Someone got into my account

If money already left your bank or card, call the number on the card first, then come back. Otherwise start with your email, even if it was Facebook or Instagram that got taken.

If it’s happening now

A sign-in code you didn’t ask for. Someone probably has your password. Don’t share the code. Open the account yourself, in its app or at an address you type, and change the password.

A “reset your password” email you didn’t ask for. Someone typed your email address, by mistake or on purpose. That alone doesn’t mean they’re in. Don’t tap the link.

A “your password was changed” email you didn’t ask for, or you can’t sign in. Go to If you’re locked out. Don’t pay anyone who offers to get it back.

Your account is sending messages you didn’t write. Lock it down first (next section). Then warn people by text or a call, not only from the account they took.

Someone was on your computer, or you installed something a stranger asked for. Hold the power button until it turns off, and do everything here from your phone. I let someone control my computer.

Your phone suddenly has no service. Someone may have moved your number to their phone to get your codes. My phone suddenly has no service.

What to say

• Someone hacked my account. Anything from me asking for money or a code, or sending a link, wasn't me. Don't click it or send anything. If you already did, call me.

• That message wasn't me. Someone hacked my account. If you sent money, call your bank or the app right now, on the number on your card or inside the app, and ask them to stop it.

• Someone got into my email. Can you check my account for new payees, changed contact details, or transfers I didn't make, and put a fraud note on it?

If you can still sign in

Use a device you trust. If something on your computer stole the old password, it can steal the new one. Use your phone, or a computer you’ve just scanned with up-to-date security software.

In your email first:

1. Change the password to one you’ve never used anywhere else.
2. Sign out everywhere else.
3. Check the recovery phone and email, and the ways to sign in: phone numbers, passkeys, authenticator apps. Remove any you didn’t add. Each one is a way back in.
4. Look for what they set up to keep reading your mail: forwarding, filters that hide or delete messages, other people given access. Screenshot anything you didn’t set up, then delete it. It shows which accounts they were after.
5. Add a passkey or an authenticator app. Text-message codes are better than nothing.

Where those are:

Gmail, on a computer: Settings (the gear) > See all settings. Check the tabs Forwarding and POP/IMAP, Filters and Blocked Addresses, and Accounts and Import (under “Grant access to your account” and “Send mail as”). Then in your Google Account: Security & sign-in > Your devices > Manage all devices, and sign out any you don’t know. Passkeys are at myaccount.google.com/signinoptions/passkeys.

Outlook.com or Hotmail: Settings > Mail > Forwarding and IMAP, and Settings > Mail > Rules. To sign out everywhere or add a passkey, go to Advanced security options at account.live.com/proofs/manage/additional. Signing out everywhere can take up to 24 hours. Microsoft is phasing out text-message codes for personal accounts, so add a passkey and a second email address you check.

Yahoo: Settings (the gear) > More Settings. Check Mailboxes (forwarding and the reply-to address), Filters, and Vacation response. At login.yahoo.com/account/security, delete app passwords you don’t recognize and check recent activity.

iCloud Mail: At icloud.com/mail, open Settings (the gear) > Settings and check Mail Forwarding and Rules. Then at account.apple.com, go to Sign-In and Security > Account Security and check the trusted phone numbers. Under Devices, remove any you don’t recognize.

Facebook and Instagram: Accounts Center (some accounts show Meta Account instead) > Password and security > Where you’re logged in > Select devices to log out.

WhatsApp, if you can still open it: Settings > Linked devices (Android: the three dots > Linked devices). Log out any computer or browser you don’t recognize. Then turn on two-step verification: Settings > Account > Two-step verification.

If you’re locked out

Use a phone or computer you’ve signed in from before, at home if you can. Google and Facebook both recommend it.

• Google or Gmail: g.co/recover. Answer every question, even with a best guess. Google has no phone line for this and says it doesn’t work with any service that claims to help with passwords.
• Outlook or Hotmail: account.live.com/password/reset. If that fails, the recovery form at account.live.com/acsr. Give it a different email address you can check (a relative’s is fine); Microsoft answers there within 24 hours. Old passwords and the exact subject lines of recent emails help. You can try twice a day.
• Yahoo: login.yahoo.com/forgot.
• Apple Account or iCloud: iforgot.apple.com. If it puts you in account recovery, the wait can be several days or longer, and Apple Support can’t shorten it. Turn off your other Apple devices until it’s done. Using the account cancels the request, except on the device where you started it in Settings or the Apple Support app.
• Facebook: facebook.com/hacked.
• Instagram: instagram.com/hacked. It may ask for a video selfie, turning your head while it records. You can’t get in while it’s reviewed.
• WhatsApp, if you’re logged out: On your phone, tap Log back in and enter the 6-digit code sent to your number. WhatsApp says that logs everyone else out. If it asks for a two-step PIN you never set, they may have set it. They’re already out; wait 7 days and try again. No phone service? Start with My phone suddenly has no service. Don’t report the account to WhatsApp until you’re back in. WhatsApp says it may ban it.

Recovery can take days. Paying someone won’t make it faster.

If the company says it can’t recover the account, start a new email address. Change the email on your bank, card, phone company, Social Security, Medicare, and pharmacy accounts, starting with the bank, and tell family the new address.

