Checklist for What to Do If Your Account Is Hacked

Everyone · Checklist · Updated October 1, 2026 · LearnLife Editorial

When Should You Use This Account Hacked Checklist?

Use this checklist as soon as you notice unusual activity or suspect your account has been compromised. Common warning signs include unexpected password changes, login alerts from unknown devices, messages you didn’t send, or friends reporting strange behavior from your account. For example, if you receive a notice that your email password was reset but you did not initiate it, start this checklist immediately. Acting right away limits damage, helps you regain control, and protects your contacts from possible scams. Even if you only suspect something is wrong, taking quick action like changing your password and running a security scan on your device is a smart precaution. This checklist is designed to help you respond methodically without missing critical steps.

What Steps Should You Take Immediately After Your Account Is Hacked?

When you confirm or strongly suspect hacking, follow this immediate action list to secure your account:

• Change Your Password Right Away: Pick a new, strong password unique to this account. Use a mix of uppercase letters, lowercase letters, numbers, and symbols. For example, instead of “Summer2024,” consider “R9$wLp7!qXe2.” If you cannot log in because the hacker changed your password, use the “Forgot Password” link to reset it, following the platform’s identity verification process.
• Turn On Two-Factor Authentication (2FA): Add an extra security layer by enabling 2FA, which requires a second verification step such as a code sent to your phone or generated by an authentication app. Apps like Google Authenticator or Authy provide time-sensitive codes. This reduces the chance of future unauthorized access.
• Check and Restore Account Recovery Options: Go to your account settings and verify that recovery email addresses and phone numbers are correct. If hackers replaced these with their own, update them back immediately. This step ensures you can regain access if locked out.
• Log Out of All Devices and Sessions: Many services offer the option to end all logged-in sessions. Use it to kick off hackers who might still have access from other devices. For example, Gmail’s “Security Checkup” lets you sign out from all devices at once.
• Run a Malware and Virus Scan on Your Devices: Hackers often install malicious software to maintain access or steal data. Use reputable antivirus or anti-malware software to scan your phone, computer, or tablet thoroughly. For example, Malwarebytes or the built-in Windows Defender can detect and remove threats.
• Review Your Account Settings for Suspicious Changes: Look for unauthorized linked accounts, suspicious forwarding rules, or privacy setting changes. For instance, hackers might add an email forwarding rule to hide their actions or post spam from your social media. Remove anything unfamiliar.

Taking these immediate steps reduces ongoing risk and helps you regain control efficiently. Keep a record of the actions you take and when, so you have a timeline if you need to report the incident.

How Do You Assess the Damage After Hacking?

Once you have secured your account, carefully check what the hacker may have accessed or changed:

• Review Recent Account Activity: Look at your login history, sent messages, purchase records, and posts for anything you didn’t initiate. For example, if your email was hacked, check the “Sent” folder for unexpected emails and the trash folder for deleted messages.
• Notify Your Contacts Quickly: Let friends, family, coworkers, or clients know your account was hacked and warn them to ignore suspicious messages or links they received from you. A simple message like: “My account was compromised recently. Please be cautious with any unusual messages from me,” helps protect others from scams or malware.
• Examine Other Accounts That May Be Linked: If you reused passwords or recovery info on other sites, those accounts may also be compromised. Change those passwords and enable two-factor authentication there as well. For example, if your email password was stolen and you used it on your online shopping site, update that password immediately.
• Monitor Your Financial and Personal Information: Check bank accounts and credit card statements for unauthorized transactions or changes in billing details. Also, consider reviewing your credit report through free annual checks provided by major credit bureaus to spot any new accounts or inquiries you did not authorize.
• Document Suspicious Findings: Save screenshots or notes detailing what you discovered and when. This documentation will help if you report the hack to authorities or dispute fraudulent charges.

A thorough damage assessment helps you understand what information was exposed and guides your next steps to protect your identity.

What Should You Do to Report and Recover Your Account?

