The first hour
Speed matters more than elegance. An intruder who gets into one account usually tries the same password elsewhere within minutes, and the account that matters most is your email, because every password reset link you own lands there. Work from a device you trust, not the one that may be infected, and go in this order.
- Change the email password first, even if the email account is not the one that was hit.
- Change the password on the hacked account to a new one you have never used anywhere.
- Use the account's option to sign out of all other sessions and devices, which throws the intruder out.
- Turn on two-factor authentication, or reset it if it was already on, and generate fresh backup codes.
- Change the password on every other account that shared the old one.
What an intruder leaves behind
A changed password does not undo what was done while they were inside. Open the security settings and read every line. Look for a recovery email or phone number you do not recognize, because that is how they plan to return. In an email account, check for forwarding rules and filters that silently send copies of your mail elsewhere or hide messages from your bank. Review the list of connected apps and revoke anything unfamiliar. Check the sent folder, the trash, and recent orders, payments or posts.
If you are locked out
Use the service's official account recovery process, reached by typing the address yourself, and fill it out from a device and location you have used with that account before, since those signals count in your favor. Expect it to take days. Anyone on social media offering to recover your account for a fee is running a second scam on top of the first.
Tell the people who need to know
If money is involved, call the number on the back of your card and dispute the charges that day. Warn your contacts that messages from the account may not have been you, because the most common use of a stolen profile is asking your friends for money. If the intruder got your Social Security number or opened accounts in your name, the Federal Trade Commission's IdentityTheft.gov builds a recovery plan step by step.
Tip Run a malware scan and check your browser for extensions you did not install before you type the new passwords, or you may simply hand them over a second time.
