Situation · Hacked account
Hacked account: secure access and check what has changed
From a trusted device, change the password, close unknown sessions and check the recovery methods. Then check the rules, authorised apps and linked accounts before you consider the account secure.
We will never ask for your codes or your passwords.
Do this right away
Three steps, in this order, from a safe device:
- Change the password of the account (and of the email linked to it), then turn on two-factor authentication.
- Sign out of every session and device you don’t recognise.
- Don’t delete anything: suspicious messages and emails are evidence. And warn the people close to you that the account has been compromised.
How to tell if your account has been hacked
A compromised account almost always leaves signs. If you recognise one of these situations, it’s time to act.
You’re locked out
Your password no longer works, or the recovery email address and phone number have been changed without your knowledge.
Messages are being sent in your name
People close to you are receiving links, requests for money or posts you didn’t write: the account is being used to scam them in turn.
Unknown activity
Sign-in alerts from a new device or another country, forwarding rules or filters you never created, authorised apps you don’t recognise.
Regain access, in the right order
The right order avoids two common mistakes: leaving an access still active, or deleting items that are useful for your formal steps too soon.
1. Regain access through the official route
Each service has its own recovery procedure (“forgot password” / “hacked account”). It is always the right door, and it is free. Never go through a paid third-party “service” that promises to recover your account.
- Instagram / Facebook: “Hacked account” at facebook.com/hacked or the recovery option in the app. Check the linked email and phone number, which may have been changed.
- Snapchat: “Forgot password”, then the support form if the email or phone number has been changed.
- WhatsApp / Telegram: reinstall and re-verify your number by text, then turn on the PIN (two-step verification).
- TikTok / X: recovery by email or phone; report the account as compromised if access is locked.
- Email (Gmail, Outlook, iCloud…): deal with this first: it is often used to reset your other accounts and to receive bank alerts.
If the hacker changed your email and your phone number, platforms offer a specific form, sometimes with identity verification or a video selfie. It takes longer, but it is the reliable route.
2. Close the doors the hacker may have opened
Regaining access is not enough: an account can stay vulnerable even after a new password. Go through these, one by one:
- Sessions & devices: sign out of everything, then sign back in on your own devices only.
- Recovery methods: secondary email, phone number, security question, trusted device: remove anything that isn’t yours.
- Email rules: forwarding, filters and delegations can divert your emails or hide alerts.
- Authorised apps: third-party apps, app passwords, IMAP/POP access: remove anything you don’t recognise.
3. Warn people and check what was affected
If fraudulent messages have been sent, warn your contacts to limit the spread. Check posts and orders placed, and keep an eye on your bank and the accounts linked to the hacked account. Warning people quickly protects them.
Report it, and protect the rest
Once the account is secure, a few useful steps depending on your situation, with no obligation, at your own pace.
Report the incident
cybermalveillance.gouv.fr is the French public one-stop service for victims of cybercrime. A report also helps document the facts.
Open Cybermalveillance.gouv.fr →File a police report
If you have suffered a loss (identity theft, extortion, people close to you scammed) filing a police report is useful. We explain what to do.
File a police report / report →Alert your bank
If bank details or payments are involved, contact your bank without delay to block your card. Here are the steps to request a refund, which is assessed case by case depending on your situation.
Dispute a bank transaction →Official reference: Cybermalveillance.gouv.fr, “account hacking” quick-reference sheet.
What you must not do
A few costly reflexes to avoid, and our commitment to transparency.
The traps to avoid
- Never pay a “ransom” to get an account back: nothing guarantees it will be returned, and it encourages the scammer.
- Don’t rush to create a new account before trying the official recovery.
- Never enter your login details on a link received in a message: that is often the scam itself.
- Don’t delete suspicious messages or emails: they serve as evidence.
- Be wary of paid “recovery services” that ask for money or codes.
In all honesty
Serious help stays cautious: it secures, documents and explains, but it does not turn an assumption into evidence.
- No guaranteed recovery if the platform blocks the account permanently.
- No access to the platform’s internal data, and no promise to identify the culprit.
- We never ask for your passwords, codes received by text or your full card number.
A clear plan to secure your account.
Start with the free diagnosis: in a few minutes, you’ll know what to do, and then you decide whether you want an expert’s help. No result is promised in advance, but every step is clear.