If you've been hacked, the order you do things in matters more than speed. Get your email back before your bank. Change passwords from a device you trust rather than the one that might be infected, then lock your credit before anyone can use what they took. The steps below follow that order. It's the containment logic a company's security team uses, scaled down to one person.
You're in a lot of company. The FBI's 2025 Internet Crime Report counted 1,008,597 complaints and about $20.9 billion in reported losses during 2025. Verizon's 2026 Data Breach Investigations Report, whose data runs from October 2024 to November 2025, found that exploiting an unpatched vulnerability had overtaken stolen credentials as the most common first step into a breach (31%). Credentials still turned up somewhere in the chain of 39% of breaches, more than anything else. Those are breaches of organizations. Your passwords are part of what leaks out of them, and a password you reused is the easiest thing for someone to try on your other accounts.
Signs you've been hacked
They run roughly from most to least definitive.
- You're locked out of an account, and the password-reset emails are going to an address you don't recognize.
- You get a notice that your password or username changed, and you didn't change it.
- Reset emails or verification codes arrive that you never asked for, especially several in a burst.
- A login alert names a device or a place you've never used, or the account's security page lists a session you don't recognize.
- Friends ask about odd messages "from you," or your sent folder has emails you didn't write.
- Charges you didn't make, including tiny ones. The CFPB warns that thieves sometimes run a small charge first and come back for more if it goes through.
- Your email address shows up in a breach. You can check it at Have I Been Pwned. If a site you use was breached, treat that password as public everywhere you used it.
The first four are on the FTC's own list of hacked-account signs. If two or more apply, or you're locked out completely, assume the account is compromised and start at Step 1.
How to know if your phone is hacked
Phones are confusing because most of the classic symptoms have boring explanations. A battery that drains fast might just be old. What you're looking for is a pattern, or a symptom that started suddenly for no reason you can point to.
The FTC's guide to stalkerware, the monitoring apps someone installs on a phone they had their hands on, gives the physical signs. Watch for a battery draining faster than usual or unexpected data use. A phone that overheats or switches itself off and on is the other pair. If someone seems to know where you've been or what you said in a private conversation, take that more seriously than any battery reading. Its malware page adds a flood of pop-up ads and messages you didn't send.
Signs on an iPhone
On an iPhone, start with settings someone could change while holding your unlocked phone. Open Settings, then General, then VPN & Device Management. A configuration profile you didn't install can route your traffic or manage the device, and Apple's personal safety guide says to select it and tap Delete Profile, then restart. If the phone came from your employer or school, check with their IT people first, because their profile is supposed to be there.
Next, run Safety Check, which needs iOS 16 or later. It shows who can see your location and which devices are signed into your Apple Account. It also lists app permissions, and its Emergency Reset stops all sharing at once.
You may have heard about spyware that infects iPhones without a single tap. It exists, and Apple sends threat notifications to people it believes were targeted by it. Apple's own page also says "the vast majority of users will never be targeted by such attacks," which it describes as costly operations aimed at a very small number of specific people. Real notifications show up on your Lock Screen and in your Apple Account. Apple says they never ask you to click a link or install anything.
Signs on an Android phone
Android lets you install apps from outside the Play Store, which is how a lot of monitoring software gets on. Google's Android cleanup steps start with turning on Play Protect in the Play Store app's settings and installing any pending system update. Then uninstall every app you don't trust or didn't get from the Play Store.
An app that refuses to uninstall usually has device-admin access. Android's developer documentation says an active device admin app has to be switched off as an administrator before it can be removed, so look for "Device admin apps" in your security settings. The exact menu name varies by phone maker. Google's page ends by saying that if you still see signs of malware, you may need to reset the device.
One caution applies to either phone. If you think a partner or family member put monitoring software on it, the FTC suggests talking to a domestic violence advocate before you remove it, because cutting off someone's access can make them escalate. Do that from a different phone.
