Getting a hacked account back is only half the job: attackers who take over an email or social media account usually leave behind a forwarding rule, a new recovery address, a connected app or a signed-in device that lets them walk straight back in. This guide gives a step-by-step recovery sequence for a hijacked email or social media account, the provider routes for Google, Apple, Microsoft and the main social platforms, and a thorough clean-up checklist for the things attackers change. It is for anyone locked out of an account, for the friends and relatives helping them, and for small organisations whose shared or public accounts have been taken over. Setting up an email account securely in the first place is covered in the Securing Your Email Account Guide; this page is about the response once something has gone wrong.
Key takeaways
- Secure your email first. The FTC warns that a hacked email account can be used to reset the passwords on your other accounts, so recover and lock down email before anything else.
- Use only the provider's own recovery route. Go to the recovery page yourself (for example accounts.google.com/signin/recovery or iforgot.apple.com); fake "recovery services" are a common follow-up scam.
- Changing the password is not enough. Sign out all other sessions, then check recovery email and phone, forwarding rules, filters, delegates and connected apps.
- Clean the device you recover from. NCSC and the FTC both say to update your devices and scan for malicious software, because a password typed on an infected device can be stolen again.
- Two-step verification blocks most repeat attacks. In the 2026 Instagram support assistant takeovers, Meta's filing showed accounts with two-factor authentication were not taken over.
Is it really hacked? The signs
The FTC, Apple and Google list the same core warning signs. Any one of them is reason to act now.
| Sign | What it usually means | First action |
|---|---|---|
| You cannot sign in, or your password no longer works | The attacker has changed the password, and possibly the recovery details | Start the provider's recovery process immediately |
| Alerts about a password, email or phone number change you did not make | Takeover in progress | Use the "this wasn't me" or "secure your account" link in the provider's own app or site, not in an email |
| Sign-in alerts from devices or places you do not recognise | Someone has your password, or a stolen session | Change the password and sign out all sessions |
| Two-step codes you did not request | Someone has your password and is trying to get past the second step | Do not share or approve; change the password (NCSC) |
| Friends receive messages or posts you did not send | The account is being used to scam your contacts | Recover the account and warn contacts through another channel |
| Your iPhone or Mac is locked or in Lost Mode by someone else | Your Apple Account has been taken over (Apple) | Reset the Apple Account password or start recovery |
Step by step: getting back in
- Use a clean device: if you suspect malware, recover from a different, up-to-date device. The FTC says to update your security software, run a scan, delete anything suspicious and restart before you begin.
- Try the normal password reset: if the attacker has not changed your recovery email or phone number, a standard reset gets you straight back in.
- If the reset fails, use the provider's account recovery process: answer the questions as fully as you can, ideally from a device and location you have used before. Each provider's route is in the table below.
- Change the password to a new, unique one: never one you have used before. Store it in a password manager.
- Sign out every other session: the FTC and NCSC both say to sign out of all devices and apps you do not recognise, so the attacker's session ends. A stolen session cookie can stay valid after a password change on some services until it is explicitly signed out.
- Turn on two-step verification: use an authenticator app, a passkey or a security key rather than SMS where you can. See the Two-Factor Authentication for Everyone Guide.
- Work through the clean-up checklist in the next section before you treat the account as safe.
Provider recovery routes
| Provider | Recovery route | What to check afterwards |
|---|---|---|
| Google (Gmail, YouTube) | accounts.google.com/signin/recovery; try recovering the username first if unsure which account it is | Security and sign-in: Review security events (choose "No, it wasn't me" for anything unfamiliar) and Manage devices |
| Apple Account | Password reset; if that fails, account recovery at iforgot.apple.com, which includes a waiting period | account.apple.com personal and security details, trusted devices, and that every linked email and phone number is yours |
| Microsoft (Outlook, Hotmail) | Microsoft's password reset, then its account recovery form if you cannot verify | Security info, recent activity, and inbox rules and forwarding in Outlook settings |
| Hacked account process: a login link sent to your email, a security code, and if needed a video selfie identity check | Email and phone on the profile, logged-in devices, connected apps | |
| Meta's dedicated hacked account flow (facebook.com/hacked) | Contact details, recognised devices, and any pages or ad accounts you manage | |
| Re-register the number on your own phone with the SMS code, which signs the attacker out | Set a two-step verification PIN so the number cannot be re-registered without it | |
| X, TikTok, LinkedIn, Snapchat | Each provider's own hacked account page; the FTC links to official instructions for each | Email, phone, sessions and connected apps |
If recovery keeps failing
- Recover from familiar ground: use a device, browser and network you have signed in from before; recovery systems weigh these signals.
