What do I do if my account has been hacked?
The order matters — email first, then money, then everything sharing that password.
- Difficulty
- beginner
- Time
- 1 hr
- Read
- 2 min
- Safety
- warning
Short answer
Change the email password first, from a clean device, because email is how everything else gets reset. Then anything with money in it. Then everywhere you reused the same password.
Panic makes people start with the account they noticed. The right order is by consequence: email is the master key, money is the immediate loss, and reused passwords are how one breach becomes five.
Safety
Step by step
- Use a device you trust.If the computer might be compromised, changing passwords on it hands the new ones over too. Use a phone or another machine.
- Secure the email account first.New unique password and two-factor authentication. Email resets everything else, so until it is secure nothing else stays secure.
- Check email forwarding, filters and recovery settings.The step people miss. Attackers set up rules that forward or delete mail, and change the recovery address so they can get back in after a password change. Check all three.
- Then secure anything with money in it.Banking, payment services, shopping accounts with saved cards. Change passwords, enable two-factor, and check for recent transactions and any changed details.
- Contact your bank if money has moved.Immediately. Speed is the main factor in recovery. Then report it to the police and the national fraud reporting service.
- Change the password everywhere you reused it.This is how one compromise becomes many. Attackers try leaked credentials everywhere automatically. Every account that shared that password needs a new, unique one.
- Sign out all other sessions.Most services have a "sign out everywhere" or active-devices option. A password change alone does not always end existing sessions.
- Warn the people in your contacts.Compromised accounts are used to scam friends and family, and the messages are convincing because they come from you. Tell them by another channel.
Tips
- Check for new devices, apps or third-party connections authorised on the account. Attackers add these to retain access after a password change.
- Start using a password manager as part of recovering from this. Reuse is what turned one breach into several, and it is the thing to fix permanently.
- Keep a record of dates, amounts and reference numbers. It is what a bank or the police will ask for.
Questions people ask
What should I do first if I have been hacked?
Secure your email first, from a clean device — it is the reset route for everything else. Then anything with money in it, then everywhere you reused that password.
Why check email forwarding rules?
Attackers set up rules that forward or hide messages, and change the recovery address, so they can regain access after you change the password. A password change alone does not remove them.