What to Do if You’ve Been Hacked: Recover in the Right Order

Written by cybersecurity professionals.

The direct answer

If you think you have been hacked, secure your main email account first, because it can reset the passwords for almost everything else. Change its password from a device you trust, turn on multi-factor authentication, and sign out all other sessions. Then secure your banking and payment accounts, then your phone account, then social media and everything else. Order matters more than speed.

Signs someone is inside your account

• You get password reset emails or sign-in alerts you did not request.
• Your password suddenly stops working.
• Friends receive messages or posts from you that you did not send.
• You see purchases, transfers, or new payees you do not recognize.
• Your recovery email or phone number has been changed.
• There are email forwarding rules, filters, or connected apps you did not set up.
• Your phone suddenly loses service and shows “SOS only” or no signal when it normally has coverage. This can be a sign someone moved your number to another SIM; contact your carrier from another phone.

Step 1: Use a device you trust

If you suspect your computer or phone has malware, use a different device to make changes. Otherwise, whoever is watching may see your new passwords too.

Step 2: Secure your main email account

1. Change the password to a long, unique one you have never used before. A password manager makes this easier.
2. Turn on multi-factor authentication. An authenticator app or a passkey is stronger than text-message codes.
3. Sign out of all other sessions. Most email providers have a “sign out of all devices” option in security settings.
4. Check the recovery email and phone number and change them back if they were altered.
5. Look for forwarding rules and filters you did not create, and delete them. Attackers use these to hide reset emails from you.
6. Review connected apps and remove anything you do not recognize.

If you cannot get in at all, use the provider’s official account recovery page. Go there by typing the address yourself or searching for the provider’s help center, not through a link in an email or text.

Step 3: Secure money and payment accounts

Sign in to your bank, card, and payment apps directly. Change passwords, turn on multi-factor authentication, and review recent transactions and payees. If you see anything you did not do, call the number on the back of your card.

Step 4: Secure your mobile phone account

Your phone number receives many sign-in codes. Ask your carrier about adding an account PIN or a port-out or number-transfer lock. Each carrier names this differently.

Step 5: Secure social media and everything else

For each important account, change the password, turn on multi-factor authentication, sign out other sessions, and check the recovery details. If you reused the hacked password anywhere, change it there too. Reused passwords are one of the most common ways one breach turns into many.

If someone took over a social media account and is messaging your contacts, use the platform’s official hacked-account help page, then tell friends through another channel not to send money or codes.

Step 6: Check your devices

Update your phone and computer operating systems and browsers. Remove apps and browser extensions you do not recognize. Run your device’s built-in security scan or a reputable antivirus.

Step 7: Protect your identity if personal information was exposed

If your Social Security number or financial details may have been taken:

• Consider a free credit freeze with each of the three US credit bureaus: Equifax, Experian, and TransUnion. A freeze makes it harder for someone to open new credit in your name.
• Visit IdentityTheft.gov, the FTC’s site, for a recovery plan if someone used your information.

Step 8: Write down what happened

Note dates, what you saw, and what you changed. If you need to contact your bank, a platform, or law enforcement later, this record helps.

A data breach is not always a hack

A company announcing a data breach does not automatically mean your account was taken over. It means some of your information may have been exposed. Lesson 21 of the course explains the difference, and Lesson 22 shows how to check whether your information appears in known breaches, safely.

Get ahead of the next one

Most recoveries are harder than they need to be because recovery settings were never set up. Personal Cybersecurity Essentials covers this before anything goes wrong.

The course has 7 modules, 27 short lessons, and a quiz at the end of each module. Module 2 covers unique passwords, password managers, multi-factor authentication, passkeys, and account recovery. Module 6 covers breach alerts, checking your exposure, signs someone is inside your account, and what to do, in the right order. Module 7 helps you build a personal security plan you can keep up.

Plain language, no technical background needed. $19.99, one-time.

Start Personal Cybersecurity Essentials

---

Frequently asked questions

What is the first thing to do if you’ve been hacked?

Secure your main email account from a device you trust. Change the password, turn on multi-factor authentication, and sign out all other sessions. Your email can reset most of your other accounts.

How do I know if my phone has been hacked?

Warning signs include apps you did not install, unexpected pop-ups, settings that changed on their own, and sign-in alerts you did not trigger. Sudden loss of mobile service can mean your number was moved to another SIM, so contact your carrier from another phone.

Should I change all my passwords after being hacked?

Start with the hacked account and your main email, then banking, then any account where you used the same password. Then work through the rest. A password manager makes unique passwords practical.

Can I recover a hacked account if the hacker changed my password?

Often, yes. Use the provider’s official account recovery page, reached by typing the address yourself. Having a current recovery email and phone number set up in advance makes this much easier.

Do I need to freeze my credit after being hacked?

If your Social Security number or financial information may have been exposed, a credit freeze with Equifax, Experian, and TransUnion is a free and effective step. For an account takeover alone, it may not be necessary.

Where can I get official help with identity theft?

In the United States, IdentityTheft.gov from the Federal Trade Commission provides a personal recovery plan.