Your phone buzzes at 7:14 on a Tuesday morning. A friend is asking why you just posted a crypto giveaway on Facebook. You didn't post anything. You're still in bed. And that sinking feeling hits before you've even unlocked the screen.
I've been on both sides of this. I've had a client call me in a panic after her Facebook account got taken over, and I've watched my own email get hit in a credential-stuffing wave a couple of years back. So here's the blunt version: the first 30 minutes decide whether you get your account back or lose it for good. Panic wastes them. This guide is what to do instead.
Whether it's a Facebook account hacked and password changed, a Gmail compromised in the middle of the night, or your phone itself acting strange, the steps below walk through what actually works.
Key takeaways
- Act within the first hour if you can — recovery windows close fast once a hacker changes your recovery email or phone.
- Change your password from a different, clean device, not the one you suspect is compromised.
- Turn on two-factor authentication immediately after recovery. This is the step most people skip and then regret.
- If the platform won't let you back in, use its official account-recovery form — not a random "hacker recovery" service.
- Report the hack to the platform and, if money or identity is involved, to the relevant authorities.
- Check every other account that shares the same password — attackers reuse credentials across sites.
What is the first thing you do when you get hacked?
Before you touch anything, take a breath and answer one question: is the attacker still inside? That changes your entire approach. If they're actively logged in, anything you do on the compromised account might get undone in seconds.
Here's the sequence that actually works, and I'll be honest — I got this wrong the first time and it cost me a day.
Step 1: Change your password from a clean device
Not your laptop. Not the phone that might have a malicious app on it. Use a device you trust — a partner's laptop, a work computer, anything you haven't logged into that account on recently.
Why does this matter so much? Because if a hacker installed a keylogger or a browser extension that reads your keystrokes, changing your password on the infected machine just hands them the new one. I watched a colleague do exactly this and lose access again within twenty minutes.
Step 2: Log out every other session
Most platforms let you see active sessions and force a sign-out everywhere. Do it. Don't skip it because it feels tedious. If the attacker has a session token, a new password alone won't boot them.
- Google: Security → Your devices → sign out unfamiliar sessions
- Meta/Facebook: Security and login → Where you're logged in
- Microsoft: Security → Advanced options → sign out everywhere
Step 3: Fix your recovery info
Check the recovery email and phone number on the account. This is the sneaky part — attackers often add their own before doing anything else, so they can get back in even after you reset the password. If you see a number or address you don't recognize, remove it right then.
How does a hacker get into your account?
It's almost never a genius in a hoodie guessing your password in real time. Real-world account takeovers come from a handful of boring, repeatable methods.
| Attack method | How it works | Your defense |
|---|---|---|
| Credential stuffing | Passwords leaked from one site get tried on every other site you use | Never reuse passwords; use a password manager |
| Phishing | A fake login page or urgent email tricks you into typing your credentials | Check the URL; never log in from an email link |
| Malware / keyloggers | Software on your device records what you type | Keep devices updated; avoid sketchy downloads |
| SIM swapping | An attacker ports your phone number to their SIM to intercept 2FA codes | Prefer app-based or hardware 2FA over SMS |
| Data breaches | A service you use gets breached and your details end up in a dump | Change the password; check breach notifications |
Credential stuffing is the big one. I still see people using the same password across a dozen sites, and that single habit is behind a huge share of the account takeovers I help clean up.
Why password reuse is the silent killer
Think of it this way. You sign up for some niche forum years ago, use your main email password, and forget about it. That forum gets breached. Your email and password land in a list that gets sold and reshared for years. Someone runs that list against Gmail, Facebook, your bank. Most attempts fail. A few don't.
The fix is dull but effective: one unique password per account, stored in a manager. That's it. That's the whole game.
What is the solution if your FB account is hacked?
Facebook is where most people panic hardest, because the account is tied to friends, groups, and sometimes a business page. Meta's recovery flow is decent, but it only works if you follow the exact path — and the attacker knows that path too.
Use the "hacked" report, not the login form
Go to the login screen and look for the "Forgotten password" link. When it asks for your email or phone, there's usually an option like "My account is compromised" or "I think my account was hacked." Tap that. It routes you into a dedicated recovery flow instead of the standard reset.
