What to do if your social media account is hacked

Every recovery route ends with a link sent to your registered email or phone. If the attacker also controls that inbox, every attempt you make hands them the reset instead. So secure the email account first: change its password, check its recovery options, and review its forwarding rules and filters.

Forwarding is the step people skip. An attacker who quietly forwards your mail keeps receiving your reset links long after you have changed the password, and a filter that deletes security alerts hides what they are doing. Both are in Gmail's settings under Forwarding and POP/IMAP, and Filters and Blocked Addresses.

If you can still receive a reset link, use it immediately, then sign out all other sessions from the account's security settings. That combination — new password plus session revocation — is what actually ejects an attacker. A new password alone leaves their existing session logged in on many platforms.

This is the point where you need the platform's own account-recovery flow, which is designed for exactly this case. For Instagram and Facebook, start from the login screen's "Need more help?" or "Forgot password?" path, which leads to identity verification — usually a video selfie for accounts with photos of you, or a form for accounts without.

Instagram's hacked-account entry point is instagram.com/hacked. Facebook's is facebook.com/hacked. Google account recovery is at accounts.google.com/signin/recovery. WhatsApp recovery is done by re-registering your number in the app and entering the SMS code, which automatically logs the other device out.

Submit from a device and network you have used with the account before. Recovery systems weigh familiar signals heavily, and a request from a brand-new device on a VPN looks exactly like the attacker's request.

Give the platform something only the real owner would know: the original email address or phone number the account was created with, an old password you used, the approximate creation date, and the exact spelling of the username. Answer their questions and nothing else, keep it factual and short, and use the same email address consistently across every attempt. A long emotional message is not what the reviewer needs.

A stolen account earns its keep by scamming the people who trust it, usually with an urgent money request or an investment tip. Tell your close contacts by another channel immediately, and if it is a business account, post from any other channel you control. Ask a few friends to report the account as compromised too — independent reports from established accounts carry weight in review.

Some accounts are recovered in hours; some are never recovered, particularly ones with no photos of a real person, no linked phone, or an original email that no longer exists. Nobody outside the platform can override that decision, and no fee changes it. If a service claims a guaranteed recovery or an "inside contact", it is taking money from someone who has already been robbed once.