Social media account hacked

What this means

Two things are at stake, and people usually only think about the first one. There is the account itself, with its photos and followers and years of messages. And there is your name, which is now being used to talk to everyone you know.

The second one does more damage. The most common use of a stolen social account is not posting spam. It is messaging your friends as you, asking for a favour, a code, or money. People who would never fall for a stranger will believe a message from you.

Speed matters because of how these platforms work. Once the attacker changes the email address and phone number on the account, you are relying on an automated appeals process that can take weeks and sometimes never works. Before they change it, recovery is usually a five minute job.

Warning signs

• Posts, stories, or replies you did not make.
• Friends mention getting a message from you that seemed off, especially one asking for money or a verification code.
• An email saying your address, phone number, or password was changed, which you did not do.
• You are logged out everywhere and your password no longer works.
• New accounts you do not recognise appear in your connected or linked apps.
• Your account starts following, or is followed by, a wave of accounts you know nothing about.

Recover now

First 15 minutes

1. Try a password reset immediately. If your email is still attached to the account, this is the fastest route and it often just works. Do this before anything else.
2. Check your email account first if the reset does not arrive. If the attacker got in through your email, fixing the social account is pointless until the mailbox is yours again.
3. Sign out all other sessions once you are back in. Every platform has this, and it removes the attacker even if they know the old password.
4. Turn on two-factor authentication, and check that any existing second factor points at your own phone.
5. Tell your friends, on a different platform. A quick message elsewhere stops the scam working while you sort out the account.

Report and recover on your platform

Today

1. Change the password on the email address attached to the account, if you have not already. The two are usually connected.
2. Look through direct messages to see who the attacker contacted and what they asked for. Warn those people specifically.
3. Delete anything posted in your name, and check whether your bio or links were changed to point at a scam.
4. Check any other account that uses the same password, and change those too. Reused passwords are the most common way this happens.
5. If money changed hands, tell the bank of whoever paid, and report the fraud to your national fraud service.

Verify recovery

• Only your own devices appear in the active sessions list.
• The email address and phone number on the account are yours.
• Two-factor authentication is on and the codes reach your device.
• No unfamiliar third-party apps are connected.
• Your bio, links, and profile picture are as you left them.

Prepare now

The account

• Two-factor authentication is on, using an authenticator app rather than SMS where the platform allows.
• The password is unique to this account and stored in a password manager.
• The email address on the account is one you still control and check.
• Login alerts are on, so a new sign-in reaches you straight away.

Around the account

• The email account it is attached to has its own two-factor authentication.
• You have downloaded a copy of your photos, so losing the account does not lose the memories.
• Friends and family know you will never ask for money or codes over social messages.
• Any business Page has more than one admin, so one compromised person cannot take it down.

Common mistakes

• Waiting to see if it sorts itself out. The window before the attacker changes your email address is the only easy window there is.
• Recovering the social account while the email is still compromised. They will simply reset it again. Fix the mailbox first.
• Not telling anyone. The scam works on your friends, not on you, and it works best while nobody knows.
• Using the same password again somewhere else. If the password leaked, it is in a list that gets tried against every other service.
• Paying whoever took it. Accounts held for ransom are rarely returned, and paying marks you as someone who pays.

Sources

• Instagram: Hacked accounts
• Meta: What to do if your Facebook account is hacked
• X: Help with a hacked account
• TikTok: Account security
• UK NCSC: Recovering a hacked account