Hacked Email or Social Media Account Recovery Guide

Getting a hacked account back is only half the job: attackers who take over an email or social media account usually leave behind a forwarding rule, a new recovery address, a connected app or a signed-in device that lets them walk straight back in. This guide gives a step-by-step recovery sequence for a hijacked email or social media account, the provider routes for Google, Apple, Microsoft and the main social platforms, and a thorough clean-up checklist for the things attackers change. It is for anyone locked out of an account, for the friends and relatives helping them, and for small organisations whose shared or public accounts have been taken over. Setting up an email account securely in the first place is covered in the Securing Your Email Account Guide; this page is about the response once something has gone wrong.

Key takeaways

Secure your email first. The FTC warns that a hacked email account can be used to reset the passwords on your other accounts, so recover and lock down email before anything else.
Use only the provider's own recovery route. Go to the recovery page yourself (for example accounts.google.com/signin/recovery or iforgot.apple.com); fake "recovery services" are a common follow-up scam.
Changing the password is not enough. Sign out all other sessions, then check recovery email and phone, forwarding rules, filters, delegates and connected apps.
Clean the device you recover from. NCSC and the FTC both say to update your devices and scan for malicious software, because a password typed on an infected device can be stolen again.
Two-step verification blocks most repeat attacks. In the 2026 Instagram support assistant takeovers, Meta's filing showed accounts with two-factor authentication were not taken over.

Is it really hacked? The signs

The FTC, Apple and Google list the same core warning signs. Any one of them is reason to act now.

Sign	What it usually means	First action
You cannot sign in, or your password no longer works	The attacker has changed the password, and possibly the recovery details	Start the provider's recovery process immediately
Alerts about a password, email or phone number change you did not make	Takeover in progress	Use the "this wasn't me" or "secure your account" link in the provider's own app or site, not in an email
Sign-in alerts from devices or places you do not recognise	Someone has your password, or a stolen session	Change the password and sign out all sessions
Two-step codes you did not request	Someone has your password and is trying to get past the second step	Do not share or approve; change the password (NCSC)
Friends receive messages or posts you did not send	The account is being used to scam your contacts	Recover the account and warn contacts through another channel
Your iPhone or Mac is locked or in Lost Mode by someone else	Your Apple Account has been taken over (Apple)	Reset the Apple Account password or start recovery

Step by step: getting back in

Use a clean device: if you suspect malware, recover from a different, up-to-date device. The FTC says to update your security software, run a scan, delete anything suspicious and restart before you begin.
Try the normal password reset: if the attacker has not changed your recovery email or phone number, a standard reset gets you straight back in.
If the reset fails, use the provider's account recovery process: answer the questions as fully as you can, ideally from a device and location you have used before. Each provider's route is in the table below.
Change the password to a new, unique one: never one you have used before. Store it in a password manager.
Sign out every other session: the FTC and NCSC both say to sign out of all devices and apps you do not recognise, so the attacker's session ends. A stolen session cookie can stay valid after a password change on some services until it is explicitly signed out.
Turn on two-step verification: use an authenticator app, a passkey or a security key rather than SMS where you can. See the Two-Factor Authentication for Everyone Guide.
Work through the clean-up checklist in the next section before you treat the account as safe.

Provider recovery routes

Provider	Recovery route	What to check afterwards
Google (Gmail, YouTube)	accounts.google.com/signin/recovery; try recovering the username first if unsure which account it is	Security and sign-in: Review security events (choose "No, it wasn't me" for anything unfamiliar) and Manage devices
Apple Account	Password reset; if that fails, account recovery at iforgot.apple.com, which includes a waiting period	account.apple.com personal and security details, trusted devices, and that every linked email and phone number is yours
Microsoft (Outlook, Hotmail)	Microsoft's password reset, then its account recovery form if you cannot verify	Security info, recent activity, and inbox rules and forwarding in Outlook settings
Instagram	Hacked account process: a login link sent to your email, a security code, and if needed a video selfie identity check	Email and phone on the profile, logged-in devices, connected apps
Facebook	Meta's dedicated hacked account flow (facebook.com/hacked)	Contact details, recognised devices, and any pages or ad accounts you manage
WhatsApp	Re-register the number on your own phone with the SMS code, which signs the attacker out	Set a two-step verification PIN so the number cannot be re-registered without it
X, TikTok, LinkedIn, Snapchat	Each provider's own hacked account page; the FTC links to official instructions for each	Email, phone, sessions and connected apps

