A password reset you never asked for is a bad sign. So is a coworker texting to ask why you want gift cards. Both usually mean the same thing: someone else is inside your account. The fix is a short sequence of steps, done in the right order.

Hands rest a closed phone face down on a kitchen table beside a mug and notepad, showing a calm pause to regain control of an account.
A closed phone sits face down beside a mug and notepad. Pausing to plan the order of steps comes before any password reset.

Recognize the warning signs early

The plainest sign is a login that fails with a password that worked yesterday. Other signs are quieter. You may get a notice that your username or password changed when you changed nothing. You may see a login alert from a device or place you do not know. The Federal Trade Commission lists these signs for hacked email and social media accounts.

Your contacts may spot the problem before you do. The U.S. Chamber of Commerce lists the same pattern: friends or followers get strange messages, links, or money requests from your profile that you never sent. The FBI's Internet Crime Complaint Center (IC3) describes account takeover fraud as criminals gaining unauthorized access to an online account to steal money or information. A social profile is one of the accounts it names.

Secure your email and regain control first

Start with the email account tied to the hacked one. A summary of the UK National Cyber Security Centre (NCSC) steps, published by the third-party Scam Safety Guide, says to check your email for filters and forwarding rules. A forwarding rule sends the criminal a copy of every message that reaches your inbox. They can then use those copies to reset your passwords.

Once your email looks clean, work through the hacked account itself:

  • Change the password. Make it unique, and change it on any other account that shares the old one.
  • Log out all devices and apps so the intruder loses any open session.
  • Turn on two-step verification, also called two-factor authentication. A criminal who knows your password still cannot get in without the second factor.

On password strength, the University of British Columbia's privacy office suggests at least 12 characters, mixing uppercase and lowercase letters, numbers, and symbols. The same summary says second-factor options include codes by text or email, a fingerprint, a face scan, or an authenticator app.

The exact buttons differ by service. The Scam Safety Guide summary says to begin with the provider's own help or support pages. The NCSC's guidance page covers the same ground. The sources reviewed here do not give platform-by-platform steps for the major networks, so use the help center of the service you are recovering.

Warn your contacts and watch for impersonation

While recovery is pending, tell people through another channel. A phone call or a text from your own number works. Say your account was compromised. Ask them to ignore recent messages from it and not to click links or send money. Keep it short.

Impersonation scams can also reach you. A December 2025 IC3 public service announcement described a campaign in which senior U.S. officials were impersonated by text and AI-generated voice messages. Targets were pushed to move the conversation to encrypted apps such as Signal, Telegram, or WhatsApp. They were then asked for authentication codes, personal documents, or wire transfers.

If a message wants you in a private chat right now, slow down.

The same advisory points to a simple check. Before you answer an unexpected message, verify the sender through a phone number you find independently. Never read out a security code to someone who contacted you first.

Be wary of rescue offers too. The IC3 home page says the center will never contact you directly for information or money. It also says it does not work with non-law-enforcement entities to recover lost funds. Anyone claiming to be from IC3 and asking you for payment is a red flag.

Check for money and identity problems afterward

Think about what the account touched. Some profiles are linked to payment apps, marketplaces, or ad accounts. Look through those for charges you do not recognize. If you find any, contact the bank or payment service involved.

The sources reviewed here do not say how a takeover affects credit reports or bank accounts. They also do not explain what to do if financial accounts were accessed. For those questions, rely on your financial institution and on official government consumer pages rather than on this article. If you want to report the incident, the IC3 site accepts complaints about online crime.

The sources also do not cover recovering a business or shared account in detail. If one of those was hit, start with the platform's help pages. Then tell the other people who have access.

Reduce the chance of a repeat takeover

IC3 says attackers get in through several routes. These include weak passwords without multi-factor authentication, phishing emails and sites, and social engineering, such as posing as bank or tech support to get a one-time passcode. They also include credentials from data breaches, malware, and search-ad poisoning that leads to lookalike sites. The Scam Safety Guide summary adds that criminals try a stolen password on other accounts, because many people reuse them.

That points to a few habits:

  • Use a different strong password for every account.
  • Turn on two-step verification wherever it is offered.
  • Treat any request for a one-time code as a warning, especially an unsolicited one.
  • Check your email for unfamiliar forwarding rules or devices now and then.

None of this takes long. The 2022 NordVPN survey cited by the U.S. Chamber found 9 in 10 people know someone whose social media profile was hacked. A few minutes spent on these habits is cheap by comparison.