Got Hacked? What to Do First, Step by Step

It usually starts with a text from a friend. "Did you just send me this?" Or an email saying your password was changed, when you're sitting on the couch and definitely didn't change anything. Then the stomach drop.

First thing: breathe. Most hacked accounts can be recovered, and the faster you move, the easier it is. Second thing: don't let panic make the next mistake for you. The people who "help" you in a panic (a number from a search ad, a stranger in your DMs offering to recover your account for a fee) are very often running the second half of the scam.

Signs it's actually a hack

• You can't log in, or your password suddenly "stopped working."
• You got an email or text saying your password, email address or phone number changed, and it wasn't you.
• A sign-in alert from a device or a city you don't recognize.
• Friends are getting messages, links or requests for money from you that you didn't send.
• Your sent folder has emails you didn't write, or it's suddenly empty.

Step 1: Use a device you trust

If you think your computer itself is infected (pop-ups that won't quit, a program you didn't install, someone had remote access), do the steps below from your phone or another computer. Deal with the infected one in Step 6.

Step 2: Get back in

If you can still log in, do these right now, in this order:

1. Change the password to a new one you've never used anywhere.
2. Sign out of all other devices. Look for "Sign out of all sessions," "Where you're logged in" or "Your devices," and kick everyone else out.
3. Turn on two-factor authentication if it wasn't on already. (Our two-factor guide walks through it.)

If you're locked out, go to the company's official recovery page. Type it yourself or use the links below. Don't search for a phone number and call whatever comes up first.

Recovery can take a few tries and sometimes a few days. Use a device and Wi-Fi network you've used with that account before. It helps the company recognize you.

Step 3: Close the back doors

Hackers like to leave themselves a way back in, so changing the password isn't the end of it. Once you're in, check:

• ☐ Recovery email and phone number. Change back anything that isn't yours.
• ☐ Email forwarding, filters and rules. A favorite trick is quietly forwarding your mail to the hacker, or auto-deleting alerts from your bank. Delete any rule you didn't make.
• ☐ Two-factor settings. Make sure the phone or authenticator on file is actually yours.
• ☐ Connected apps and devices. Remove anything you don't recognize.
• ☐ Email signature and auto-reply. Check that no one added a link.
• ☐ Social accounts: posts or messages you didn't send, new admins on your business page, ads or payment methods that weren't there before.

Step 4: Change it everywhere you reused it

If that password (or a close cousin of it, like the same word with a different number) is used anywhere else, change those too. Start with email, banking and anything with a saved card. This is the moment a password manager starts paying for itself.

Step 5: Warn people and protect your money

• Tell your people. Text or post that you were hacked, and tell friends, family and customers to ignore any message from you asking for money, gift cards, codes or clicks.
• Call your bank or card company if any money accounts were touched, using the number on the back of your card.
• Phone suddenly has no service ("SOS only") and you didn't change anything? Your number may have been moved to someone else's phone. Call your carrier from another phone right away.
• Personal info like your Social Security number might be out there? Go to IdentityTheft.gov for a recovery plan, and think about freezing your credit with Equifax, Experian and TransUnion. It's free.
• Report it at ReportFraud.ftc.gov.

Step 6: Clean up the computer

If the hack started with something you clicked or installed, update everything, then run a full scan with your security software (on Windows, that's Windows Security, which is already built in). Uninstall any remote-access app you didn't set up yourself. If you're still not sure the computer is clean, don't log into your important accounts on it until it's been checked.

Step 7: Figure out how it happened

• Put your email into haveibeenpwned.com. It shows whether that address turned up in a known data breach. If a site you used got breached and you reused that password, that's probably your answer.
• Think back. Did you type your password into a link from a text or email? Approve a sign-in prompt you didn't start? Read a code to someone on the phone?

No shame in any of it. These scams are built by people who do this all day, and they're good at it. The goal isn't to feel bad. It's to close the door they used.

Make this the last time

• ☐ A different password for every account (a password manager makes this easy)
• ☐ Two-factor or passkeys on email, Apple/Google/Microsoft, bank, social and business accounts
• ☐ Backup codes saved somewhere safe
• ☐ Your carrier's number lock turned on
• ☐ Automatic updates on, on every device

Want help?

If you're locked out, or you're not sure what they got into, don't sit on it. We'll work through recovery with you, check every account for back doors and lock things down so it doesn't happen again. Book a session and we'll start with the account that matters most.