Getting back into a hacked account is only half the job. Attackers frequently leave themselves a way back: a second email, a connected app, a business admin role, or an email rule that quietly forwards your password resets. Work through this list in order, ideally in one sitting.

The 10-step checklist

  1. Change the password to a long, unique one you have never used anywhere else. A password manager makes this painless.
  2. Log out every other session. On Meta platforms this is in Accounts Center → Password and security → Where you’re logged in. On Google, review Your devices. Sign out of everything you don’t recognise.
  3. Check contact details. Remove any email address or phone number you don’t own. Attackers often add their own as a backup.
  4. Turn on two-factor authentication, preferably with an authenticator app or a passkey rather than SMS. Remove any 2FA method you didn’t set up.
  5. Remove connected apps you don’t recognise. Look for sections called Apps and websites, Third-party access or Connected apps.
  6. Check admin roles. For Facebook Pages, Business Manager, ad accounts and YouTube channels, remove any person or partner you didn’t add.
  7. Check your email account’s rules. In Gmail or Outlook, look at forwarding and filters. A single hidden rule can forward every reset email to the attacker.
  8. Review recent activity. Look for posts, messages, stories, ads or purchases made in your name, and delete or report them.
  9. Tell people who may have been targeted. If the attacker messaged your friends or customers asking for money or codes, warn them publicly.
  10. Change passwords elsewhere if you reused the old password, starting with your email, banking and any account that receives payments.

Save your recovery details somewhere safe

Most platforms let you save backup codes for two-factor authentication. Print them or keep them in your password manager. If you ever lose your phone, those codes are the difference between a two-minute login and a two-week recovery.

Keep a recovery note. Write down the date of the hack, what was changed, and how you got back in. If it happens again, or if you need to appeal later, that record is valuable evidence.

Watch for signs of a second attempt

For the next few weeks, pay attention to:

  • login alerts from places you have never been,
  • password reset emails you didn’t request,
  • messages from “support” asking you to verify your account.

Each one is a reason to check your sessions and contact details again.

When to get help

If the account is still behaving strangely, the attacker keeps getting back in, or the account belongs to your business, our Account Recovery service can review it with you. And if someone has made a fake copy of your account while you were locked out, see our guide on reporting impersonation.

Frequently asked questions

Is SMS two-factor authentication good enough?

It is much better than nothing, but an authenticator app or passkey is safer, because SMS codes can be intercepted through SIM swapping.

Why did the hacker get back in after I changed my password?

Usually because a session, a connected app, an admin role or an email forwarding rule was left in place. Work through the whole checklist, not just the password.