The worst moment is the first one. A login alert you didn’t trigger. A friend asking why you sent them a link you never sent. Your password suddenly not working.
Your first instinct is to change the password. If you can still get into the account, that instinct isn’t wrong — it’s just incomplete. An attacker who already has your account rarely needs your password again. They need the doors they’ve already opened: your sessions on their devices, the recovery email they swapped in, the third-party app they quietly connected. Taking an account back means closing all of those, in the right order.
Don’t trust the panic — type the recovery address yourself
The first few minutes after a hack are when phishing thrives. An email arrives saying your account was compromised and offers a convenient link to “secure” it. Some of these are fake, sent by the same criminals, and clicking through hands them more than they already had.
So don’t click through. Type the recovery address into your browser yourself. Meta even publishes a help page that explains how to tell whether an email really came from Facebook — worth using before you act on any “account changed” message, because a convincing fake is exactly how people get hacked twice in one evening.
And if anyone offers to recover your account for a fee — a “support agent” who found you on social media, a helpline number from a video comment — walk away. Instagram has no phone support for personal accounts and recovery is free; paying a stranger for access is a second scam riding on the first.
Google and Gmail: use the recovery page from a familiar device
Google’s recovery lives at accounts.google.com/signin/recovery — type it, don’t search for it and hope the top result is genuine. Then do the recovery from a phone, tablet or browser where you’ve signed into the account before, on a network you normally use. Google weighs familiar device and location heavily when deciding it’s really you.
Answer with the last password you remember, and keep answering: if one option is unavailable (“we can’t send a code to that number anymore”), use the Try another way option rather than giving up. Google often offers backup codes, an authenticator app on a device still signed in, or a different route if you keep asking. Spamming attempts back-to-back can lock you out temporarily, so make each attempt careful and consistent.
One honest limit: if the attacker changed your recovery options and you can’t prove ownership any other way, even Google’s own support staff can’t bypass verification — there is no back door to ask for. In that case, wait a day and try again from your most familiar device; sometimes the checks offered are different the second time.
Facebook: facebook.com/hacked is the front door
Meta’s hacked-account flow lives at facebook.com/hacked. As with Google, use a device you’ve logged into Facebook from before. If you can’t get in that way, facebook.com/login/identify lets you find your account and walks through the recovery options it can offer.
If you still control the email address or phone number on the account, the fastest route is usually the password reset Facebook offers. If the attacker changed the email address, Facebook sends an alert to your old address — check that any such message is genuinely from Meta before acting on it, and reverse the change from there if the option is offered.
One thing people miss: if you run a Page or manage ads from the account, the damage may not end with your profile. Check admin roles and recent activity on anything you manage before you consider the incident closed.
Instagram: start inside the app’s own login flow
On the Instagram login screen, use Forgot password? (iPhone) or Get help logging in (Android) and enter your username, email or phone number. If the standard reset can’t reach you because the attacker changed everything, the flow offers Need more help? — that’s where you tell Instagram your account was hacked and it starts the identity route, which can include a video selfie to prove you’re you.
Also check your original email inbox for a message from security@mail.instagram.com about an email change. It carries a link to undo that change, and it’s often the fastest recovery path of all — but only if you act before the attacker moves further. And if your Instagram was linked to a Facebook account you still control, logging in through Facebook can restore access.
The moment you’re back in, change the password to something completely new — not a variation of the old one, and not the one you use everywhere else.
WhatsApp: re-registering is the eviction notice
WhatsApp recovery is short and decisive. On your phone, with your SIM inside, open WhatsApp and tap Log back in, enter your number, and type in the 6-digit code that arrives by SMS or phone call. Re-registering with that code automatically signs out every other device on the account — including the attacker’s.
Never share that code with anyone, not even someone claiming to be helping you recover the account. Sharing it is almost always how the account was taken in the first place.
Two complications worth knowing about. If WhatsApp asks for a two-step-verification PIN you never set, the attacker enabled one after taking over — you can reset it through a recovery email if you’d linked one, or you wait seven days and try again. Either way, the attacker is already logged out the moment you enter the 6-digit code; they can’t use the account while you wait. And if you can’t receive the code at all, talk to your mobile carrier first — a SIM swap is one way a thief takes over a number, and a replacement SIM on your number fixes the root of it.
You’re back in. Now close the doors they opened.
Getting back in is halftime, not the final whistle. Attackers habitually leave themselves a way back, and skipping this sweep is why so many people get hacked twice.
First, end the attacker’s sessions. Google shows every device signed into your account under Your devices; Facebook and Instagram have equivalent session lists. Sign out everything you don’t recognize — or everything, and sign back in yourself.
Second, check what changed. Attackers routinely add their own email address or phone number to the recovery options so they can reset their way back in. Remove anything you didn’t put there and re-add recovery methods you control.
Third, review connected apps and linked accounts. Check Google’s third-party access page for apps you don’t recognize, and on Meta’s side, look at Accounts Center for any account you don’t control — a linked unknown account is a re-entry route even after a password change.
Fourth, check your email forwarding rules and filters. This one is sneaky: an attacker in your inbox can quietly forward password-reset emails to themselves, then lock you out of other accounts weeks later without touching your password at all.
Fifth, turn on two-factor authentication if it isn’t already on, and generate a fresh set of backup codes stored somewhere offline — your previous ones may have been seen.
Secure the master key: your email
If your email account itself was the one compromised, it gets secured first, before anything else. Email is the master key to your other accounts: every password reset, every recovery link, every “is this you?” message flows through it. An attacker still in your inbox can undo every other recovery you perform, simply by asking each service to reset again.
The same applies in reverse: if a service account was taken but your email is safe, the email is your greatest asset in getting it back. Keep it that way with a unique password and two-factor turned on.
Warn the people the attacker contacted
While you had your account back, the attacker may have messaged your contacts — often asking for money or sending links. A short, plain post or message from you (“I was hacked today — please ignore anything sent from my account asking for money or links”) stops most of the secondary damage and saves friends from falling for it themselves. If anyone paid or clicked, tell them to contact their bank or report the phishing promptly.
Recovering an account feels urgent, and it is. But the order is what matters: the official recovery page first, from a device you trust; a sweep for leftover access the moment you’re in; the email account secured as the priority; and a setup — two-factor, fresh backup codes, no unknown sessions — that makes the next attempt bounce off. A hacked account is a bad afternoon. An account the attacker can get back into tomorrow is a bad year.
More guides like this live in our Online Safety section.
