Hacked accounts do not always look dramatic. Often the signs are small and easy to dismiss. No technical knowledge is needed for this checklist. It is part of our section on data breaches and hacked accounts.
Warning signs
| Where to look | What you may notice |
|---|---|
| Reset messages you did not request, or missing mail | |
| Login alerts | New device or location |
| Sent messages | Posts, emails or texts you did not write |
| Account details | New phone, recovery email or address |
| Money | Purchases, transfers or new payment cards |
| Access | You are logged out, or your password stops working |
| Friends | People asking about strange messages from you |
| Two-factor | Unexpected codes or push prompts |
Check for hidden access
Attackers often stay out of sight. Do this for any account that you are worried about:
- Open security settings and look at active sessions and devices.
- Check recovery email, phone and security questions.
- In email, look at forwarding rules and filters.
- Review connected apps.
- Look at recent activity or login history.
What to do first
- Use a device you trust. If you suspect malware, use a different one.
- Change the password to a new, unique one.
- Log out of all other sessions.
- Turn on two-factor login.
- Restore your recovery details.
- Change the same password anywhere else you used it.
If it is your email, follow the full email recovery steps, because other accounts depend on it.
Work out how it happened
| Likely cause | Clue | Fix |
|---|---|---|
| Reused password | Your password is in a known leak | Unique passwords |
| Phishing | You recently logged in from a link | Learn the warning signs |
| Malware | Several accounts hit at once | Clean your device |
| SIM swap | Your phone lost signal | Protect your number |
When to involve others
- Your bank, straight away, if money is at risk.
- Friends and family, so that they do not fall for messages sent from your account.
- Your employer, if it is a work account or you use the same password there.
- The authorities, if you lost money or your identity was used. In the US, use IdentityTheft.gov and IC3.