What to Do If Your Account Is Hacked and Password Changed

Everyone · How-to · Updated October 1, 2026 · LearnLife Editorial

What do you need before starting to recover your hacked account?

Before beginning account recovery after a password change by a hacker, gather all relevant information and tools to improve your chances of success. You will need your account’s username or the email address originally linked to the account. If you can recall any previous passwords, keep those ready, as some services ask for recent passwords during verification. Access to the secondary email address or phone number tied to the account is important because recovery instructions or codes will be sent there.

For example, if your account is connected to your phone number, ensure your phone is nearby and has service to receive SMS codes. Also, review answers to any security questions if applicable, and have identification documents ready if the service requires proof of ownership. If you set up two-factor authentication (2FA) on the account, have your authentication app or device accessible. Having a secure internet connection and a device you trust helps avoid interception risks during the recovery process.

Having this information prepared avoids delays. For instance, if you want to recover a hacked Instagram account, you may need to provide your username, email, or phone number plus submit a photo ID if prompted. Being ready with these details strengthens your recovery attempt.

What are the step-by-step actions to take if your password has been changed by a hacker?

Follow these detailed steps to regain control of your account when the password has been changed without your permission:

1. Select the “Forgot Password” or Account Recovery option: Visit the login page and click “Forgot Password?” or “Can’t access your account?” Enter your username, email, or phone number to receive a reset link or code. For example, if your Instagram password was changed, you’ll be prompted to enter your username or email to receive a login link via email or SMS. Check your inbox and spam folder carefully.

1. Use backup codes or alternate authentication methods if available: If you enabled two-factor authentication and saved backup codes, use these to log in even if the password changed. For example, Instagram provides one-time backup codes that you can use to access your account if you don’t have your phone.

1. Contact customer support or the platform’s help center if automated recovery fails: Find the official support page and report that your account was hacked and password changed. Provide as much information as possible, such as previous passwords, account creation date, linked email addresses, or any transaction history. For example, Facebook offers a form specifically for hacked accounts where you can submit this information.

1. Review recent activity and revoke unauthorized access: After regaining access, immediately check your account’s recent login history, connected devices, and third-party app permissions. Remove any devices or apps not recognized. For instance, Google’s security page shows recent sign-ins and connected devices, allowing you to log out of any unknown sessions.

1. Change your password to a strong, unique one: Choose a password with at least 12 characters, mixing uppercase letters, lowercase letters, numbers, and special symbols. Avoid simple words or predictable sequences. Example: Instead of “Summer2024,” use something like “Blue!7River*Race19”.

1. Enable two-factor authentication (2FA): Turn on 2FA to add an extra layer of security. Use an authenticator app or receive codes by SMS. This means even if someone has your password, they also need the second verification step to log in.

1. Notify your contacts if your account sent spam or suspicious messages: Inform friends or followers that your account was compromised and to ignore any strange messages they may have received. You can say, “My account was hacked recently. Please be careful if you received any unusual links or messages from me.”

1. Scan your devices for malware and viruses: Run a full scan using trusted antivirus and anti-malware software on your computers and smartphones. Remove any threats to prevent repeat hacking. Keyloggers or malicious software might have captured your passwords.

Following these steps carefully and thoroughly increases your chances of fully regaining control and protecting your account from future attacks.

How do you know your account recovery worked?

You can tell account recovery succeeded if you can log in using your new password without any error messages. Once logged in, visit the account’s security or settings page to confirm your information is correct and that no unauthorized changes remain. For example, check that the recovery email and phone number are accurate, and that no unfamiliar devices are connected.

Many platforms send confirmation emails or notifications after password changes or security updates. For example, Google will email you when your password is reset or if new devices access your account. If you enabled two-factor authentication, you should be prompted to enter a code from your authenticator app or SMS during login.

Test your account by using normal features like sending messages, posting, or accessing saved files. If you have full access and see no suspicious activity, your recovery was successful. Continue monitoring for unusual alerts or login attempts in the following days. If you detect anything suspicious, act immediately by repeating recovery steps or contacting support.

What should you do if account recovery doesn’t work or the hacker still controls it?

