Password changed by a stranger, weird emails you didn't send, followers asking why you're selling crypto: the first hour decides whether you get your account back.
Panicked clicking wastes the hour. This sequence is the one professionals would follow in your chair.
Before you start
- A device you trust (your own phone or computer)
- One focused hour
Step by step
1. Secure your email FIRST, it's the master key
Every other account resets through your inbox. Change the email password right now from a device you trust, enable two factor authentication, and check forwarding rules and filters for anything you didn't create. Attackers add hidden forwarding to keep reading your mail after 'recovery'.
2. Use the official recovery pages
Every major platform has one: google.com/accounts/recovery, facebook.com/hacked, instagram.com/hacked, and equivalents. Only use URLs you type yourself: fake recovery pages are the scam that rides on the first scam.
3. Kick out intruder sessions
Inside each recovered account, find 'Where you're logged in' or 'Active sessions' and sign out everything you don't recognize. Without this step the attacker often stays inside like nothing happened.
- Google: Security, Your devices, sign out all
- Facebook/Instagram: Login activity, log out of other sessions
4. Change passwords everywhere they were reused
If the leaked password exists on other sites, those doors are open too. Change them now, unique ones from a password manager, and enable 2FA per account during the same pass.
5. Tell your circle and check for damage
Post or message a quick warning: 'I was hacked, ignore links from me, report them'. Check sent folders, purchase history, linked payment methods and profile changes for anything the intruder did while inside.
6. Lock the door behind you
Recovery email and phone up to date, 2FA on authenticator app (not just SMS), login alerts enabled. The second takeover attempt should hit a wall, not another open window.
Pro tips without the attitude
- Act on the FIRST warning sign (a login alert email from another city), not after the damage: hours matter
- Financial accounts attached? Call the bank's fraud line the same day; speed unlocks protections that disappear after delays.
- Scan the device you believe was compromised: malware on your own machine re-steals every new password you set.
Keep reading
- How to Use the iPhone Passwords App (The Built In Password Manager You're Ignoring)
- How to Remove a Virus From Your Android Phone (The Calm, Step-by-Step Cleanup)
- How to Set Up a Password Manager (And Never Reset a Password Again)
Email first, official recovery only, sessions out, passwords rotated, circle warned, door locked. One bad hour, handled right, beats months of aftermath.