If recovery keeps failing

Recover from familiar ground: use a device, browser and network you have signed in from before; recovery systems weigh these signals.
Give exact answers: old passwords you remember, when you created the account and the recovery details you used to have all help.
Wait out any recovery period: Apple's account recovery includes a waiting period, and repeated new requests can restart it.
Never pay anyone to recover it: provider support is free; paid "recovery experts" contacting you are scammers.

If you genuinely cannot recover the account, NCSC advises creating a new one, telling your contacts the new details, and updating any bank, utility or shopping accounts that used the old address.

The clean-up checklist: what attackers leave behind

Google's own checklist after a compromise is long because attackers make many small changes. These are the ones that let them return or keep reading your messages.

Where	What to check	Why it matters
Recovery details	Recovery email, recovery phone, alternate email, security questions (Google); every linked email and phone (Apple)	An attacker's address here lets them reset your password again at any time
Email forwarding	Forwarding addresses in settings (FTC, NCSC, Google)	Silently copies every message, including password reset emails, to the attacker
Filters and inbox rules	Rules that delete, archive or mark as read messages from your bank or the provider	Hides alerts so you do not notice further misuse
Delegation and IMAP/POP	Delegated access and enabled mail access protocols in Gmail (Google)	Gives another account or app ongoing access without your password
Signed-in devices and sessions	Every device, browser and app session	A live session survives a password change on some services
Connected apps	Third-party apps with access to your account (Google lists "apps with access")	An app granted access keeps working after the password is changed. See the Consent Phishing and Illicit OAuth Grants Guide
Two-step settings	Methods added by the attacker, such as a new phone or authenticator	An attacker's authenticator lets them pass your second step
Sent and deleted folders	Messages the attacker sent, or read and deleted (FTC)	Shows who was targeted from your account and what was taken
Social posts, messages and friends	Posts, direct messages and new connections you did not make (FTC)	Often used to scam your followers
Payments	Google Pay, Google Play, saved cards, ad accounts (Google); Apple Media and Purchases	Attackers make purchases or run ads with saved payment details
Phone carrier	Ask the carrier and email provider to check for unauthorised SMS forwarding (Apple)	SMS forwarding hands the attacker your codes

Google also notes that if it disables a suspicious sign-in method, you have 30 days to confirm it is yours before it is deleted, so review these notices promptly.

Check the accounts connected to the hacked one

An email account sits at the centre of a web of other accounts. After recovering it, work outwards.

Accounts with the same password: NCSC and Google say to change the password on every account that used the same or a similar password.
Accounts that send resets to this email: banking, shopping, social media, cloud storage and utilities. Check their recent activity.
Accounts where you "sign in with" this account: Google lists sites where you sign in with your Google Account and passwords saved in your account as places to check.
Bank and shopping accounts: NCSC advises checking for unauthorised activity and contacting your bank only through official channels, not links in messages.
Your device's Apple Account or Google account: Apple says to check each device's settings to confirm the signed-in account is yours, including FaceTime, Messages, Mail and Calendar.

If the attacker used your account to commit fraud or impersonate you, Google recommends contacting your bank or local authorities, and NCSC says to report any financial loss to your bank and to Report Fraud at reportfraud.police.uk, or to Police Scotland on 101. The What to Do If You Have Been Scammed Guide covers money losses.

Tell your contacts, safely

Hackers use a taken-over account to send convincing messages to everyone who trusts it: requests for money, links to phishing pages, or "vote for me" and verification code scams that spread the takeover to friends.

