Your account was hacked: spot it, recover it, stay safe

A hacked account rarely announces itself with a password change: a noisy takeover does not benefit a thief. Far more often the access is quiet: someone reads your mail, browses your chats, and the account waits for its moment to send spam or withdraw money. So half the job is to notice the outside presence in time, the other half is to act fast and in the right order, giving the thief no time to dig in. This article is that order: from signs to cleanup.

Signs of outside access

• Sessions and devices. The security settings of any major service include a list of active sessions: an unfamiliar city or device is a signal, no "location glitch".
• Emails read by someone else, missing or appearing in Sent. Check forwarding rules and filters separately: quietly forwarding copies outside is a favorite trick.
• Notifications of a login or data change you did not make, including "your login code" when you were logging in nowhere: someone already stands at the door with your password.
• Activity in your name: messages to friends, likes, ads, loan applications.
• Changed recovery data: someone else's backup mail or number in the settings is a prepared back door.

The first 30 minutes, access is still yours

1. Change your password to a new one used nowhere else. If the same password stood anywhere else, change it there too: trying leaked pairs across services is the main hacking method.
2. End all sessions with the "sign out on all devices" button: it throws the thief out even if they are inside right now.
3. Enable a second factor, preferably an authenticator app: we covered how to choose in the article on two-factor authentication. Save the backup codes.
4. Check and restore your recovery data: mail, phone, secret questions.
5. Go through forwarding rules, filters, linked apps and granted access: delete everything unfamiliar.

The order is exactly this: password, sessions, factor, recovery, cleanup. Start with cleanup and the thief has time to change the password, and then a harder scenario begins.

How to learn about a hack before anyone else

It pays to check yourself and not wait for signs. Password managers and browsers have built-in leak checks: they compare your saved passwords with known databases and highlight compromised ones. Major services' security pages show login history going back weeks: five minutes a month on this history catches quiet access before it grows into damage. Keep login and settings-change notifications on even if they seem annoying, and put them somewhere visible: they are your alarm, and their silence is information too.

The password was already changed without you

Go to the service's access recovery form: major platforms have a separate "account hacked" route that relies on recovery data and history. Answer from your usual device and network: systems take into account where the request comes from, and a home address raises trust. Old passwords, the approximate account creation date, linked cards and addresses all help: things the real owner remembers and a thief does not know. Meanwhile warn people close to you through another channel: while the account is in other hands, someone will surely ask your whole address book for money in your name. And if other services recover through this mailbox, urgently unlink it there or strengthen them with a second factor: thieves unwind the "mail, then everything else" chain on autopilot.

If money is at stake, act alongside the recovery: for stolen bank access, block cards and access by calling the bank, and note times and amounts. For work accounts, warn the administrator at once: a company has levers you do not, from resetting sessions to revoking tokens. The shame of "I fell for it" is the worst adviser here: the sooner you speak, the less the damage, and security people know this well.

Cleanup after getting back

Deal with the cause too: where the password leaked from. Reuse on a hacked service, a phishing page like the ones in our phishing breakdown, malware on the device: each cause has its own prevention, and without it the story repeats. Check the device you usually log in from with an antivirus before the final password change: if an interceptor sits on it, new passwords go the same way as the old ones.

And turn the incident into an upgrade: a password manager with unique passwords, a second factor on everything important, passkeys where available. An account once hacked becomes stronger with such protection than one never hacked: you now have both motivation and a plan. You will never need half of this article again, and that is its best result.