In the first 15 minutes
- Try to sign in and reset the password using the normal "Forgot password?" link. If it works, change the password at once and sign out all other sessions.
- Search your email for a security message from the service, such as "Your email address was changed" or "New login". These usually contain a link like "This wasn't me" or "Secure your account" that reverses the hacker's changes. Use it quickly, as it can expire.
- Secure your email account first if you suspect it is also compromised. Whoever controls your email can reset everything else.
- Warn your friends and followers through another channel. Hacked accounts are used to message contacts asking for money or for a login code.
Then use the official recovery page for the service.
Official recovery pages
| Service | Where to start |
|---|---|
| instagram.com/hacked, or Need more help? on the login screen | |
| facebook.com/hacked | |
| Re-register WhatsApp on your phone with your number | |
| Google / Gmail | g.co/recover |
| Apple ID | iforgot.apple.com |
| X (Twitter) | help.x.com, the hacked account form |
| TikTok | The login screen's Forgot password and the in-app support form |
| Microsoft / Outlook | account.live.com/acsr |
Type these addresses yourself. Do not follow links from messages claiming to be from support.
Instagram and Facebook
Meta's tools work similarly for both:
- Hacked page: go to instagram.com/hacked or facebook.com/hacked and choose what happened, for example "My account was hacked" or "My email or phone was changed".
- Login link or code: Meta can send a link or code to an email or number on file, including old ones.
- Video selfie (Instagram): if your account has photos of you, Instagram may ask you to record a short video turning your head, to compare with them.
- Identity document: Facebook may ask for a photo ID.
Once you are back in, check Accounts Centre > Password and security > Where you're logged in, remove unknown devices, and change your password.
WhatsApp accounts are tied to your phone number. Usually a hacker got in by tricking you into sharing the six-digit registration code.
- Open WhatsApp on your phone and sign in with your number. Enter the SMS code you receive. This signs the hacker out.
- If you are asked for a two-step verification PIN that you did not set, the hacker set one. You will have to wait (WhatsApp shows the time) before you can register again without it.
- Turn on two-step verification yourself in Settings > Account.
- Check Linked devices and log out of any you do not recognise.
If your SIM stopped working at the same time, contact your mobile carrier immediately, as your number may have been moved to another SIM.
Google and Apple accounts
These accounts unlock email, photos, passwords and your phone, so treat them as the priority.
- Google: at g.co/recover, answer as many questions as you can from a device and location you normally use. Afterwards, run the Security Checkup at myaccount.google.com/security.
- Apple: at iforgot.apple.com, reset the password. If you use a recovery key or recovery contact, you will need them. Apple's account recovery can take days by design, to stop impostors.
After you get back in: lock it down
- Set a new, unique password with a password manager.
- Turn on two-factor authentication, ideally with an authenticator app or passkey rather than SMS. Our guide to passkeys explains the strongest option.
- Sign out of all other sessions and remove unknown devices.
- Check the recovery email and phone number and correct them.
- Review connected apps and remove any you do not use.
- Look for changes the hacker made: posts, messages, ad accounts, payment methods, email forwarding rules.
- Check whether your password appeared in a breach and change it anywhere else you used it. See how to check if your data was in a breach.
Beware of recovery scams
After a hack, people often post for help publicly. That attracts scammers who claim they can "recover any account" for a fee, sometimes pretending to be ethical hackers or company staff. They cannot, and you will lose the money. Only the company can restore your account, and its recovery tools are free.
If you cannot recover the account
- Report it as hacked or impersonating you, so it can be disabled.
- Ask friends to report it too.
- If you are being threatened or blackmailed, keep evidence and report it to the police or your country's cybercrime unit.
Key takeaways
- Look for the security email that lets you reverse the hacker's changes.
- Use only official recovery pages, typed in yourself.
- Secure your email account first; it controls the rest.
- Turn on two-factor authentication and never share login codes with anyone.