If you cannot regain access using password reset tools or customer support, and the hacker continues to control your account, take these actions:

• Report the hack to the platform’s abuse or security team:

Many services have dedicated forms or contact methods for compromised accounts. For example, Instagram and Facebook have specific help pages for hacked accounts where you can submit identity verification and additional details. This often triggers manual review by security specialists.

• File a complaint with federal agencies if identity theft is involved:

Use IdentityTheft.gov to report the incident and follow their recovery plan. The FBI’s Internet Crime Complaint Center also accepts reports of online crimes. Document all your communications and attempts to regain control.

• Alert your bank and payment providers if linked to the hacked account:

Notify financial institutions immediately if your compromised account is connected to payment methods. This helps prevent fraudulent charges or transfers.

• Consider creating a new account if recovery isn’t possible:

Inform close contacts about the new account and update any services or subscriptions that used the old login. Make the new account more secure with strong passwords and two-factor authentication.

• Seek professional assistance if needed:

Identity theft protection services or legal advice may help if the hack involves stolen personal information or serious fraud.

Persistence is key in difficult cases. Keep detailed records of all attempts and communications with support teams.

How do you adapt these steps if your Instagram account was hacked and password changed?

Instagram recovery has unique steps when a password has been changed by a hacker. Start by selecting “Forgot password?” on the Instagram login page and enter your username, email, or phone number. If you don’t receive a reset link or cannot access the linked email, tap “Need more help?” to open Instagram’s support form.

Instagram may require you to verify your identity by submitting a photo ID or a selfie video showing your face from different angles. This verification is designed to confirm ownership and protect your account. Check your email inbox for messages from “[email protected]” that include instructions or options to revert unauthorized changes, such as email or phone number updates.

Once access is restored, immediately change your password to a strong, unique one, enable two-factor authentication, and review recent activity and authorized apps. Remove any suspicious devices or third-party apps linked to your Instagram account. If the hacker sent spam or malicious links, notify your followers with a clear message to avoid clicking suspicious content.

Instagram’s recovery process may require patience and careful follow-through of their instructions. For additional help, refer to Instagram’s official help center articles on hacked and disabled accounts.

What precautions can you take to prevent future hacking incidents?

To reduce the risk of future hacking, adopt these security habits:

• Use a strong, unique password for each online account. Avoid reuse across multiple sites. Consider using a reputable password manager to create and store complex passwords securely.

• Enable two-factor authentication (2FA) wherever available. This requires a second verification step, such as an app-generated code or SMS, making unauthorized access harder.

• Be alert for phishing attempts. Never click links or open attachments from suspicious emails or messages asking for login information. Instead, go directly to the official website by typing the URL yourself.

• Keep your software, apps, and devices up to date with security patches and updates. Cybercriminals exploit outdated programs to gain access.

• Avoid using public Wi-Fi for logging into sensitive accounts unless you use a trusted virtual private network (VPN).

• Monitor your accounts regularly for unusual activity and set up login alerts if offered by the service.

By practicing these steps consistently, you strengthen your online security and reduce vulnerability to hackers.

Frequently asked questions

How fast should I act if I discover my account password was changed without my permission?

Act immediately by attempting a password reset and contacting the platform’s support if needed. The faster you respond, the less time hackers have to misuse your account or access linked services.

Can hackers access my other accounts if one account is hacked and password changed?

Yes, especially if you reuse passwords or if accounts are linked. After recovering, change passwords on all important accounts and review security settings.

What if I didn’t set up a recovery email or phone number for my account?

Recovery becomes more difficult. Contact the platform’s support and provide proof of identity and account ownership. Setup recovery options once you regain control.

How can I recognize phishing attempts related to account hacking?

Phishing messages often create urgency, ask for personal info, contain spelling errors, or use suspicious links. Always verify the sender and avoid clicking links unless you trust the source.

Should I tell friends or family if my social media account is hacked?

Yes. Inform them so they do not interact with suspicious messages or links coming from your compromised account, helping prevent spread of scams or malware.

Can I regain access if the hacker deleted my account?

It depends on the platform. Many services allow recovery of recently deleted accounts within a limited timeframe. Contact support promptly to check your options.