup codes in a safe place. If you already used a second step and the account was still taken over, check whether the code was sent to a phone number you no longer control, or whether you were tricked into sharing it.
Step 6: Check for damage and contact the service
Look at recent activity: messages sent, posts made, purchases and subscriptions. If money was spent or a card was used, contact your bank or card provider promptly; they can often block a card or investigate unexpected charges. Report the takeover to the app’s support team through its official help pages, which can sometimes reverse changes and add protection.
If the account sent messages to your contacts, a short note warning them not to click links or send money is a considerate step, since those messages may have been scams.
Step 7: Change other passwords that matched
If you used the same or a similar password on other accounts, change them too, starting with the most important ones: email, banking and anything that stores payment details. This is the cost of reuse, and it is the reason a unique password for each account is recommended.
Step 8: Look at how it happened
Consider how the takeover might have occurred. Common causes include a reused password from an earlier data leak, a phishing message, or an app you installed outside the official store. Check your device for unfamiliar apps and make sure the system is up to date. If you suspect harmful software, remove the apps involved, and consider consulting the maker’s support for advice about resetting the phone as a last resort. Having a recent backup makes that much less stressful.
When recovery is not possible
Sometimes the attacker has changed all the recovery details, and the service cannot verify you. Some providers have identity verification forms that may take time and are not guaranteed to work. Keep records such as past receipts, the date you created the account and the device you used; they can help your case. Outcomes vary, and some accounts cannot be recovered, which is another reason to act early and keep recovery details current.
Afterward
When the immediate problem is over, keep an eye on your accounts for the next few weeks. Be wary of follow-up messages from someone claiming they can recover your account for a fee, since that is a common second scam.