Someone got into my email or social media

Last updated 2026-10-14 · Written with AI assistance, reviewed by a person

It's an awful feeling: posts you didn't write, friends asking about a message you never sent, a password that suddenly doesn't work. The good news is that accounts can almost always be won back. This playbook walks you through it, whether you can still sign in or you're locked out.

Do this now

Pick a device you trust. If your usual phone or computer might be infected (you installed something, or let someone control it), use a different one. Otherwise your own phone is fine.
Try to sign in. Still works? Change the password straight away, then go to Once you're back in. Locked out? Use the official recovery page in the table below.
Warn your friends and family from another account, or by text: "My account was hacked. Ignore anything from it asking for money, codes or clicks." Hackers use your account to scam the people who trust you.
Was it your email? Change your banking password too, from a trusted device. Anyone in your email can reset most of your other accounts.
Keep proof. Screenshot strange posts, messages you didn't send, security alert emails. They help with recovery, plus any report you make later.

Did your phone suddenly lose signal around the same time? Call your mobile carrier from another phone right away. Someone may have moved your number to their own SIM card to receive your sign-in codes. This is called a SIM swap.

Locked out? Start here

Only use these official pages. Type the address yourself, or use the "Forgot password?" link on the real sign-in screen. Never trust a recovery link in a message, or a "support agent" who contacts you first. Real support teams don't reach out on social media or charge a fee.

Account	Official recovery
Google, Gmail, YouTube	Google Account recovery
Microsoft, Outlook.com, Hotmail, Xbox	Microsoft account recovery form
Apple Account, iCloud	iforgot.apple.com
Facebook	facebook.com/hacked
Instagram	instagram.com/hacked
Anything else	The "Forgot password?" link on the sign-in page, or the company's help center. Search for it by typing the company's address yourself.

Tips that make recovery work:

Use a device and Wi-Fi you've used with the account before. Recovery systems trust familiar devices more.
Answer every question you can, even with a best guess: old passwords, when you opened the account, people you've emailed recently.
Be patient. Some recoveries include a waiting period on purpose, so a thief can't rush through it. Apple's can take days. Don't start the process again, since that can reset the clock.
Didn't work? Try again from another trusted device, or a little later. Many people get in on the second or third try.

Once you're back in

Changing the password is only the first step. Intruders often leave a way back in. Go through this list, ideally on a computer, where the settings are easier to find:

Set a new password. Long, new, used nowhere else. A password manager can make one for you.
Sign out everywhere else. In the security settings, find the list of devices or places you're signed in. Sign out anything you don't recognize, or choose "sign out of all sessions" if it's offered.
Check the recovery email and phone number. Intruders swap in their own, so they can reset your password again next week. Remove anything that isn't yours.
Check two-step sign-in. Remove any phone, app or security key you don't recognize. If it was off, turn it on now. A passkey or an authenticator app is stronger than text messages.
Email only: check forwarding with filters. This is the sneakiest trick. A forwarding address quietly copies all your mail to the intruder. A filter can hide messages from your bank in a folder you never open. In Gmail, open Settings, then See all settings. Check the Forwarding and POP/IMAP tab first. Then check Filters and Blocked Addresses. In Outlook.com, look in Settings, Mail, then Forwarding plus Rules. Delete anything you didn't set up.
Remove apps you don't recognize. Look for "third-party apps", "connected apps" or "apps and websites" in the security settings. An app you approved by mistake can keep reading your account even after a password change.
Social media: check what they changed. Your name or username, posts, messages they sent, pages or groups where they made themselves an admin, a payment method they added.
Check your saved cards, then recent purchases in any account that holds payment details: app stores, shopping sites, game accounts.

Then check what else they could reach

Your email is the master key. Anyone in it can press "Forgot password?" on your other accounts, then read the reset email.

Search your inbox, deleted items and spam for "password reset", "new sign-in" or "verify" messages from while they had access. Each one points to another account to secure.
Change any password you used in more than one place. Start with banking, other email accounts, shopping, social media, then cloud photo storage.
See where your email address has turned up in data breaches at haveibeenpwned.com, a free service run by a respected security researcher. It shows which old passwords might be out there.
Did they get financial or personal information? If the account held your Social Security number, tax forms or ID photos, go to IdentityTheft.gov for a recovery plan, then consider freezing your credit. Our I sent money to a scammer playbook explains how.

If they're asking you for money

Someone says they'll release your account, or delete your photos, if you pay? Don't pay. It rarely works, then they ask for more. Report it to the platform, then to the FBI at ic3.gov. If a child is being threatened, also report it to NCMEC's CyberTipline.
A "recovery expert" offers to get your account back for a fee? That's a second scam. Real recovery is free, through the official pages above.

So it doesn't happen again

Most accounts are taken over in one of three ways: a password reused from another site that leaked, a fake sign-in page, or a stolen phone number. A few changes close all three:

A password manager. One strong password for each account, without having to remember them. It also refuses to fill in your password on a fake site.
Two-step sign-in on email, banking, social media. Use a passkey or an authenticator app where you can. Text messages are better than nothing.
A PIN on your mobile account. Ask your carrier about a port-out PIN or "number lock", so nobody can move your number without it.
Keep recovery details current. An old phone number or a dead email address makes your own recovery much harder. Google's free Security Checkup walks you through it for Google accounts.

Sources

We checked these on October 14, 2026. Settings move around, so if a menu name doesn't match, the provider's own help page wins.