Discovering that someone has taken over your email, social media, cloud storage, or another online account can trigger an understandable urge to start changing passwords everywhere immediately. That may be necessary, but the order in which you respond matters.
- First, Work Out Whether the Account Is Actually Compromised
- If You Can Still Log In, Don’t Just Change the Password
- If You’re Locked Out, Use the Provider’s Recovery System
- Secure Your Email Before Almost Everything Else
- Check the Device You Were Using
- Find Out What the Hacker Actually Did
- Tell Your Contacts If the Hacker Impersonated You
- If Money Is Missing, Contact the Financial Institution Immediately
- Preserve Evidence Before You Delete Everything
- When Should You Report the Hack to Police or Cybercrime Authorities?
- If Your Identity Information Was Exposed, Treat It Differently
- Businesses Have Additional Legal Responsibilities
- Don’t Accidentally Destroy Evidence Your Business May Need
- Watch Out for the Second Scam
- The Incident Isn’t Over When You Get the Account Back
An attacker who still controls your email, device, recovery settings, or active sessions may simply regain access after you change the password. A better response is to contain the breach, remove the attacker’s access, understand what they changed, and then protect any other accounts that may now be exposed.
First, Work Out Whether the Account Is Actually Compromised
Not every unexpected security email means you’ve been hacked. Attackers frequently send fake “your account has been compromised” warnings specifically to frighten people into clicking phishing links.
Instead of using links contained in an unexpected message, open the service through its normal app or manually visit the website. Look for evidence such as unfamiliar logins, password changes you didn’t make, unknown devices, messages you didn’t send, changed profile information, purchases you don’t recognize, or security settings that have been modified.
Email accounts deserve particularly close inspection. Attackers sometimes create automatic forwarding rules so they continue receiving copies of your messages even after you believe you’ve removed them; the FTC specifically advises hacked-email victims to check for forwarding rules they didn’t create.
If You Can Still Log In, Don’t Just Change the Password
Changing the password is important, but stopping there can leave several doors open. Start by creating a completely new password that you have never used elsewhere, then review the account’s active sessions and sign out devices you don’t recognize.
Next, inspect the recovery email address, recovery phone number, two-factor authentication methods, trusted devices, connected applications, and API or app access where relevant. Attackers sometimes add their own recovery method before victims notice the compromise, allowing them to regain access later.
For an email account, also inspect forwarding rules, filters, deleted messages, sent mail, and any settings capable of silently redirecting messages. For social media, look for unknown posts, direct messages, linked business accounts, advertising accounts, newly authorized apps, and changes to the username or contact information.
If You’re Locked Out, Use the Provider’s Recovery System
If the attacker has already changed your password or recovery information, avoid paying anyone who claims they can “hack the account back.” Account-recovery scammers routinely target people who are already desperate to regain access.
Use the official recovery process provided by the platform. The FTC recommends first checking the device for suspicious software and then following the account provider’s recovery procedure when dealing with a hacked email or social-media account.
Recovery may involve confirming previous passwords, trusted devices, recovery addresses, phone numbers, identity information, or other account history. The exact process differs between providers, so be patient and provide accurate information rather than repeatedly guessing answers that might complicate automated recovery checks.
Secure Your Email Before Almost Everything Else
If several accounts may be affected, your primary email should usually become one of your highest priorities. Email is often the master key to the rest of your online life because password-reset messages for banking, shopping, social media, cloud storage, and many other services arrive there.
Once your email is secure, change passwords for accounts that reused the compromised password and for particularly sensitive services. Don’t simply modify LondonCoffee21 into LondonCoffee22; create completely different credentials and store them in a reputable password manager.
Enable multi-factor authentication wherever possible, preferably using phishing-resistant methods such as passkeys or FIDO security keys when supported. CISA notes that MFA dramatically reduces the likelihood of account compromise even when one credential is stolen.
Check the Device You Were Using
If you have no idea how the attacker obtained your credentials, consider whether the problem could be on your computer or phone rather than only inside the account. Malware, malicious browser extensions, information-stealing software, and fake applications can potentially capture credentials or authentication sessions.