Warn through another channel: the FTC suggests telling friends and family by email, text or a post, and warning them not to click links from your account and to ignore requests for help or money.
Be specific about the time window: tell them which messages to distrust, for example anything sent between two dates.
Check whether friends were compromised: if a contact entered a code or password because of a message from your account, they need to follow this guide too.
For a business or community page: post a notice once recovered, and review admin and editor roles for anyone who should not be there.

Lessons from incidents

Account recovery is itself an attack surface. Between April and June 2026, attackers took over more than 20,000 Instagram accounts by asking Meta's AI support assistant to send recovery links to email addresses they controlled, according to Meta's filing with the Maine Attorney General. Accounts with two-factor authentication were not taken over. See the Meta AI Instagram Account Takeover 2026. The practical lessons for individuals: turn on two-step verification before you need it, keep your recovery email and phone current, and treat any unexpected reset code as an alert that someone is trying. See the Account Recovery Planning Guide for setting up recovery options in advance.

Choosing your protection after recovery

Option	Protection	Best for
SMS codes	Better than nothing, but exposed to SIM swap and phishing	Accounts that offer nothing else
Authenticator app	Stronger; NCSC says authenticator apps are more secure than SMS codes	Most personal email and social accounts
Passkey	Phishing-resistant and easy to use	Google, Apple, Microsoft and other services that support it
Security key	Phishing-resistant; Apple recommends considering Security Keys for its accounts	Public figures, account administrators and anyone who has been targeted repeatedly

Whatever you choose, save backup codes somewhere safe and offline; losing your only second factor is a common cause of a second lock-out. See the SIM Swap Fraud Guide if your phone number was involved.

Signs it is fixed, and what to watch

Recent activity is clean: no new sign-ins from unknown devices or places for several weeks after recovery.
Settings stay as you left them: recovery details, forwarding and rules unchanged when you check again a week later.
No new alerts: no password reset emails or two-step codes you did not request. If they return, the attacker still has your password or access to your email or phone.
Contacts report no new messages from you.

For organisations helping staff or customers, useful measures are the time from report to recovered account, the share of recovered accounts with two-step verification turned on, and the rate of repeat compromise within 90 days.

Common failure patterns

Changing the password and stopping there: the forwarding rule or connected app keeps working, and the attacker is back within days.
Recovering on an infected computer: an infostealer captures the new password too.
Using a "hacked account recovery" service found online: these often charge a fee and take over the account themselves. Use only the provider's own pages.
Leaving the attacker's recovery phone or email in place: they reset the password again at will.
Not checking reused passwords: the same password opens the attacker's next target.
Not warning contacts: friends lose money to messages sent from the hijacked account.

Framework mapping

What the attacker did	MITRE ATT&CK	Recovery step	NIST CSF 2.0
Signed in with a stolen password	T1078 Valid Accounts; T1110.004 Credential Stuffing	New unique password, two-step verification	PR.AA-03
Added a forwarding rule	T1114.003 Email Forwarding Rule	Remove forwarding	RS.MI-02
Added rules to hide alerts	T1564.008 Email Hiding Rules	Review filters and inbox rules	RS.MI-02
Changed recovery details or added a second factor	T1098 Account Manipulation	Correct recovery details and two-step methods	RS.MI-02
Kept a live session	T1539 Steal Web Session Cookie	Sign out all sessions	RS.MI-01
Used the account to scam contacts	T1586.002 Email Accounts	Warn contacts through another channel	RS.CO-02

Practitioner checklist

Recover from a clean, updated device after scanning for malicious software.
Use only the provider's own recovery page: Google, Apple (iforgot.apple.com), Microsoft, Instagram, Facebook and others.
Set a new unique password and sign out of all other sessions.
Turn on two-step verification with an authenticator app, passkey or security key, and save backup codes.
Check recovery email and phone, forwarding, filters, delegates, IMAP/POP, connected apps and two-step methods.
Review sent and deleted folders, posts, messages and saved payment details.
Change every reused password and check accounts that reset through this email.
Warn contacts through another channel and report any financial loss to your bank and Report Fraud or Police Scotland.
Recheck settings and activity a week later.

Hacked Social Media or Email Account Recovery Guide