Home › Security

10 Signs Your Account Has Been Hacked (and What to Do)

By Ammar Aslam · Updated September 29, 2026 · 3 min read
10 Signs Your Account Has Been Hacked (and What to Do)

Hacked accounts don't always announce themselves. Sometimes the signs are subtle. Spotting them early limits the damage to your money, reputation and contacts.

Warning signs

  1. Password no longer works, and you didn't change it.
  2. Login alerts from unknown devices or locations.
  3. Messages or posts you didn't send, often scam links or requests for money.
  4. Friends tell you they got strange messages from you.
  5. Password reset emails you didn't request.
  6. Changed recovery details: a new phone number or email you don't recognise.
  7. Unknown purchases or payment notifications.
  8. Emails in your Sent folder you didn't write, or rules forwarding your emails elsewhere.
  9. New connected apps or devices in your account settings.
  10. Your email appears in a data breach. See what to do after a breach.

What to do immediately

  1. Change your password from a device you trust. Make it strong and unique.
  2. Sign out of all sessions in the account's security settings.
  3. Check recovery email and phone number and remove any you don't recognise.
  4. Turn on two-factor authentication. See our 2FA guide.
  5. Review connected apps and remove unknown ones.
  6. Check email forwarding and filters for rules that send your emails elsewhere.
  7. Change passwords anywhere you reused the same password.
  8. Warn your contacts not to trust recent messages from you.

If you're locked out

Use the service's official account recovery process. Specific guides:

Beware of "account recovery services" that contact you offering help for a fee; many are scams.

Check your devices

If accounts keep getting hacked, your device might have malware that steals passwords. Run a full antivirus scan and remove unknown apps and browser extensions.

If money is involved

Contact your bank immediately using the official number, block cards and report fraudulent transactions.

Prevention: unique passwords from a password manager plus 2FA stop the vast majority of account takeovers.

How to check recent account activity

Most major services show where and when your account was accessed:

ServiceWhere to look
Google / Gmailmyaccount.google.com → Security → Your devices; Gmail → "Details" at bottom of inbox
Facebook / InstagramAccounts Center → Password and security → Where you're logged in
WhatsAppSettings → Linked devices
Microsoftaccount.microsoft.com → Security → Sign-in activity
AppleSettings → [your name] → device list

Look for unfamiliar devices, locations or times. Locations can be approximate, especially on mobile data, so focus on devices you don't recognise.

Prepare now so recovery is easy

  • Keep recovery email and phone numbers up to date on every important account.
  • Save backup codes for 2FA in a safe place.
  • Use a password manager so changing many passwords quickly is simple.
  • Make sure your main email account is the most secure of all, since it's used to reset others.
  • Know the official recovery pages for your main accounts.

Don't feel embarrassed

Account takeovers happen to careful people too. Scams are designed to be convincing. Reporting quickly and warning friends protects others, and there's no shame in being targeted.

Frequently asked questions

How did they get my password?

Common causes: reused passwords from breached sites, phishing pages, or malware.

Should I delete the hacked account?

Usually no. Recover and secure it; deleting can lose important data and contacts.

A
Ammar Aslam
Ammar writes clear, practical tech guides that help everyday users fix problems, stay safe online and get more from their devices.

Keep reading