What to Do If Your Account Is Hacked

Short answer: Secure the email inbox first — it is the master key that resets everything else. Then, on each compromised account: change the password, sign out all active sessions, remove unknown recovery emails, phone numbers, app passwords and forwarding rules, and only then turn on two-factor authentication. Resetting a password without killing existing sessions leaves the attacker logged in.

Most account takeovers are credential stuffing: a password reused from a site that was breached years ago. That is why the fix is not just one password but every place that password went.

Recovery in order

1. Email first: new unique password, sign out all devices, check filters and forwarding rules for silent copies going out.
2. Check the account's security activity log and note the times and locations you do not recognise.
3. Remove unknown recovery phone numbers, backup emails, trusted devices and third-party app access.
4. Turn on two-factor authentication with an authenticator app or hardware key rather than SMS where possible.
5. Save the backup codes somewhere offline.
6. Repeat for banking, then social, then shopping accounts — highest damage first.
7. If money moved, tell the bank the same day and report it to the national fraud service.

Signs it happened at all

After the clean-up

Check whether your address appears in known breaches, review connected apps every few months, and keep two-factor backup codes printed somewhere physical. If a work account was involved, tell your IT team immediately — the same credentials often unlock far more than your inbox.