Update your operating system, browser, applications, and security software, then run appropriate security scans. Review recently installed applications and browser extensions, particularly anything installed shortly before the compromise began.
Changing twenty passwords from a device infected with credential-stealing malware would be counterproductive. You could simply be handing the attacker twenty new passwords.
Find Out What the Hacker Actually Did
Regaining access is only half the job. You also need to understand what happened while somebody else controlled the account.
Check login history and security notifications, then inspect recent activity carefully. Look for purchases, password resets, new payment methods, changed addresses, messages sent to contacts, downloaded data, deleted files, newly connected applications, and anything else the attacker could have accessed.
If your email was compromised, search the inbox and trash for password-reset messages from other services. An attacker may have used the inbox to take over additional accounts and then deleted the evidence.
If the hacked account contained scans of passports, tax information, bank statements, customer records, medical information, or similar sensitive documents, treat the incident as potentially more serious than a simple password theft.
Tell Your Contacts If the Hacker Impersonated You
If an attacker used your email or social media account to contact other people, warn them. A short message telling contacts to ignore unusual messages, links, payment requests, cryptocurrency requests, or requests for authentication codes can prevent the breach from creating additional victims.
Do not feel embarrassed about notifying people. Attackers deliberately exploit trusted relationships because a fraudulent message from “you” is far more convincing than one from a stranger.
If the compromised account belongs to a business, notify whoever handles IT or security as quickly as possible. A single compromised employee account can sometimes provide a route into company systems, customer information, payment processes, or shared cloud resources.
If Money Is Missing, Contact the Financial Institution Immediately
If an attacker made purchases, transferred money, changed payment instructions, or obtained banking credentials, speed becomes particularly important. Contact the bank, card issuer, payment provider, cryptocurrency exchange, or other institution involved through its legitimate fraud channel.
Explain clearly that the transaction was unauthorized and ask what measures are available to freeze the account, block cards, recall or reverse transactions, and prevent further activity. The FTC advises victims of unauthorized bank withdrawals, card charges, and fraudulent transfers to contact the relevant financial institution immediately and request reversal where possible.
Do not wait for the hacked platform to finish investigating before contacting your bank. Financial recovery rights and deadlines can vary according to the payment method, institution, jurisdiction, and circumstances, so prompt notification can matter legally as well as practically.
Preserve Evidence Before You Delete Everything
When people regain control of an account, their instinct is often to erase the hacker’s messages and move on. If significant fraud, harassment, extortion, identity theft, business loss, or another crime has occurred, preserve evidence first.
Save screenshots and, where possible, original messages showing suspicious logins, email addresses, usernames, telephone numbers, transaction identifiers, cryptocurrency addresses, timestamps, changed settings, threatening messages, and fraudulent conversations. Keep copies somewhere safe and avoid editing them unnecessarily.
Also keep a simple timeline explaining when you first noticed the compromise, what actions you took, whom you contacted, and what financial loss occurred. That record can become useful when dealing with banks, platforms, insurers, employers, regulators, lawyers, or law enforcement.
When Should You Report the Hack to Police or Cybercrime Authorities?
A teenager guessing your streaming-service password and a criminal stealing thousands of euros through a compromised bank account are obviously not equivalent situations. Police or specialist cybercrime reporting becomes much more appropriate when the incident involves financial theft, extortion, stalking, threats, identity theft, serious impersonation, stolen sensitive data, business compromise, or continuing unauthorized access.
For victims in Greece, cybercrime complaints can be submitted electronically through gov.gr to the Hellenic Police Directorate for Cybercrime, including complaints involving violations of electronic communications. The Directorate for Cybercrime is the specialist Hellenic Police service responsible for investigating cybercrime requiring digital or technical investigation.
In the United States, identity-theft victims can report the incident through the federal IdentityTheft.gov process, which provides an individualized recovery plan. Other countries have their own police, cybercrime, consumer-protection, and identity-theft reporting procedures.
If Your Identity Information Was Exposed, Treat It Differently
A hacker learning your Instagram password is one problem. A hacker gaining your passport number, tax identifier, banking information, date of birth, address, and identity documents can become an identity-theft problem.
