7 steps to take right after an account is hacked

Regaining control of a hacked account takes fast and ordered action. You need to secure your hardware first so you can lock the intruder out and undo the damage they left behind. Work through these seven steps to stop the immediate threat.

1. Scan the device you use for the account

The device you use for the account might be the source of the breach. Malware running on your laptop may capture your new password as you type it. You must clear the hardware before changing any account details. Do this on every computer or phone you regularly use.

The FTC says to update your security software, run a scan and delete any suspicious software it finds. Open your antivirus program first. Look for the settings menu and check for software updates. A program may not catch new threats if its definitions are out of date.

Once the software is up to date, choose the option for a full system scan rather than a quick scan. A full scan examines more of your files and can take a while. Let the scan run completely, then follow the prompts to quarantine or remove every threat the software identifies. Restart your computer afterward.

2. Recover access through the provider's official steps

Intruders may change the password to lock you out. Go to the login page of the email or social media service and click the link for forgotten passwords or compromised accounts. This starts the official recovery process where the system will ask you to verify your identity. You might need to receive a code on a backup phone number or answer security questions you set up years ago.

Follow the on-screen prompts closely and use only the recovery steps on the provider's official website. Be cautious about searching for a support phone number, since some results can lead to scammers posing as the provider.

If the automated recovery tool fails, look for a dedicated compromised account form in the provider's help center. Some services may ask for extra proof that the account is yours, so follow the provider's instructions. Review times vary. Submit the form once and wait for their response.

3. Change the password and sign out everywhere

Set a new password right away once you regain access. Pick a combination of words, numbers and symbols that you do not use on any other website. A strong password helps keep the intruder from logging back in with the stolen credentials. Make the password long and hard to guess, such as a string of unrelated words that is easy to type.

Changing the password does not always disconnect active sessions. The FTC advises signing out of all devices so anyone logged in on another device gets kicked out. Look in your account security settings. Find the menu labeled active sessions, recognized devices or signed-in devices.

You will see a list of phones and computers connected to your account. Choose the option to sign out everywhere to sever the connection to the attacker's computer. It forces every device to enter the new password before loading your messages. You will have to log back in on your own phone, but this should sign out anyone else who was connected.

4. Turn on two factor authentication

A password alone is often not enough to protect sensitive information, so you need a second layer of security. This stops an attacker who guesses your password or buys it from a data breach. A second factor means the service asks for something extra, such as a PIN or a one-time code, along with your password. The attacker usually cannot log in without it.

Open the security or privacy menu in your account settings. Turn on two factor authentication. The menu might call this two-step verification or login approval. You can usually choose to receive a code by text message or use an authenticator app.

Text messages, email and authenticator apps are all common ways to receive a code, and not every service offers all three. Understanding how the codes work helps you decide which method fits your daily routine. Set up the method you prefer and save any backup codes in a safe place.

5. Check recovery details and forwarding rules

Attackers may leave ways to get back into your account in case you change the password. They can change recovery details to intercept your password reset codes. They might also set up rules to read your private messages. You need to close these hidden doors before you can consider the account secure.

Check your profile information first. The FTC says to make sure the recovery email addresses and phone numbers on the account are ones you entered and can access. Look closely at the spelling of any backup email addresses. Delete any unfamiliar contact methods immediately.

Inspect your inbox settings if an email account was compromised. The FTC advises reviewing email forwarding rules and deleting any you did not create. Attackers can set up rules that send copies of your messages to another address. That can give them ongoing access to sensitive messages, including password reset links for other accounts.

6. Look for messages and posts you did not send

You need to know how the attacker used your account while they had control. Open your sent messages folder, your outbox and your deleted items, and read through any emails or direct messages sent during the time you were locked out. Documenting what was sent helps you understand who the attacker targeted. It also shows you what kind of scam they were running under your name.

Check your public profile and timelines if a social media account was breached, since attackers may post spam links or scam offers. Look for new friends or followers added during the breach. Delete the spam posts right away. Remove any suspicious connections to stop the scammers from messaging those accounts later.

Look for receipts or confirmation emails in your inbox. The intruder might have used your saved payment methods to buy digital goods. Contact your bank or credit card issuer immediately if you see unauthorized charges. Tell them the account was hacked and dispute the fraudulent transactions.

7. Warn your contacts about follow up scams

The people in your contact list are the prime targets for an attacker. The intruder might have sent messages claiming you are stranded in a foreign country and asking for urgent financial assistance. They exploit the trust your friends and family have in your name. You need to warn your network before someone sends money to a criminal.

Reach out to your contacts through a different method, such as sending a text message, making a phone call or posting a public update on another platform. Do not use the compromised account to send the warning. The attacker might still have a backdoor active. Your friends might also refuse to believe the message is really from you.

The FTC suggests warning contacts not to click links in emails from you and to ignore pleas for help or money. Tell them exactly which account was compromised. Ask them to delete any unusual messages they received over the past few days. A quick warning can help your contacts avoid malware or a phishing scam.

How to protect your other digital profiles

A breach on one platform puts your other profiles at risk if you reuse passwords. Attackers take the stolen email and password combination and test it on banking sites, online stores and other social media platforms. Automated software makes it easy for criminals to try many logins quickly. Assume that any reused password may now be exposed.

Make a list of your most critical accounts, starting with your primary email, your bank and your mobile carrier. Log into each one and change the password to a unique phrase. Never use a variation of the compromised password. Adding a number to the end of your old password is easy to guess.

A built-in password manager can take the burden off your memory by generating complex passwords and filling them in automatically. This helps you avoid using the same password twice.

What to do about linked apps and subscriptions

Many websites allow you to log in using your major email or social media accounts. This is convenient, but it can give an attacker a route into those other services. You need to review the apps connected to your hacked profile. Open your account settings and look for the connected apps menu, which might also be called linked accounts or sign in with this service.

Review the list of apps authorized to access your data, and revoke access for any app you do not recognize or no longer use. If you see a shopping or payment app on the list, log into that service separately. Check its recent activity for strange purchases. Update the password on those third-party sites to sever their reliance on your compromised account.