What to do if your account has been hacked

Signs that someone else is in your account

• Emails or messages you didn’t send, often links or requests for money.
• Sign-in alerts from devices or places you don’t recognise.
• Your password no longer works, or your recovery email or phone number has changed.
• Payments or orders you didn’t make.

What to do in the first hour

If it was your email that was hacked, move fast: whoever controls your email can reset the passwords of your other accounts.

• Change the password from a device you trust: If you can still sign in, change the password straight away to a long, unique one. If the device you normally use might be infected, use another.
• Use the official recovery page if you’re locked out: Go to the company’s website or app yourself, not through a link in an email, and follow its “forgot password” or “hacked account” steps.
• Sign out everywhere: Most services show where you’re signed in and let you sign out of every device. Remove anything you don’t recognise.
• Check your recovery details: Make sure the recovery email address and phone number are still yours. Attackers often change them so they can come back.
• Turn on two-step verification: With a code from your phone or a security key, a stolen password alone is no longer enough to get in.

Then, look a little wider

Once the account is back in your hands, check what else could be affected:

• Any account with the same password. Give each one its own unique password.
• Your bank and cards. If money or card details may be involved, call your bank on the number printed on your card.
• Your contacts. Let friends know not to open links sent from your account in the last few days.
• Your computer and phone. Install the latest updates, and run a security scan if you think a device was infected.

Mistakes to avoid

• Clicking the “security alert” link: Fake alerts are a common trick. Open the app, or type the address yourself.
• Going back to the old password: Even with a small change, it may already be on a list attackers use.
• Reading out a code to “support”: Real companies never ask for your sign-in codes. Anyone who does is trying to get in.
• Waiting to see what happens: The longer someone has access, the more they can read, change or spend.

Make the next one less likely

Many account takeovers start with a password that was reused or easy to guess. A password manager like SyFly gives every account its own strong password, so one leak stays one leak.

Not sure whether a password has already leaked? Check it with our free password health check, then follow our guides to strong passwords and two-step verification.

• A unique password for every website, created and filled in for you.
• Recovery codes kept safe in encrypted notes, ready when you need them.
• Everything encrypted on your device, so SyFly can’t read your passwords either.

• password health check
• strong passwords
• two-step verification

Questions

Should I report it?

Yes. Tell the company first, through its official help pages. If money was taken, contact your bank straight away; if you lost money or someone used your identity, you can also report it to the police or your country’s fraud reporting service.

How did they get my password?

Usually from a data leak on another website where you used the same password, a fake login page, or a password that was easy to guess. Often it has nothing to do with anything you did on that account.

Is changing my password enough?

It’s the first step. Signing out other devices, checking your recovery details and turning on two-step verification stop the attacker from coming straight back in.