If your account or computer has been hacked, work in this order: first protect money, then take back your main email, then lock out the attacker everywhere else, then clean or reset the infected device, and finally warn the people who may be targeted next. If any banking app, card or e-wallet may be involved, call the bank on its official number immediately and report to the police; minutes matter more than understanding exactly what happened.
Most damage from a hack happens in the first hours, not the first minutes, because attackers use a captured account to reset other accounts, scam your contacts and move money. A calm, ordered response during the first 24 hours usually limits the harm to one account rather than your whole digital life.
First, work out what kind of compromise you are facing
The word "hacked" covers very different situations, and the right first move depends on which one you are in. Take one minute to sort it before acting. You do not need certainty, only a rough idea.
An account compromise means someone has signed in to one of your online accounts: email, social media, a shopping account or a chat app. Signs include messages you did not send, password reset emails you did not request, new devices in the account's security page, or being suddenly locked out.
A device compromise means malware or an unwanted remote control app is running on your phone or computer. Signs include apps you did not install, special permissions you do not remember granting, the screen moving by itself, security software being switched off, or a ransom message on the screen.
A financial compromise means money has moved, or someone may be able to move it: unknown transactions, one-time codes you did not request, or a scam call during which you shared a code or installed an app. This is the most urgent case and comes first whenever it is possible, even if you are not sure.
Quick triage: what you see, what it likely means, what to do first
Use this to choose your starting point. When in doubt, start with the row involving money.
| What you notice | Likely situation | First action |
|---|---|---|
| Unknown bank or e-wallet transaction, or OTP codes you did not request | Financial compromise, possibly device too | Call the bank on its official number now, then report to police |
| You shared a code or installed an app during a call | Financial and device compromise | Cut the phone's internet, call the bank from another phone |
| Friends receive messages from you asking for money | Chat or social account taken over | Warn contacts through another channel, start account recovery |
| Email password no longer works, recovery details changed | Email takeover, high risk to other accounts | Use the provider's official recovery process at once |
| Security alert about a sign-in from an unknown device | Password leaked, attacker may be inside | Change password, sign out all sessions, check second factor |
| Ransom note or files with strange extensions | Ransomware on the device or network | Disconnect from network, do not pay, call IT support |
| Screen moves by itself, unknown remote app | Remote control or accessibility malware | Disconnect internet, call bank, get help to reset device |
Write down the time you noticed each sign. Banks, police and technical helpers will ask, and memory becomes unreliable under stress.
The first hour when money may be involved
Do these steps even if you only suspect a problem. A false alarm costs a phone call; a delay can cost everything.
- Disconnect the affected device from the internet. Airplane mode on a phone; unplug the cable or turn off Wi-Fi on a computer. This interrupts any live remote control.
- Call the bank from another phone. Use the number on the back of your card or on the bank's official website, never a number from a message. Ask them to lock online banking and cards and check recent transactions.
- Lock e-wallets and other payment apps the same way. Use the official support channels of each provider.
- Report to the police. Describe what happened, when, and which accounts are affected. Bring transaction details and screenshots if you have them.
- Do not send more money to "recover" the loss. Calls offering to get your money back for a fee are a second wave of the same scam.
- Keep evidence. Screenshots of messages, links, phone numbers and transaction confirmations. Do not delete the conversation, even if it is embarrassing.
Banks have their own procedures for disputed transactions, and outcomes depend on timing and circumstances. Follow their instructions exactly and keep a record of every reference number.
Taking back your email or social account
Email comes first, because it is used to reset almost everything else.
- Start from a device you trust. If you suspect your usual computer is infected, use another phone or computer for recovery.
- Use the provider's official recovery page. Type the address yourself or use the official app. Search ads and messages offering "account recovery services" are often scams.
- Prove ownership with old recovery details. Recovery flows often accept a previous phone number, a known device or past passwords. Answer as accurately as you can.
- Set a new, unique password immediately. Generate it with a password manager; never reuse an old one.
- Sign out all other sessions. Most services have an option to log out everywhere. Use it to remove the attacker's access.
- Turn on two-factor authentication or add a passkey. If the attacker added their own second factor or recovery email, remove it.
If recovery fails, keep trying through the provider's official support. Social platforms often have specific forms for hacked accounts and impersonation.
Cleaning up after you are back in
Check recovery email and phone number. Attackers often add their own so they can return later. Remove anything you do not recognise.
Look for forwarding rules and filters in email. A hidden rule that forwards or deletes certain messages lets attackers keep reading your mail or hide bank alerts.
Review connected apps and app passwords. Remove third-party apps and app-specific passwords you did not create.
Check sent messages and posts. See what the attacker sent in your name so you know who to warn and what to correct.
Review devices and sessions. Remove unknown devices from the account's device list.
Change passwords on accounts that shared the old password. If you reused the hacked password anywhere, those accounts are at risk too.
Check accounts that use this email for login. Shopping, delivery, cloud storage and payment services may have received password reset emails.
Look at payment methods stored in accounts. Remove cards from accounts you do not need them in, and watch statements for a while.
When the device itself is infected
If the problem is on the device, changing passwords from that same device can hand the new passwords straight to the attacker. Recover accounts from a clean device first, then deal with the infected one.
