What should you do if your social media account is hacked?

When an account is hacked, the first thing the attacker does is change the email and the phone number; that's why speed is everything. The order below gives you the highest chance of getting the account back.

There's also a point that often gets skipped: the other accounts opened with the same email and password. The attacker usually carries on from there.

1. Try changing the password If you can still log in, change your password right away and don't use the new password anywhere else.
2. If you can't get in, start the recovery process Use the platform's “I can't get into my account / my account has been hacked” form. To verify your identity, it may ask for your old password, the registered email and roughly when you opened the account. 💡 Filling in the recovery form from the device and connection you used when you opened the account makes things easier.
3. Close all sessions Once you've got the account back, go to the “active sessions/devices” list in the security settings and end every session you don't recognize.
4. Check your email account The attacker usually gets into your email first. Change your email password and look at the redirect rules and the automatic forwarding settings. 💡 If a hidden redirect rule has been left behind, your mail keeps being read even if you change the password.
5. Turn on two-step verification Prefer an authenticator app over SMS; write the backup codes on paper and keep them safe.
6. Clean up connected apps Review the third-party apps you've given access to your account, and revoke the permission of the ones you don't recognize.
7. Warn the people around you Messages asking people you know for money may have gone out from your account. Tell people what happened; fraud like this usually ends up costing your friends' money, not yours.
8. If a complaint is needed, gather documentation If there's a demand for money or a threat, take screenshots and go to the police.

⚠ This guide is general information. Yudum cannot be held responsible for the outcome of following it; for official procedures always rely on the institution's own statement. Steps and fees change over time.

🎯 Related content

How do you download and delete your data with Google Takeout? From photos to email, from location history to searches — what's in your account? Download it all, and have what you don't need deleted automatically. Where do you report internet fraud? If you've lost money, the first hours are critical. Which incident goes to which institution, and which evidence you need to gather — in order. How do you turn on two-step verification? Keep your account out of reach even if your password is stolen: two-step verification is the single setting that, on its own, makes the biggest… How to spot a scam message A parcel, a bank, e-Devlet, a prize draw... Fake messages all use the same patterns. Once you have learned those patterns, you don't fall for them… What to do if you forget your password No panic. If you gave an e-mail address it is a five-minute job — if you didn't, there is a section you need to read. How to set up your profile and avatar An empty profile looks like an empty chair. Five minutes and people start recognizing you.