Discovering that one of your accounts has been hacked is a stomach-dropping moment — but how you respond in the first hour makes all the difference. There is a clear playbook that works for almost any account, from email to social media to banking. Our GetMyPassword team lays out exactly what to do to recover a hacked account and lock the attacker out for good.
Act fast: regain control
- Try to log in and change the password right away. If it still works, you are ahead of the attacker.
- If you are locked out, use “Forgot password” with your recovery email or phone.
- Still no luck? Use the service’s account-recovery or “my account was hacked” form.
- Start with your email account if several are affected — it controls the others’ resets.
Then close every back door
Regaining the password is not enough — attackers leave themselves ways back in. Once you are in, do all of these:
- Sign out of all devices/sessions to kick the attacker off.
- Check email forwarding and filter rules — a common hidden trick to keep reading your mail.
- Review the recovery email and phone and reset them to yours if changed.
- Remove unknown connected apps and turn on two-factor authentication.
Changing the password is step one, not the finish line. If you do not also check forwarding rules and connected apps, the attacker can quietly keep their access even after you “fixed” it.
Limit the wider damage
If you reused the hacked password anywhere else, change it on those sites too — attackers will try it everywhere. Warn your contacts if the account could be used to scam them, watch any linked bank statements, and run a security scan in case malware was involved. Then rebuild stronger: give every account a unique password from our password generator and enable 2FA, so a single breach can never spread like this again.
Frequently asked questions
What is the first thing to do if my account is hacked?
Try to log in and change the password immediately. If you are locked out, use “Forgot password” with your recovery email or phone, and start with your email account if several are affected, since it controls the others.
How do I stop a hacker who keeps getting back in?
After changing the password, sign out all sessions, remove hidden email forwarding rules, reset the recovery email and phone, delete unknown connected apps, and turn on two-factor authentication to block their return.
Should I change other passwords after one account is hacked?
Yes, if you reused that password anywhere. Attackers try leaked passwords across sites, so change it everywhere it was used and switch to unique passwords to contain any future breach.