What to do if you get hacked
A calm, ordered recovery plan for a hacked email, social media, bank or device. Work through the steps in this order so the attacker cannot get back in.
First, breathe and use a clean device
Getting hacked feels personal and urgent, but a few minutes of calm planning beats an hour of panicked clicking. If you suspect the computer or phone itself is infected (strange pop-ups, programs you did not install, security software switched off), do the account recovery steps below from a different device you trust, such as a family member's phone or a freshly updated computer. Changing passwords on an infected device can hand the new passwords straight to the attacker.
The recovery order
Work from the most powerful account down. Email comes first because it can reset everything else.
| Order | Account | Why |
|---|---|---|
| 1 | Main email | Controls password resets for nearly everything |
| 2 | Password manager | Holds every other password |
| 3 | Apple ID, Google or Microsoft account | Controls devices, backups, and often email |
| 4 | Banking, cards, payment apps | Money moves fast |
| 5 | Phone carrier account | Protects against SIM swapping |
| 6 | Social media and messaging | Used to scam your contacts |
| 7 | Shopping and everything else | Saved cards, gift balances, loyalty points |
For each hacked account
- Regain access through the official recovery page. Type the site's address yourself; never use links from messages offering "recovery help".
- Set a new, unique password generated by a password manager.
- Sign out every other session in the security settings.
- Turn on two-factor authentication or add a passkey. See 2FA and passkeys.
- Check what the attacker changed: recovery email and phone, forwarding rules, connected apps, trusted devices, saved addresses and payment methods. Remove anything that is not yours.
- Look at recent activity: sent messages, posts, orders, transfers. Note anything you need to dispute.
Attackers often add a hidden email forwarding rule or a second recovery address so they can return later. Changing the password without removing these leaves the door open.
If money is involved
- Call your bank or card issuer immediately using the number on your card. Ask them to block cards, stop pending payments and flag the account.
- Dispute fraudulent charges in writing as soon as possible. US consumer protection rules give stronger rights to people who report quickly.
- Never pay "recovery agents" who contact you offering to get the money back for a fee. That is a second scam.
If the device is infected
- Disconnect it from the internet.
- Run a full scan with the built-in antivirus (see malware types).
- Back up personal files only (documents and photos, not programs).
- If problems continue, reset the device to factory settings and restore personal files.
- Install all updates before signing back into accounts.
Tell the right people
- Warn your contacts that messages from you during the hack were not genuine.
- Work account or work device? Tell your IT or security team right away. Fast reporting limits damage, and good teams do not blame people for reporting.
- Report the crime: in the US to the FBI's IC3 (ic3.gov) and the FTC (ReportFraud.ftc.gov, or IdentityTheft.gov if your identity was misused). In the UK, Action Fraud.
- If personal data was taken (ID numbers, date of birth), consider a credit freeze.
Afterward: find the cause
Ask how it happened so it does not happen again. The most common causes are a reused password from an old breach, a phishing page, an infostealer from a fake download, or SMS codes stolen through a SIM swap. Fix the cause, then set a reminder to review your security settings again in a month.