Hacked Account

1. Has the account really been hacked?

Answer the questions honestly. If multiple warning signs apply, treat the account as compromised just to be safe — without claiming absolute certainty.

2. Secure Your Main Account First

Your email, Apple, or Google account is often the key to many other accounts. If this account is compromised, someone can reset passwords for other services.

• Open the official account directly (app or website of the provider)
• Change your password
• Log out of unknown sessions
• Check recovery information
• Enable two-factor authentication
• Review forwarding rules and filters

When checking email accounts, also look for automatic forwarding, filters, and rules. Attackers sometimes use these to read or hide security messages.

3. Use Official Account Recovery

If you can’t log in, only use the official recovery feature from the provider.

• Select the affected platform
• Open the official recovery page or app (not through chat links)
• Verify your identity as instructed by the provider
• Recover access or document your support case
• Do not pay for 'account recovery services' from direct messages

Paid 'recovery experts' in direct messages are often scammers.

4. Change Passwords in the Right Order

If a password was reused, all affected accounts need a new, unique password.

• Changed the main email account
• Updated password manager
• Changed Apple or Google account
• Changed payment services
• Changed accounts with the same or similar password
• Changed remaining important accounts

Do not use any variation of the old password. Do not enter real passwords on this page. Do not share passwords via message. Use a password manager whenever possible.

5. Log Out of Unknown Devices and Sessions

Changing your password isn’t always enough. Some services may keep existing sessions active.

• Open active sessions
• Check for unknown devices
• Log out of all unrecognized sessions
• Remove old devices
• Check connected browsers
• Revoke app passwords
• Log back into known devices if necessary

6. Check Recovery Information

Attackers often change your email, phone number, or backup codes to lock you out permanently. Do not enter these values here — only check them with the provider.

• Checked recovery email
• Checked phone number
• Checked or regenerated backup codes
• Checked trusted devices
• Checked emergency contact
• Checked security questions
• Checked passkeys
• Checked hardware security keys

Immediately remove unknown email addresses, phone numbers, passkeys, or devices. Generate new backup codes if old codes may have been exposed.

7. Review Connected Apps and Access

An attacker can still have access through a connected app or granted permissions.

• Checked apps with account access
• Checked browser extensions
• Checked social logins
• Checked third-party tools
• Checked games and bots
• Checked calendar or contact access
• Checked cloud storage
• Checked payment connections
• Revoke unknown or unnecessary connections

8. Enable Additional Account Protection

Two-factor authentication makes it harder for someone to access your account with a stolen password.

• Chosen preferred method (passkey / security key / authenticator over SMS)
• Set up recovery method
• Stored backup codes securely
• Never share confirmation codes
• Reject unknown login confirmations

A support representative will never need your one-time code to 'secure' an account.

9. Warn Your Contacts

Inform close contacts first. Do not forward suspicious links and share only what is necessary publicly.

• Informed close contacts
• Did not forward suspicious links
• Informed group admins (if relevant)
• Involved school or employer if relevant accounts are affected
• Shared only what is necessary publicly

10. Review Payments, Purchases, and Subscriptions

Check purchases, saved cards, wallets, and subscriptions — and block cards through the bank if needed.

• Checked saved cards
• Checked wallets
• Checked in-app purchases
• Checked subscriptions
• Checked digital currencies
• Checked order history
• Checked advertising accounts
• Checked in-game purchases
• Checked transfers or payment links

Do not accept refunds through a link sent by an unknown contact. If you notice unknown activity: block your card, contact the payment provider, report the platform, and keep receipts.

11. Report Account Takeover

Report the account takeover through the official support channels of the platform. For fraud, extortion, or child endangerment, also use helplines and possibly contact the police.

• Used official platform reporting
• Marked account as hacked (if available)
• Completed identity verification if required
• Reported suspicious messages
• Reported fake or substitute profiles
• Documented the incident (without passwords or codes)

12. Check Device and Browser

If login details are misused again despite changing the password, the device or browser may also be affected.

• Updated operating system
• Updated apps
• Removed unknown apps
• Checked browser extensions
• Performed security check
• Checked downloads
• Checked notification permissions
• Reviewed saved passwords

Use the security features of your operating system or established professional help. Do not download unknown 'cleanup' software.

Special Cases

Depending on the type of account, there are additional focuses. Open the relevant section.

Check again after 24 hours

Check the next day to see if access is stable and if any new suspicious activities appear.

• Are there any new login alerts?
• Have unknown devices been removed?
• Have any new messages been sent?
• Are there any additional purchases?
• Do recovery options and 2FA work?
• Are other accounts affected?

Check Again After 7 Days

Check your security status and any open reports again after a week.

• Are there any new login alerts?
• Have unknown devices been removed?
• Have any new messages been sent?
• Are there any additional purchases?
• Do recovery options and 2FA work?
• Are other accounts affected?