When your phone suddenly has no service
If your phone drops to no signal or "SOS only" at home, and the problem doesn't go away after a restart, consider a SIM swap. That's when someone gathers enough about you to pose as you with your carrier, then moves your number to a SIM they control. Verizon's explainer puts it simply: once the swap goes through, your calls and texts go to the criminal's phone. You might not notice until yours stops working. That matters because so many reset codes go out by text.
Call your carrier right away from another phone. Then change the passwords on your email and bank accounts and look at their recent-login pages. Afterward, turn on whatever lock your carrier offers against number transfers and SIM changes. Verizon's Number Lock and SIM Protection are both free. If you're with another carrier, ask what its equivalent is called. The IC3 report logged only 971 SIM-swap complaints in 2025, but $17.4 million in losses from them.
What to do if you've been hacked: the steps, in order
Each step assumes the ones before it are done. Jumping straight to "change all my passwords" while the attacker still has your email or your laptop is how people lose the same accounts twice.
Step 1: Contain the device before touching accounts
If you think the computer or phone itself is compromised, and not just one online account, anything you type on it could be seen, including new passwords. Disconnect it from Wi-Fi and run a full scan with updated security software. Do your account recovery from a different device you trust. If the device seems fine and only one account is affected, move on.
Step 2: Take back your email first
Whoever controls your email can reset every other password you have, so it comes first. Use the provider's own recovery flow (there's more on that below if the normal reset fails). Once you're back in, change the password. Then sign out every other session.
Then look for the ways an attacker leaves themselves a door. Google's checklist for a compromised account tells you to fix any unfamiliar recovery phone or email and check the apps with access to your account. In Gmail's settings, check forwarding and filters. Google also lists delegation and POP/IMAP access. A forwarding rule that copies your mail to a stranger keeps working after you change the password. On Google accounts, changing the password revokes your app passwords automatically. On other providers, look for app passwords or "connected apps" and delete any you didn't create.
Step 3: Change passwords and turn on two-factor authentication
Work outward from email: banking first, then anything that stores a card, then social media, then the rest. Every new password should be unique, and a password manager makes that painless. Turn on two-factor authentication as you go. An authenticator app beats text-message codes, which a SIM swap can redirect.
A passkey is better again where a site offers one. Google's passkey page explains that a passkey can't be copied or handed to someone, which is what makes it hold up against phishing. If an account offers "sign out of all devices," use it, because a password change doesn't always end sessions that are already open.
Step 4: Check for changes the attacker left behind
In every account you've recovered, go through the settings an attacker would touch. Look at saved payment methods and shipping addresses first. Then check connected third-party apps and auto-replies. Any device recently added as "trusted" should be one you recognize. On social media, look for posts and new follows you didn't make. Check the recovery phone number one more time, because an attacker's number left there can undo everything.
Step 5: Contact the organizations that hold your money
If a bank account was involved or a card was saved in a hacked account, call the issuer on the number printed on the card. Dispute the charges you didn't make and ask for a new card number.
The FTC's page on lost or stolen cards sets out what you can be made to pay, and the rules for a hack are kinder than people expect. When only the card number was stolen and you still have the card, you aren't responsible for unauthorized credit card charges. For a debit card in the same situation, you owe nothing as long as you report within 60 days of the statement that shows the charge.
The tighter clock applies when the physical card or PIN is gone. A credit card's limit is $50. A debit card costs you nothing if you report before it's used. Within two business days of noticing, the most you can lose is $50. After that it rises to $500, as long as you're within 60 days of the statement. Past 60 days, the FTC says you could lose all the money taken from the account "and possibly more." Debit cards draw straight from your money, so call that day.
Step 6: Freeze your credit
If the attacker could have seen your Social Security number or enough personal detail to open accounts in your name, place a credit freeze at each of the three national credit bureaus. The FTC's freeze and fraud alert page says it costs nothing to place or lift. You have to contact each bureau separately, and the freeze stays in place until you lift it.