If enough identity information was exposed to create a meaningful risk of financial impersonation, monitor financial accounts and credit information available in your jurisdiction. In the United States, for example, consumers can place free credit freezes with the major credit bureaus, preventing new creditors from accessing the credit report and making it harder for criminals to open new accounts.
The appropriate protection differs significantly between countries because credit-reporting systems and identity-theft laws are not universal. Don’t blindly follow a US-focused recovery checklist if you live elsewhere; use the official consumer, banking, police, and data-protection procedures applicable to your country.
Businesses Have Additional Legal Responsibilities
This is where a hacked account can stop being merely an IT incident and become a legal compliance issue.
If a compromised employee, administrator, email, cloud, or business account gives an unauthorized person access to personal data belonging to customers, employees, or other individuals, the organization may have experienced a personal data breach.
Under the EU GDPR, organizations must assess the risk created by the breach. A controller generally must notify the relevant supervisory authority when the breach is likely to pose a risk to individuals’ rights and freedoms, and Article 33 establishes a notification framework that can require reporting within 72 hours after becoming aware of the breach. Where the breach is likely to result in a high risk to affected individuals, Article 34 can also require communication to those individuals without undue delay.
This does not mean every hacked company account automatically requires public notification. The obligation depends on what happened, what personal data was involved, whether the attacker actually accessed or exposed it, the safeguards protecting it, and the resulting level of risk. Businesses dealing with a potentially reportable incident should involve their data-protection, security, and legal professionals promptly rather than trying to make that determination casually.
In Greece, individuals can also submit complaints regarding alleged violations of personal-data law through the official data-protection complaint procedure.
Don’t Accidentally Destroy Evidence Your Business May Need
If a work account has been compromised, resist the temptation to immediately wipe devices, delete logs, or remove every suspicious file before security personnel have assessed the situation. Containment is essential, but preserving evidence may also be necessary for investigation, insurance claims, litigation, regulatory obligations, or law-enforcement cooperation.
Businesses should document when the incident was discovered, systems affected, information potentially accessed, actions taken, and how conclusions about risk were reached. GDPR breach-management guidance specifically emphasizes assessing and documenting personal-data incidents rather than simply fixing the technical problem and forgetting about it.
This is one reason serious business breaches should be escalated internally immediately. The employee who discovers the compromise should not be expected to personally decide whether the incident triggers regulatory notification.
Watch Out for the Second Scam
Victims are vulnerable immediately after an account takeover because they’re actively searching for help. Criminals know this and may pose as “account recovery experts,” cybersecurity investigators, platform employees, lawyers, cryptocurrency recovery services, or even law enforcement.
Be particularly suspicious of anyone who contacts you unexpectedly and guarantees they can recover an account or stolen money for an upfront fee. Never give a supposed recovery specialist your new password, authentication codes, recovery codes, cryptocurrency seed phrase, or remote access to your device simply because they claim to be helping.
Communicate with banks and technology platforms through contact methods you independently verify. If you decide professional legal or cybersecurity assistance is warranted, verify the person’s identity and professional credentials separately before sharing sensitive information.
The Incident Isn’t Over When You Get the Account Back
Once the immediate crisis is contained, work out how the compromise happened. If you reused a password, replace reused credentials; if phishing was involved, examine how the fake message convinced you; if malware is suspected, secure the affected devices; and if a recovery account was weak, strengthen it.
Then spend some time making the next attack harder. Set up passkeys or strong MFA, save recovery codes securely, remove unused connected applications, delete abandoned accounts you no longer need, and turn on security notifications.
A hacked account is unpleasant, but it can also expose weaknesses that were invisible before the incident. Fixing those weaknesses is what turns account recovery into actual security recovery.
For incidents involving substantial financial loss, identity theft, threats, workplace data, or potential legal obligations, obtain advice appropriate to your jurisdiction and circumstances. General cybersecurity guidance can tell you what to investigate, but it cannot replace individualized legal advice when significant rights, losses, regulatory duties, or criminal conduct are involved.
