What to do if your email or social media account was hacked
It's not your fault. Accounts get hacked every day, often through data leaks or fake messages. Acting now can lock the hacker out, protect your money, and stop them from tricking people you know. Start with the first step now.
Do these steps in order
0 of 7 done
-
Do this now Get back into your account through the company's own app or website
If someone you know or live with may have set this up, removing it or signing them out can alert them. If you’re worried about your safety, talk to a domestic violence advocate before you change anything. The National Domestic Violence Hotline is free and open any time: call 800-799-7233 or chat at thehotline.org. If you can, use a phone or computer they can’t check.
Open the app yourself, or type its web address yourself. Don't use links in texts or emails. Locked out? Look for Forgot password or help for a hacked account. Use a device you usually sign in on. Don't search online for a support number. Scammers post fake ones.
- Google: Secure a hacked Google Account
- Microsoft: Recover a hacked Microsoft account
- Apple: If your Apple Account may have been hacked
- Yahoo: If your Yahoo Mail was hacked
-
Do this now Change the password and turn on two-step sign-in
Pick a new password you don't use anywhere else. Then turn on two-step sign-in. Never read the codes it sends to anyone who contacts you. Used the old password on other accounts? Change it there too. Think your device has a virus? Do the scan in the last step first.
- FTC: Two-step sign-in, explained
- Google: Turn on 2-Step Verification
- Microsoft: Two-step verification
- Apple: Two-factor authentication
-
Do this now Sign out of all other devices
In the account's security settings, find the list of devices where you're signed in. Sign out of any you don't know, or choose to sign out everywhere. This kicks out whoever got in. On a Microsoft account, it can take up to 24 hours.
-
Do this now Remove forwarding, recovery details, and apps you don't know
Hackers may set your email to quietly send copies to them. In settings, check forwarding, filters, rules, and automatic replies. Delete any you didn't make. Make sure the recovery phone and email are yours. Remove connected apps you don't know.
-
Do this now Call your bank if you use this email with your bank
Someone with your email may try to reset your bank password. Use the number on the back of your card, or open your bank's official app. Ask them to watch for changes and transfers you didn't make.
What to say: “My email was hacked, and I use it with my bank. Please watch my account for changes or transfers I didn't make, and help me change my login.”
-
Warn your friends and family about messages from your account
Send a quick text or email, or make a post, saying you were hacked. Tell them not to click links from you, and to ignore any request for money or codes. Check your sent messages and posts for anything you didn't send.
What to say: “My account was hacked. Don't click links from me, and ignore any message asking for money or codes. If you're not sure, call me on the number you already have.”
-
Update your device and run a security scan
Install all updates in Settings (on a Mac, System Settings). On Windows, open Windows Security and run a full scan. If it finds anything, delete it, restart, and change your password again.
Follow up later
- Tomorrow: sign in again and check the security settings. Make sure the recovery phone and email are still yours.
- In 30 days: look at your bank and card statements for anything you don’t know.
Keep your place
To keep your place, bookmark this page or copy your private link.
Keep the link private. It shows the steps you’ve ticked. Never send it to anyone who calls, texts, or emails you. Latchstring will never ask for it. Your browser’s history also keeps this address, and may copy it to your Google or Apple account if you sync. On a shared phone or computer, use a private window, or clear your history afterward.
Did any of these happen too?
- I sent money by bank, Zelle, wire, Western Union, or MoneyGram
- I paid with an app like Venmo, Cash App, or PayPal
- I paid with a credit or debit card
- I paid with gift cards
- I sent crypto or used a Bitcoin ATM
- I gave cash, gold, or my cards to someone
- I deposited a check and sent money back
- I shared a code or password
- My phone suddenly has no service
- I let someone into my computer or phone
- Someone is using my name, or I gave out my Social Security number
Then, report it and get free help
- Report the scam at ReportFraud.ftc.gov (Federal Trade Commission).
- Also report it to the FBI at IC3.gov, even if it started with a phone call or a visit.
- Get a free recovery plan from a real person: call or text 888-400-5530 (Identity Theft Resource Center, a nonprofit).
- Age 60 or older? Call the Justice Department’s National Elder Fraud Hotline at 833-372-8311 for free help reporting it. Mon–Fri, 10 am–6 pm Eastern.
- Feeling overwhelmed? Call or text 988, any time.
Watch for a second scam. Anyone who contacts you offering to get your money back for a fee, a code, your bank details, or access to your phone or computer is a scammer, even if they say they’re the FBI, the FTC, a lawyer, or us. Don’t search online for a company’s phone number either. Scammers post fake ones.
This guide was last checked in October 2026. Sources: