If you get hacked: the first hour
Recognise the signs of a taken account, follow the first-hour steps in the right order, get a messenger account back, and build a small emergency kit today so you're ready.
THE SIGNS
How you usually find out
You can't log in. An email says your password or recovery phone was changed, and you didn't do it. Friends ask about messages you never sent. An unknown device appears in your account's active sessions. Your bank texts about a payment you didn't make. Any one of these is enough to act.
"Why did you ask me for money last night?" from a friend is often the first sign that a messenger account was taken.
Check yourself
Act now, or check calmly?
- Friends get messages from you asking to borrow money
- A sign-in alert right after you logged in on your new laptop
- An unknown device in your email's active sessions
- An app asks you to log in again after an update
- A bank SMS for a purchase you didn't make
Show the answer
Act now: Friends get messages from you asking to borrow money, An unknown device in your email's active sessions, A bank SMS for a purchase you didn't make
Check calmly in the app: A sign-in alert right after you logged in on your new laptop, An app asks you to log in again after an update
The first hour, in order
- Money first
If a bank card or banking app is involved, call your bank and block the card before anything else.
- Use a device you trust
If you suspect your phone or laptop itself, do the next steps from another one.
- Secure your email
Recover it through the provider's official page, set a new unique password, and check the recovery phone and email are yours.
- Take back the hacked account
Recover it the same way, set a new password, and sign out every other session or device.
- Lock it again
Turn on two-step login, or reset it if the attacker changed it. Then change that old password anywhere else you used it.
- Tell people
Warn contacts through another channel not to send money or codes, and report the account to the platform.
WHY EMAIL FIRST
Your email is the master key
Almost every "forgot password" link goes to your email. Whoever controls it can reset your other accounts one by one. Attackers know this, so they often change the recovery phone or add a forwarding rule that quietly copies your mail to them. Check both, even after you're back in.
You can win back your messenger, but if the attacker still reads your email, they can take it again tomorrow with a reset link.
Check yourself
Nazanin gets an email: "Your recovery phone number was changed." She didn't change it. She uses the same password for her email and her online shop account. What should she do first?
- Post a story telling her followers she has been hacked
- Recover her email through the official page, then change the reused password
- Wait a day to see whether the email service changed it by mistake and fixes it itself
- Open a new email address and stop using the old one
Show the answer
Recover her email through the official page, then change the reused password
Right. Email is the master key, so she wins it back first, puts her own phone back as recovery, then changes the password on the shop account that shared it.
MESSENGER TAKEOVER
Getting a messenger account back
Most messenger takeovers start with a login code someone was tricked into sharing, often by a friend's already-taken account: "I sent you a code by mistake, can you forward it?" To get back in, log in again with a fresh code, end all other sessions, and set a two-step password or PIN. If the attacker set one first, you may need the messenger's own recovery or support process, which can take days.
While the attacker is in, they message your contacts for money or for their codes. Warning people by phone call or another app stops the chain.
Check yourself
After Majid's account was taken, a stranger messages him: "I'm a security expert. I can get your account back in an hour for a small fee." Since the official recovery is slow, paying this person is a reasonable shortcut.
Show the answer
False
False. Nobody outside the platform has a back door into your account. These offers usually take the fee and disappear, or ask for your codes and take more. Official recovery is slower, but it's the only route that works.
A hacked account or a hacked device?
Hacked account
The problem is the login. Recover it, set a new password, end other sessions, turn on two-step login. Your phone itself can stay as it is.
Hacked device
Signs: apps you didn't install, pop-ups everywhere, settings changing by themselves. Remove unknown apps and update. If that doesn't fix it, back up your personal files (not the apps) and reset it to factory settings. Then change important passwords from a clean device.
Check yourself
Hossein's messenger account was taken an hour ago and it's asking his contacts for loans. His email uses the same password. His phone itself seems normal. Which plan puts the course together best?
- Reset his phone to factory settings first, because a hacked account means a hacked phone
- Message each contact from the taken account to say sorry, then deal with all the passwords properly at the weekend
- Change only the messenger password, since the email hasn't shown any problems yet
- Log back in, end other sessions, set a two-step PIN, change the email password, warn contacts by phone
Show the answer
Log back in, end other sessions, set a two-step PIN, change the email password, warn contacts by phone
Yes. Getting back in and ending sessions stops the loan requests, the PIN stops a repeat, the email change closes the reused password, and a phone call reaches friends the attacker is still writing to.
Your emergency kit, made today
- Your bank's card-blocking phone number, saved somewhere you can reach without your phone.
- Recovery codes for your email and main accounts, printed or in your password manager.
- Two-step login on email, messengers and banking, as in lesson 3.
- You know where the "active sessions" or "devices" page is in your email and messengers.
- A 3-2-1 backup, so even a factory reset only costs you an afternoon.
Course recap
- Act on the signs: changed recovery details, unknown sessions, messages you didn't send, payments you didn't make.
- First hour, in order: block cards, use a trusted device, secure email, recover the account, end other sessions, turn on two-step login, warn people.
- Only official recovery works. Paid "experts" and extortion demands are traps.
- Unique passwords, two-step login, a careful eye for links, updates and 3-2-1 backups make most of this plan unnecessary.