A fraud alert is the lighter option if you only suspect exposure. You contact one bureau, which tells the other two. It lasts a year. Identity theft victims can get an extended alert that lasts seven years.
Step 7: Report it
If someone used your information to open accounts or make purchases, report it at IdentityTheft.gov. The FTC says you'll get a personal recovery plan and pre-filled letters to send to credit bureaus and businesses. The hack itself can go to the FBI at ic3.gov. IC3 says it can't respond to every complaint, but reports feed its picture of what's going around.
If the device or account is connected to your job, tell your IT team the same day. If your work password matches anything that leaked, change it too.
Step 8: Warn your contacts
A hacked email or social account is often used to go after the people who trust you. Expect messages like "I'm stuck abroad and my card got declined," or a link that seems to come from you. The FTC's recovery guide recommends a short note telling your contacts not to click links in messages from you.
Step 9: If the device was infected, wipe it
If a computer or phone showed real signs of compromise, especially anything that looked like remote control, a scan isn't enough to be sure. A factory reset is the surest fix. Back up your photos and documents first and restore those afterward. Reinstall apps fresh from the store, though, because the FTC's stalkerware guidance warns that restoring apps from a backup can bring the monitoring software back.
Step 10: Close the holes so it doesn't happen again
You're done when the way in is closed, not when you can log in again.
- Keep the unique passwords and two-factor settings from Step 3. Going back to one password for everything quietly undoes the whole cleanup.
- Turn on automatic updates for your phone, computer and browser. Updating software is one of the four core steps on CISA's Cybersecurity Awareness Month page, next to multifactor authentication, strong passwords and avoiding phishing.
- Expect follow-up phishing. Someone who lost your account may try again with what they learned, and an email warning that "your account was hacked again" deserves extra suspicion. Our guide to social engineering attacks shows what the follow-ups tend to look like.
- Shrink what's public about you. Phone numbers, address history and relatives' names circulate in breach dumps and get republished by people-search sites. We screenshot those sites for our opt-out guides, and the free preview on a site like Spokeo shows a stranger your age, your relatives' names and your past cities before any paywall. Spokeo also takes an email address as a search term, so an address that leaked in a breach can lead straight to your name and city. That's much of what a caller needs to pass a carrier's security questions in a SIM swap. Our guide to removing your personal information from the internet walks through taking it down.
There's also some reassurance in that work. Broker files are often out of date. When we file a removal through PeopleConnect's suppression tool, which covers TruthFinder and Intelius among others, the masked phone number it offers for verification is frequently one the person stopped using years ago. Anyone working from broker data inherits those mistakes, which is one more reason a fresh, unique password per account beats them more often than you'd expect.
Hacked account recovery when the normal reset fails
If the attacker changed your password along with your recovery details, the regular "forgot password" link won't help. Each big provider has a fuller recovery route, and each one wants proof that you're the owner.
Google's recovery tips are to use a device and a location where you usually sign in. Answer every question rather than skipping, and give the most recent password you remember. Wrong guesses won't end the attempt. Google also says you can't call it for help signing in, and if recovery still fails, the only option it offers is creating a new account.
Microsoft points you to its sign-in helper first, then its account recovery form. Microsoft says it replies within 24 hours and allows two tries a day. Use a device you've signed in on before. One dead end: if you had two-step verification on and can't reach any of your backup methods, Microsoft's page says "we cannot help you, sorry." After you get in, its hacked-account page says to review your forwarding settings and connected accounts.
Apple's version is called account recovery and starts at iforgot.apple.com. It can take several days or longer, and Apple Support can't shorten the wait. If you started on the web, Apple says to turn off your other Apple devices while you wait, since using one that's still signed in cancels the request. Apple's compromised-account page also suggests asking your carrier whether someone turned on SMS forwarding for your number.