Then check what your email reaches

Search the inbox, Sent, Archive, and Trash for “password,” “reset,” “new sign-in,” “verify,” “order,” and “payment.” Look for accounts they opened or changed.

1. Money. Open your bank, card, and payment apps yourself. New payee, changed phone or email, a transfer you didn’t make: call the number on your card.
2. Your phone company account. Change its password and PIN, and ask them to lock your number so it can’t be moved to another phone. My phone suddenly has no service.
3. Anywhere you used the same password. Change it there too.

If your mail held tax forms, ID scans, or your Social Security number, freeze your credit: I gave out a code, password, or card number. If it’s a work account, tell IT today.

If your account is messaging people

Hijacked accounts tend to send a few things:

• A link: “Is this you in this video?” or “check out this video.”
• “I sent you a code by mistake, can you send it back?” Or a code “to vote” in a contest. The code is for your friend’s own account.
• Crypto or trading wins, and an offer to show them how.
• An emergency, or something cheap for sale, paid by Zelle, Cash App, or gift card.

Screenshot what they sent and who got it before you delete anything. Text the warning to the people most likely to act on it: family, close friends, anyone who’s sent you money before. Post it once you’re back in. A friend who already paid should call their bank now: I paid or sent money. A friend who sent you a code may lose their account next. Send them this page.

Report it

Report it at ReportFraud.ftc.gov. If money was taken, also file at ic3.gov. If they opened accounts or filed taxes in your name: IdentityTheft.gov.

What it looks like

You got back into your Gmail and changed the password. On the Filters and Blocked Addresses tab, there's one filter.

mail.google.com/mail/u/0/#settings/filters

Settings · Filters and Blocked Addresses

The following filters are applied to all incoming mail:

Matches: {fernmontbank "security alert" "new sign-in" password}
Do this: Skip Inbox, Mark as read, Delete it

edit delete

You didn't make it. What do you do?

• Delete it. They're out now that the password's changed
• Screenshot it, delete it, and open Fernmont's app
• Delete it and empty the Trash so nothing of theirs is left

Show the answers

• Wrong move Delete it. They're out now that the password's changed Deleting it doesn't undo whatever they did at your bank while it hid those emails and your security warnings. It shows you where to look: Fernmont.
• Best move Screenshot it, delete it, and open Fernmont's app The screenshot is your record, and deleting it lets alerts through again. Then check Fernmont's own app for new payees and transfers, and call the number on your card if anything changed. What it caught is in Trash for 30 days.
• Wrong move Delete it and empty the Trash so nothing of theirs is left Emptying Trash deletes the bank emails it hid, which you need to see.

A filter or forward you didn't set up shows you what they were after. Check those accounts next, in their own apps.

Your Instagram email and phone number were changed this morning. This text arrives an hour later.

+1 (213) 555-0187

Text Message
Today 10:52 AM

hello i have your instagram. you want it back? make video 30 sec saying you invest $1,000 in bitcoin and get $9,400 back in 1 week. send here and i send you login. no video in 2 hours i delete account

What do you do?

• Make the video. Your friends know you'd never invest in this
• Ignore it and go to instagram.com/hacked
• Ask them to send the login first, then make the video

Show the answers

• Wrong move Make the video. Your friends know you'd never invest in this It gets posted from your account to people who trust you, as proof the scheme pays. Some of them will send money. Nothing makes them give the account back afterward.
• Best move Ignore it and go to instagram.com/hacked Instagram's recovery doesn't depend on them. Also text close friends that anything about money or crypto from your account isn't you. They hear it somewhere the hacker can't post.
• Wrong move Ask them to send the login first, then make the video They hold the account, so they set the terms. Whatever you send gets used, and they can take any login back.

Don't deal with whoever has it. Use the recovery page at an address you type, and warn friends by text.

You typed instagram.com/hacked into your browser. The email and phone on the account aren't yours anymore, so it offers another way to prove who you are.

www.instagram.com/hacked/

Instagram

Confirm it's you

Take a video selfie. You'll be asked to turn your head in different directions.

We'll compare it to photos on this account. It won't be shown on your profile.

Get started

An hour ago, someone else wanted a video of you too. What do you do?

• Record the video selfie here
• Skip it and wait for another option by email
• Ask a "Meta Support" account that replied to your post

Show the answers

• Best move Record the video selfie here You typed the address, so this is Instagram. Meta says the video is never shown on your profile or to other people, and the face data is deleted right after the comparison. You can't get in while it's reviewed. If it doesn't pass, Instagram emails you and you may be able to try again.
• Wrong move Skip it and wait for another option by email Instagram says that if you don't confirm with the selfie, you may not be able to get back in.
• Wrong move Ask a "Meta Support" account that replied to your post Fake support accounts reply to people who post about being hacked, then ask for details or a fee. The BBB says you should never have to pay to recover an account.

The hacker wanted a video to post as you. Instagram wants one to compare with your photos, on a page you typed in yourself.

What not to waste time on

Paying for help. People who reply to your “I got hacked” post, accounts calling themselves a recovery service or Meta Support, and numbers from a search for “Gmail support” are how a second scam starts. The fix is the free recovery page above. Someone offers to get my money back.

Bargaining with whoever has it. They keep the account and use whatever you send.

Working out how they got in. Lock it down first.