After securing and assessing your account, follow these steps to fully recover and report the incident:

• Use Official Account Recovery Tools: Follow your service provider’s account recovery process. This may require answering security questions, uploading identification, or confirming contact details. Be patient, as it can take time for complex cases.
• Report the Hack to the Service Provider: Contact customer support or use the service’s “Report a Problem” feature to alert them of unauthorized access. This helps the provider monitor your account and may trigger additional security measures. For example, Facebook and Google have dedicated support for hacked accounts.
• File a Complaint with Cybercrime Authorities: Submit a report to the FBI Internet Crime Complaint Center or the Federal Trade Commission through official channels. Reporting helps authorities track cybercriminals and can aid in investigations or legal action.
• Inform Your Financial Institutions: If your bank or credit card information was involved, call your bank immediately. Request that they monitor for suspicious transactions, freeze accounts if necessary, and issue new cards or account numbers.
• Consider Credit Monitoring Services: Signing up for credit monitoring or identity theft protection can alert you to potential fraud. Some services are free, while others charge fees. Evaluate options based on your needs and risk level.
• Follow Up Diligently: Keep track of all communication with service providers and authorities. Regularly check your account status and report any new suspicious activity.

These steps help you regain full control and protect yourself from further harm.

Which Checklist Items Are Most Often Skipped and Why?

Certain steps are frequently overlooked, yet they are critical for full recovery:

• Skipping Two-Factor Authentication (2FA): Many forget or delay enabling 2FA, missing a strong layer of protection that can prevent future hacks.
• Not Logging Out of All Devices: People often change passwords but forget to sign out sessions on other devices, allowing hackers to maintain access. Always use the “log out everywhere” option.
• Ignoring Recovery Options: Failing to check and restore recovery phone numbers and emails can lock you out permanently if hackers changed them.
• Not Informing Contacts: Without notifying contacts, scammers can use your identity to trick others, spreading damage further.
• Skipping Malware Scans: Neglecting to scan devices allows malware to persist, potentially stealing more information or reinfecting accounts.
• Overlooking Other Accounts: Using the same password across sites means hackers might gain access to multiple accounts if you don’t update all passwords.

Avoid these common mistakes by carefully completing each step of this checklist for the best chance to recover safely.

How Can You Keep This Checklist Up to Date?

Keep your security habits and this checklist current by following these best practices:

• Change Passwords Regularly: Plan to update important passwords at least annually or immediately after suspicious activity. Use a password manager to generate and store complex, unique passwords without hassle.
• Keep Recovery Information Updated: Regularly check and update your recovery email addresses and phone numbers, especially after changing your contact details.
• Stay Informed About Security Threats: Follow trusted cybersecurity sources and official announcements to learn about new threats and recommended protections.
• Test Account Recovery Processes Occasionally: Try the “Forgot Password” function on important accounts to ensure you can regain access if needed.
• Use Available Security Features: Enable multi-factor authentication, alerts for unusual sign-ins, and login notifications on your accounts.
• Keep Devices and Software Updated: Regularly install security patches and software updates to minimize vulnerabilities hackers target.
• Document and Adapt Your Checklist: Add new steps or tools as you learn more about account protection to keep your checklist relevant.

Treat this checklist as a living document you revise over time to maintain your digital safety.

Frequently asked questions

What if I don’t remember which accounts are linked to my hacked account?

Search your email inbox for account registration and password reset messages. Look for saved passwords in browsers or password managers. Prioritize changing passwords on accounts with sensitive data first.

Can I recover a hacked account if the hacker changed my recovery email and phone number?

Recovery can be challenging, but many services offer alternative verification methods such as submitting government-issued ID or answering security questions. Contact customer support directly and provide proof of ownership.

How long does it usually take to recover a hacked account?

Recovery time varies widely by service and the severity of the breach. Some accounts can be recovered in minutes, others may take days or weeks. Stay patient and persistent through the process.

Is it safe to click links in emails about account recovery?

Only click links from official communications you can verify. When in doubt, open the site manually by typing the URL rather than clicking email links to avoid phishing scams.

Should I inform my employer if my work account is hacked?

Yes, notify your employer or IT department immediately. Work accounts often contain sensitive business data and may require specific recovery procedures.

What are signs my device might still be infected after a hack?

Warning signs include slow performance, unexpected pop-ups, new apps or toolbars you didn’t install, frequent crashes, or unusual network activity. Running a malware scan can confirm infections.