- Give exact answers: old passwords you remember, when you created the account and the recovery details you used to have all help.
- Wait out any recovery period: Apple's account recovery includes a waiting period, and repeated new requests can restart it.
- Never pay anyone to recover it: provider support is free; paid "recovery experts" contacting you are scammers.
If you genuinely cannot recover the account, NCSC advises creating a new one, telling your contacts the new details, and updating any bank, utility or shopping accounts that used the old address.
The clean-up checklist: what attackers leave behind
Google's own checklist after a compromise is long because attackers make many small changes. These are the ones that let them return or keep reading your messages.
| Where | What to check | Why it matters |
|---|---|---|
| Recovery details | Recovery email, recovery phone, alternate email, security questions (Google); every linked email and phone (Apple) | An attacker's address here lets them reset your password again at any time |
| Email forwarding | Forwarding addresses in settings (FTC, NCSC, Google) | Silently copies every message, including password reset emails, to the attacker |
| Filters and inbox rules | Rules that delete, archive or mark as read messages from your bank or the provider | Hides alerts so you do not notice further misuse |
| Delegation and IMAP/POP | Delegated access and enabled mail access protocols in Gmail (Google) | Gives another account or app ongoing access without your password |
| Signed-in devices and sessions | Every device, browser and app session | A live session survives a password change on some services |
| Connected apps | Third-party apps with access to your account (Google lists "apps with access") | An app granted access keeps working after the password is changed. See the Consent Phishing and Illicit OAuth Grants Guide |
| Two-step settings | Methods added by the attacker, such as a new phone or authenticator | An attacker's authenticator lets them pass your second step |
| Sent and deleted folders | Messages the attacker sent, or read and deleted (FTC) | Shows who was targeted from your account and what was taken |
| Social posts, messages and friends | Posts, direct messages and new connections you did not make (FTC) | Often used to scam your followers |
| Payments | Google Pay, Google Play, saved cards, ad accounts (Google); Apple Media and Purchases | Attackers make purchases or run ads with saved payment details |
| Phone carrier | Ask the carrier and email provider to check for unauthorised SMS forwarding (Apple) | SMS forwarding hands the attacker your codes |
Google also notes that if it disables a suspicious sign-in method, you have 30 days to confirm it is yours before it is deleted, so review these notices promptly.
Check the accounts connected to the hacked one
An email account sits at the centre of a web of other accounts. After recovering it, work outwards.
- Accounts with the same password: NCSC and Google say to change the password on every account that used the same or a similar password.
- Accounts that send resets to this email: banking, shopping, social media, cloud storage and utilities. Check their recent activity.
- Accounts where you "sign in with" this account: Google lists sites where you sign in with your Google Account and passwords saved in your account as places to check.
- Bank and shopping accounts: NCSC advises checking for unauthorised activity and contacting your bank only through official channels, not links in messages.
- Your device's Apple Account or Google account: Apple says to check each device's settings to confirm the signed-in account is yours, including FaceTime, Messages, Mail and Calendar.
If the attacker used your account to commit fraud or impersonate you, Google recommends contacting your bank or local authorities, and NCSC says to report any financial loss to your bank and to Report Fraud at reportfraud.police.uk, or to Police Scotland on 101. The What to Do If You Have Been Scammed Guide covers money losses.
Tell your contacts, safely
Hackers use a taken-over account to send convincing messages to everyone who trusts it: requests for money, links to phishing pages, or "vote for me" and verification code scams that spread the takeover to friends.
- Warn through another channel: the FTC suggests telling friends and family by email, text or a post, and warning them not to click links from your account and to ignore requests for help or money.
- Be specific about the time window: tell them which messages to distrust, for example anything sent between two dates.
- Check whether friends were compromised: if a contact entered a code or password because of a message from your account, they need to follow this guide too.
- For a business or community page: post a notice once recovered, and review admin and editor roles for anyone who should not be there.