If your password was already changed by the attacker, the flow lets you request recovery via a trusted contact — a friend you'd previously set up as someone who can vouch for you. If you never set one up, you'll be pushed toward submitting ID verification instead. Slow, but it works.
If you can still get in, move fast
- Change the password immediately from a clean device
- Review and remove any unrecognized email addresses or phone numbers in your account settings
- Check active sessions and log them all out
- Turn on two-factor authentication the moment you're back in
- Warn your contacts — attackers love to message your friends with scams while they have access
The social aftermath matters more than people expect. After my client's account was hijacked, three of her friends sent money to a "you won a prize" scam before she could get the word out. Tell people early.
My email has been hacked and password changed — how do I fix it?
Email is the master key to everything else, so this is the one to fix first if it's affected. A hijacked inbox means an attacker can reset passwords on all your other accounts through "forgot password" links.
For Gmail
Head to Google's account recovery page and follow the prompts. If the password and recovery options were both changed, you'll lean on Google's account recovery form, which asks about recent activity, devices you've used, and the creation date. Answer as accurately as you can — it's basically a trust scoring system.
Wondering how to find out who hacked your Gmail account? Realistically, you usually can't, and chasing that is a trap. Attackers hide behind VPNs and throwaway infrastructure. Your energy is better spent locking the account back down. If money was stolen, that's a job for law enforcement, not a self-styled "hacker hunter" online.
For other providers
Microsoft, Yahoo, and most major providers follow the same logic: use the official recovery form, verify your identity as best you can, then reset everything. Once you're back in, change the password on every account that used the same credentials.
What to do if you've been hacked on your phone
A compromised phone is a different beast, because the attacker may be reading your messages, your 2FA codes, everything. Signs include apps you didn't install, sudden data drain, weird pop-ups, and settings that changed on their own.
The cleanup
- Update the OS and all apps — many exploits rely on unpatched vulnerabilities
- Uninstall anything you don't recognize, especially sideloaded apps
- Run a reputable mobile security scan
- Change the passwords for accounts accessed from that phone, from a different device
- If things still feel off, back up your photos and files and do a factory reset
I'll admit I resisted factory-resetting a phone for two days once, convinced I could clean it manually. I couldn't. The reset took an afternoon and solved it. Sometimes the nuclear option is the fast one.
How do I remove my hacked account?
Sometimes recovery isn't worth it. Maybe the account was a throwaway, or the attacker buried it so deep you can't claw it back, or you're just done with the platform. Removing it is a legitimate move, and it's one almost nobody explains.
Disable first, delete second
Most platforms let you deactivate (reversible) before permanent deletion. Deactivating hides your profile and stops activity, but keeps your data in case you change your mind. Deleting is final. If you're not sure, deactivate first. If the account is actively being abused and you can't get back in, report it as compromised and request deletion through the platform's support channels.
Two things to do before you pull the trigger:
- Download your data if you want a copy of photos and messages
- Tell your contacts so they don't fall for messages sent from the abandoned account
Reporting the hack
Report the compromise to the platform itself — every major service has a form for this. If money, identity theft, or fraud is involved, file a report with your local authorities and the relevant national fraud or cybercrime body. A police report also helps if you need to dispute fraudulent charges or reclaim a hijacked account with a provider that's dragging its feet.
The part that actually prevents round two
Recovering an account is stressful. Preventing the next one is boring and takes twenty minutes. I'll take boring every time.
- Use a password manager and let it generate long, unique passwords
- Turn on two-factor authentication everywhere, and prefer an authenticator app or hardware key over SMS
- Review your active sessions every few months — you'll spot strange logins early
- Set up trusted contacts and recovery codes, and store them somewhere safe
- Treat every "urgent" login email with suspicion
One quick data point from my own experience: after I moved every account to a password manager and app-based 2FA, the number of suspicious login alerts I got dropped to near zero. Not because attacks stopped happening — because they stopped succeeding.
The uncomfortable truth is that getting hacked rarely feels dramatic in the moment. It feels like a friend asking why you posted something you never posted. What matters is what you do in the next thirty minutes. Set up your recovery options today, while nothing is wrong, and that Tuesday-morning panic becomes a five-minute fix instead of a lost account.
