Think Your Email or Social Account Was Hacked? Do These Things, in This Order

You get a text from a friend: "Did you really send me that weird link?" Or you try to sign in to your email and your password suddenly doesn't work. Your stomach drops. This is one of the most stressful moments in everyday tech, but it is also very fixable. Here is what is actually going on, and the steps to take back control.

How to tell if an account was really hacked

A "hacked" account simply means someone else has your login details and is using them. The usual signs are: you cannot sign in even though you are sure of your password; you get alerts about changes you did not make; the service shows sign-ins from places or devices you do not recognize; or friends and family receive odd messages or links from you.

One important note: if friends say they got a strange message from you, your account may not be hacked at all. Scammers can fake your name and email address without ever getting into your account. Still, it is worth doing the checks below, because they cost you nothing and take about fifteen minutes.

Step 1: Make sure your own device is clean

Before you change any passwords, check the computer or phone you are using. If it has hidden spying software on it (often called malware, meaning software designed to cause harm), a new password will just be stolen again. Install any waiting system updates, run a scan with the security software built into your device (Windows Security on a PC, for example), remove anything suspicious, and restart.

Step 2: Use the company's official recovery page

Every big provider, including Google, Microsoft, Facebook, Instagram and Yahoo, has its own account recovery process. Go to the service by typing its address yourself or using its official app, and search its help section for "recover my account." Do not click a link in an email or text that claims to help you, because scammers target people who have just been hacked with fake "recovery" messages.

Step 3: Lock the door behind you

Once you are back in, do these four things right away:

1. Change your password to a long, unique one you have never used anywhere else. A short phrase of several random words works well.
2. Sign out of all devices. Most accounts have a setting for this in their security page. It kicks out anyone else who is still logged in.
3. Turn on two-step sign-in (also called two-factor authentication), which asks for a code from your phone in addition to your password.
4. Check your recovery email address and phone number. Hackers sometimes swap in their own so they can get back in later. Make sure both are yours.

Step 4: Look for what the hacker left behind

In email, look for "forwarding" rules you did not create. These quietly send a copy of every message you receive to the hacker, and they keep working even after you change your password. Delete any you do not recognize. Also glance through your Sent folder for messages you did not write, and your Trash for messages the hacker read and then deleted. On social media, look for posts, messages or new friends you do not recognize.

Step 5: Warn your contacts and think about other accounts

Send a short note by text, email or a post: "My account was hacked. Do not click links from me, and ignore any request for money." Then think about where else you used the same password. Change it on those accounts too, starting with banking and shopping. Email is the key to the kingdom: if a hacker controls your email, they can use the "forgot password" button on almost everything else you own.

If money or identity is involved

If the hacker may have seen bank details or tried to take money, call your bank using the number on the back of your card, and report the incident to the U.S. Federal Trade Commission at ReportFraud.ftc.gov. Do this even if you only lost a little: reports help investigators spot patterns.

How to make it less likely next time

Most hacked accounts come from reused passwords leaked in a data breach, or from a convincing fake sign-in page. A different password for each important account, plus two-step sign-in, shuts down both of those routes. You do not have to do it all today. Start with your email account, because it protects everything else.

Source: U.S. Federal Trade Commission, "How to recover your hacked email or social media account" (consumer.ftc.gov).