Your First Hour After an Account Takeover
Someone has taken over one of your accounts. What to do in the first hour, in priority order: your email, your money, your contacts, then the account itself.
You try to sign in and your password no longer works. Or a friend asks why you messaged them about an "investment". Or your phone shows a sign-in from a city you have never visited. However you found out, someone else is in one of your accounts, and the next hour matters. The order below is designed to cut off the attacker's route to everything else first, and then take the account back.
If money can move from the account, such as a bank, mobile money or payment app, call the provider now on its official number, then come back to this list.
Step 1: Work out what is affected (5 minutes)
Answer three questions quickly:
- Which account has been taken over, and do you still have any access to it?
- Is your email affected? Look for password reset messages you did not request or security alerts from your email provider.
- How did it happen? Did you enter a password on a link, share a code, approve a sign-in prompt, or install something? This tells you what else might be exposed.
If you installed software at someone's request or suspect your device is infected, do the next steps from a different device you trust.
Step 2: Secure your email first (15 minutes)
Your email is the master key. Almost every other account lets you reset its password by email, so an attacker who holds your inbox can take back anything you recover.
- If you can still sign in, change the password to a new, unique one and turn on two-step verification, ideally with an authenticator app or passkey.
- Sign out of all other sessions in the security settings.
- Check recovery details: your recovery phone and email should be yours.
- Check for forwarding rules and filters that send your mail elsewhere or delete security alerts. Attackers add these to stay hidden.
- If you cannot sign in, use the provider's official recovery process. Our guide to recovering a hacked email account covers it step by step.
Step 3: Protect your money (10 minutes)
- Check your banking, card, mobile money and payment apps for new payees, changed contact details, new devices or transactions you do not recognise.
- If the taken-over account holds a saved card, such as a shopping or ride app, remove the card or ask the card issuer to block it.
- If you reused the stolen password on any financial account, change it there now.
Step 4: Warn your contacts (5 minutes)
Attackers often use a taken-over account to scam the people who trust you: urgent requests for money, links to "vote" for something, or fake investment tips. Tell your contacts through a different channel, such as a text, a call or a post on another account:
Step 5: Recover the taken-over account (15 to 20 minutes)
- Use only the official recovery route in the app or on the provider's website, which you type yourself. Most large platforms have dedicated hacked-account pages.
- Once back in, set a new unique password, turn on two-step verification, sign out of all other sessions, and remove unfamiliar devices, linked apps and changed recovery details.
- Check what was changed or sent while the attacker had access: posts, messages, purchases, settings.
Beware of recovery offers. Comments and messages from "account recovery experts" are almost always scams. Real recovery happens only through the platform's own process.
Step 6: Close the door behind you (remaining minutes)
- Change any password you reused, starting with the most important accounts. A password manager makes unique passwords practical.
- Remove any software you were told to install, and run your device's security scan.
- Save evidence: screenshots of alerts, the attacker's messages and anything posted from your account.
- Report it to the platform, and to your national fraud service if money or identity details were involved. If it was a work account, tell your IT team immediately.
In the days after
Watch your email and financial accounts for unusual activity, look out for phishing messages that use details the attacker saw, and review which accounts still share a password. If identity documents or ID numbers were in the account, consider a credit freeze or fraud alert where your country offers one.
Got a suspicious security alert? Paste it into CyberWatch AI Scan for a free check, and confirm by opening the official app yourself.
For the full recovery plan, including identity fraud and a quarterly security checkup, see our guide on how to recover a taken-over account.
Frequently asked questions
Which account should I secure first?
Your main email account, because password resets for almost everything else go there. If the attacker controls your email, they can take back any other account you recover.
Should I use the same device to recover my accounts?
If you suspect the device is infected, for example because you installed something at a stranger's request, use a different trusted device for recovery and get the first one checked.
The attacker changed my recovery phone and email. Can I still get in?
Often yes. Use the provider's official recovery process and answer as fully as possible from a device and location you have used before. Providers keep old recovery details for a period for exactly this reason.
Someone is offering to recover my account for a fee. Should I accept?
No. Only use the official recovery process on the provider's own website or app. Paid 'recovery experts' who contact you, or who advertise in comments, are almost always scammers.
Sources
- Recovering a hacked account, UK National Cyber Security Centre
- How To Recover Your Hacked Email or Social Media Account, US Federal Trade Commission
- Recover a hacked account, Facebook Help Centre
- How to recover a compromised account, WhatsApp Help Center