For a phone, remove suspicious apps, starting with any that have accessibility, device administrator or screen-sharing permissions. If you are unsure what an app did, the safest route is a full factory reset after saving photos and contacts, then reinstalling only apps you recognise from the official store.
For a computer, a full security scan can remove common malware, but serious infections, remote access tools and ransomware usually justify a clean reinstall by someone experienced. Copy only documents and photos from the old system, not programs, and scan them before opening.
If the computer belongs to a business or is connected to a company network, stop and call whoever manages IT before doing anything else. Turning machines off, deleting files or restoring backups too early can destroy evidence and spread the problem.
Hours two to twenty-four: contain the spread
Once money and email are protected, the next risk is spread. Attackers use a captured account to target the people who trust you: messages asking friends to lend money, fake investment invitations, links to the same scam. Warn your contacts through a different channel, such as a post from a recovered account or a message from a family member, telling them to ignore requests sent in your name.
Then go through your important accounts in order of value: the platform account that syncs your phone, banking-related email, social media, work accounts, shopping accounts with saved cards. Change passwords where needed and check second factors.
If you used SMS codes, consider whether your phone number is safe. A sudden loss of signal before the hack may suggest a SIM swap; contact your mobile operator through official channels. Stronger second factors are explained in our comparison of two-factor authentication methods.
Finally, note everything you did and when. If the matter goes to the police or the bank, a clear timeline helps, and it also helps you check later that nothing was forgotten.
A worked example: a shop's hijacked social media account
A small clothing shop runs its sales through a social media page managed from the owner's personal account. One evening the owner receives a message claiming to be from the platform's support team, warning that the page will be removed for copyright violations unless she verifies her account through a link. She enters her password and the code she receives.
Within minutes she is locked out. The attacker changes the recovery email, removes her as page administrator and starts posting fake "clearance sale" offers asking customers to transfer deposits.
Her response follows the order above. No banking app was involved, so she starts with email: her email account is still hers, because the attacker only had the social media password. She uses the platform's official hacked-account process from her phone, confirms her identity, regains access and signs out all sessions. She removes the attacker's recovery email and turns on stronger two-factor authentication.
In parallel, her sister posts warnings on the shop's other channels telling customers not to transfer money. Two customers had already paid; she advises them to contact their banks and the police with the transaction details. Afterwards, she adds a second trusted administrator to the page so a single compromised account can never lock the business out again.
Mistakes that make things worse
Waiting to be sure before calling the bank. Banks can act faster on a fresh report. A false alarm is far cheaper than a delay.
Calling a number from the scam message. Look up the official number yourself; scammers often provide their own "support line".
Paying a stranger to recover the account or money. Recovery offers that ask for fees are almost always a second scam.
Changing passwords from an infected device. Malware can capture the new passwords instantly.
Deleting messages out of embarrassment. They are evidence for the bank and police and help others avoid the same trap.
Reinstalling suspicious apps after a reset. Restoring everything automatically can bring the malware back.
Forgetting accounts that shared the password. One reused password can let the attacker return through a different door.
Telling nobody. Friends and customers who are not warned may be scammed in your name.
When to call professionals and authorities
Money has moved or may move. Call your bank and payment providers at once, then report to the police.
Threats, extortion or intimate images are involved. Report to the police and seek support from trusted people; do not negotiate alone.
A business computer or network is affected. Call your IT provider or a cybersecurity firm before touching affected systems.
Customer or staff data may have leaked. Ask a lawyer or qualified adviser about your obligations; rules on personal data are specific and change over time.
Ransomware appears. Disconnect, do not pay, and involve police and experienced responders.
You cannot recover a critical account. Use the provider's official support; for business accounts, ask whether there is a dedicated support channel.
You suspect your phone number was taken over. Contact your mobile operator through official channels from another phone.
Making sure it does not happen again
Most account takeovers rely on a password typed into the wrong place or reused from somewhere else, plus a second factor that could be read out. Changing those two things removes most of the risk.
Move your main email and your phone platform account to a passkey or an authenticator app, and store unique passwords in a password manager. How passkeys block fake login pages is explained in passkeys explained.
For businesses, never run important pages or accounts from a single personal login. Use proper business accounts with at least two administrators, each protected by strong two-factor authentication.
Finally, agree on a simple rule with your family or team: nobody gives verification codes, installs apps or shares their screen because of a message or call, however official it looks. Calling the organisation back on its official number is always allowed and never rude.
Frequently asked questions
Should I pay someone who offers to recover my hacked account?
No. Use only the official recovery process of the service. People offering paid recovery through messages or comments are very often running a second scam.
How do I know if my email has a hidden forwarding rule?
Open the email settings on a computer and check forwarding, filters and rules. Delete anything you did not create, especially rules that forward mail or move bank messages.
Will the bank refund money taken through a scam?
It depends on the bank's procedures and the circumstances, and nothing is guaranteed. Reporting immediately gives the best chance, so call at once and follow their instructions.
Do I need to reset my phone after a hack?
If only an online account was compromised, usually not. If you installed an unknown app, granted special permissions or saw remote control behaviour, a factory reset after saving photos and contacts is the safest option.
How do I warn friends without spreading panic?
Keep it short: your account was taken over on a certain date, ignore any requests for money or links sent in your name, and contact you by phone if unsure.
Can I find out who hacked me?
Usually not by yourself, and trying can be risky. Give the evidence to the police and let them decide what can be investigated.