A hacked social media account
For Facebook, go to facebook.com/hacked, ideally from a device you've logged in on before. When someone changes the email on a Facebook account, Facebook sends a message to the old address with a link that reverses the change, so search your inbox for it before anything else. Instagram's equivalent is instagram.com/hacked, which Meta's hacked-account page lists next to Facebook's. Once you're back in, delete what the attacker posted. Then check which devices are logged in.
"Your device is hacked" pop-ups are a scam, not a hack
A full-screen warning that your computer is infected, with a number to call, is a scam. The FTC's tech support scam page says "real security pop-up warnings and messages will never ask you to call a phone number," and that real tech companies won't contact you out of the blue about a problem with your computer. Close the tab. If the browser won't let you, quit it and reopen it without restoring the old tabs.
The danger starts when you call. The person on the line asks for remote access, then for payment. The 2025 IC3 report counted 47,794 tech support complaints and about $2.1 billion in losses from them.
If you already let someone in, treat it as a real compromise. The FTC's steps after a scam are to update your security software and run a scan, deleting anything it flags. Then change your passwords with two-factor turned on. If you paid with a gift card, call the issuer at the number on the back and tell them a scammer got the card number. Report it at ReportFraud.ftc.gov.
When to involve the police
For most hacks you don't need a police report. The FTC's identity theft recovery plan calls the Identity Theft Report you get from IdentityTheft.gov "an official report to law enforcement" and says it's enough for the credit bureaus and most companies. It says to go to your local police as well if you have information about a suspect, or if a company asks for a police report as part of its dispute process. When you go, bring a copy of your FTC report and a photo ID.
Go to the police straight away if the hack comes with threats or extortion, including anyone threatening to publish private photos. The same goes for someone tracking where you are. Keep the messages as evidence.
How long does recovery take after you've been hacked?
The core of it, Steps 1 through 4, usually takes an evening. Bank disputes and credit freezes add a few phone calls over the next several days, and a provider's formal recovery process can stretch that further.
Then there's a monitoring tail of a few months. Keep an eye on statements and login alerts, and check your credit reports. The three bureaus have permanently extended free weekly reports at AnnualCreditReport.com, which the FTC calls the only authorized site for them. If something new turns up, run the same sequence again. Our identity theft statistics page collects the numbers on how often this happens. The explainer on how data breaches happen covers where stolen details come from.
Frequently asked questions
I've been hacked. What should I do first?
Get to a device you trust and recover your email account, because it controls the password resets for everything else. Then change your banking passwords and call your bank if money or a saved card was involved. The credit freeze can wait an hour, not a week.
How do I know if my phone is hacked or just old?
Look for a pattern rather than one symptom. Fast battery drain or overheating can each be innocent. When they come with apps you didn't install or a configuration profile you didn't add, run the checks in the phone section above. Someone knowing things they shouldn't is the strongest sign of all.
Can someone hack my phone through a text?
The common route is a link in a text that leads to a fake login page, where you type the password yourself. That's phishing rather than a hack of the phone. The zero-click spyware you may have read about is aimed at a small number of people, and Apple says most users will never be targeted by it.
Does a factory reset remove hackers?
It removes software on the device, including monitoring apps, as long as you don't restore apps from an old backup. It does nothing for your online accounts. If someone has your email password, they still have it after the reset, which is why Step 2 comes before Step 9.
Should I pay someone who offers to recover my account?
No. The big providers run their own recovery for free. Google says you can't call it for sign-in help, and Apple says its own support staff can't shorten the recovery wait, so a stranger promising a shortcut can't deliver one.
What if I can't get my account back at all?
Some accounts can't be recovered. Microsoft says so plainly when two-step verification is on and you've lost every backup method. Tell your contacts the account isn't you anymore, and move your bank and other logins to a new email address. Google's own advice when recovery fails is to create a new account.
Do I need to tell my bank if only my email was hacked?
Yes, if your bank's reset links go to that email or the inbox held copies of your ID. Otherwise, changing the bank password is enough.