Lessons from incidents
Account recovery is itself an attack surface. Between April and June 2026, attackers took over more than 20,000 Instagram accounts by asking Meta's AI support assistant to send recovery links to email addresses they controlled, according to Meta's filing with the Maine Attorney General. Accounts with two-factor authentication were not taken over. See the Meta AI Instagram Account Takeover 2026. The practical lessons for individuals: turn on two-step verification before you need it, keep your recovery email and phone current, and treat any unexpected reset code as an alert that someone is trying. See the Account Recovery Planning Guide for setting up recovery options in advance.
Choosing your protection after recovery
| Option | Protection | Best for |
|---|---|---|
| SMS codes | Better than nothing, but exposed to SIM swap and phishing | Accounts that offer nothing else |
| Authenticator app | Stronger; NCSC says authenticator apps are more secure than SMS codes | Most personal email and social accounts |
| Passkey | Phishing-resistant and easy to use | Google, Apple, Microsoft and other services that support it |
| Security key | Phishing-resistant; Apple recommends considering Security Keys for its accounts | Public figures, account administrators and anyone who has been targeted repeatedly |
Whatever you choose, save backup codes somewhere safe and offline; losing your only second factor is a common cause of a second lock-out. See the SIM Swap Fraud Guide if your phone number was involved.
Signs it is fixed, and what to watch
- Recent activity is clean: no new sign-ins from unknown devices or places for several weeks after recovery.
- Settings stay as you left them: recovery details, forwarding and rules unchanged when you check again a week later.
- No new alerts: no password reset emails or two-step codes you did not request. If they return, the attacker still has your password or access to your email or phone.
- Contacts report no new messages from you.
For organisations helping staff or customers, useful measures are the time from report to recovered account, the share of recovered accounts with two-step verification turned on, and the rate of repeat compromise within 90 days.
Common failure patterns
- Changing the password and stopping there: the forwarding rule or connected app keeps working, and the attacker is back within days.
- Recovering on an infected computer: an infostealer captures the new password too.
- Using a "hacked account recovery" service found online: these often charge a fee and take over the account themselves. Use only the provider's own pages.
- Leaving the attacker's recovery phone or email in place: they reset the password again at will.
- Not checking reused passwords: the same password opens the attacker's next target.
- Not warning contacts: friends lose money to messages sent from the hijacked account.
Framework mapping
| What the attacker did | MITRE ATT&CK | Recovery step | NIST CSF 2.0 |
|---|---|---|---|
| Signed in with a stolen password | T1078 Valid Accounts; T1110.004 Credential Stuffing | New unique password, two-step verification | PR.AA-03 |
| Added a forwarding rule | T1114.003 Email Forwarding Rule | Remove forwarding | RS.MI-02 |
| Added rules to hide alerts | T1564.008 Email Hiding Rules | Review filters and inbox rules | RS.MI-02 |
| Changed recovery details or added a second factor | T1098 Account Manipulation | Correct recovery details and two-step methods | RS.MI-02 |
| Kept a live session | T1539 Steal Web Session Cookie | Sign out all sessions | RS.MI-01 |
| Used the account to scam contacts | T1586.002 Email Accounts | Warn contacts through another channel | RS.CO-02 |
Practitioner checklist
- Recover from a clean, updated device after scanning for malicious software.
- Use only the provider's own recovery page: Google, Apple (iforgot.apple.com), Microsoft, Instagram, Facebook and others.
- Set a new unique password and sign out of all other sessions.
- Turn on two-step verification with an authenticator app, passkey or security key, and save backup codes.
- Check recovery email and phone, forwarding, filters, delegates, IMAP/POP, connected apps and two-step methods.
- Review sent and deleted folders, posts, messages and saved payment details.
- Change every reused password and check accounts that reset through this email.
- Warn contacts through another channel and report any financial loss to your bank and Report Fraud or Police Scotland.
- Recheck settings and activity a week later.
Standards and references
- National Cyber Security Centre: Recovering a hacked account
- US Federal Trade Commission: How To Recover Your Hacked Email or Social Media Account
- Google: Secure a hacked or compromised Google Account
- Apple: If you think your Apple Account has been compromised
- Instagram Help Centre: How to fix and secure hacked Instagram profiles
- Google: See devices with account access
Related NHI Mgmt Group resources: Securing Your Email Account Guide · Account Recovery Planning Guide · Account Takeover Prevention Guide · Two-Factor Authentication for Everyone Guide · What to Do If You Have Been Scammed Guide