Hacked? A Step-by-Step Emergency Response

Find what happened below and work down its steps in order. Each one says exactly where to click. Do the first section that fits now; the rest can wait an hour.

Someone got into an account

Start with your email, even if it wasn’t the account that was hit. Whoever controls your email can reset every other password. Then do your bank, your Apple or Google account, and anything else that matters.

For each account, in this order:

1. Change the password. Use your password manager to generate a new one, and don’t reuse it anywhere. If you can’t sign in at all, skip to locked out below.

2. Sign out every other device. This kicks the attacker out of any session they already have open. A new password alone doesn’t always end those sessions.

   Google and Gmail

   Go to myaccount.google.com/device-activity. Select each device you don’t recognize, or any device that isn’t the one in your hand, and choose Sign out.

   Apple Account (iCloud)

   On an iPhone, open Settings, tap your name, and scroll down to your device list. Tap any device you don’t recognize and choose Remove from Account. On a computer, sign in at account.apple.com and open Devices.

   Microsoft (Outlook, Hotmail, Xbox)

   Sign in at account.microsoft.com/security, open Advanced security options, and scroll to Sign out everywhere. It can take up to 24 hours to reach every device, and an Xbox console has to be signed out separately.

   Facebook and Instagram

   Open Accounts Center (in either app’s settings), then Password and security, then Where you’re logged in. Pick the account and choose Log out of all sessions.

   Anything else

   Open the account’s settings and look for a page called Security, Sessions, Devices or Where you’re logged in. If there’s no sign-out option, changing the password and turning on two-factor is the best you can do.

3. Check the recovery email and phone. Attackers swap in their own so they can get back in later. In the same security settings, make sure every recovery address and number is yours, and delete any that aren’t.

4. Remove two-factor methods you didn’t add. Look for an authenticator app, passkey, security key or phone number you don’t recognize, and delete it. Then turn on two-factor yourself if it was off, using an authenticator app or passkey rather than text messages.

5. For email, check forwarding and filters. A common trick is a rule that quietly sends copies of your mail to the attacker, or deletes the security alerts.

   Gmail

   Click the gear icon, then See all settings. Check the Forwarding and POP/IMAP tab and the Filters and Blocked Addresses tab, and delete anything you didn’t set up.

   Outlook

   Open Settings, then Mail. Check Forwarding and Rules, and delete anything you didn’t set up.

6. Revoke apps you don’t recognize. Attackers sometimes connect an app that keeps access after the password changes. For Google, that list is at myaccount.google.com/connections. Most other services list them under Connected apps or Apps and websites.

7. Tell people. If messages went out in your name, let your contacts know so they don’t click anything or send money.

If you’re locked out

Use the company’s own recovery page, never a “recovery service” that finds you through search ads or social media.

• Google: g.co/recover
• Apple: iforgot.apple.com
• Microsoft: account.live.com/acsr
• Facebook: facebook.com/hacked
• Instagram: instagram.com/hacked

Recovery works best from a device and location you’ve used before, so try from your usual laptop or home Wi-Fi if you can.

Money was taken

Speed matters more than anything here. I’ve had a card charged by someone else; I caught it the same day, disputed it, and had the money back within a week.

1. Lock the card or account in your bank’s app. Most apps have a Lock card or Freeze card switch on the card’s page. It stops new charges in seconds, and you can undo it.

2. Call the number on the back of your card. Not a number from an email or text. Tell them which charges you didn’t make, ask them to dispute them, and ask for a new card number.

3. If it was a bank transfer, Zelle or wire, say so on the call and ask them to try to recall it. These are much harder to reverse than card charges, so call the same day.

4. Freeze your credit at all three bureaus. It’s free, takes about ten minutes, and stops anyone opening new accounts in your name. Unfreeze it any time you apply for credit yourself.

   • Equifax
   • Experian
   • TransUnion

5. If someone used your identity, not just your card, report it at IdentityTheft.gov. It’s the FTC’s official site, and it builds a recovery plan and a report you can hand to banks.

My phone is lost or stolen

1. Mark it as lost. This locks the screen, shows a message, and keeps tracking it.

   iPhone

   Sign in at icloud.com/find from any browser, select the phone, and choose Mark As Lost.

   Android

   Go to android.com/find, sign in with the phone’s Google account, and choose Secure device.

2. If it’s not coming back, erase it. Use Erase This Device (iPhone) or Factory reset device (Android) from the same page. Once you erase it you can’t track it any more, so do this once you’ve given up on getting it back.

3. Call your carrier to suspend the line, so nobody can use your number to receive your login codes. Ask them to block the phone’s IMEI too, so it can’t be used on another account.

4. Sign out of the phone from your accounts. Follow the sign-out step under hacked account for your email, Apple or Google account and your bank.

My phone suddenly has no service (SIM swap)

If your phone drops to “SOS only” or “No service” without explanation, especially after a text about a SIM or number change, someone may have moved your number to their phone. Once they have it, every text-message code goes to them. Treat this as urgent.

1. Call your carrier from another phone, or go to one of their stores with ID. Say you didn’t authorize a SIM change and ask them to reverse it and lock the account. Ask for the fraud team if the first person can’t help.

   • Verizon: 1-800-922-0204
   • AT&T: 1-800-331-0500
   • T-Mobile: 1-800-937-8997

2. Secure your email and bank from a computer. Follow the hacked account steps, starting with email. Look closely for anything that changed in the last few hours.

3. Stop using text messages for two-factor. Switch every important account to an authenticator app, passkey or security key.

4. Turn on your carrier’s lock once you have your number back, so it can’t happen again: SIM Protection and Number Lock at Verizon, Wireless Account Lock at AT&T, and SIM Protection at T-Mobile. Each is a switch in the carrier’s app.

My computer or phone is acting strangely

Pop-ups that won’t go away, settings changing on their own, or a cursor moving by itself can mean malware or someone with remote access. Most “hacked” accounts are stolen passwords rather than infected devices, but if the device itself is the problem:

1. Disconnect it. Turn off Wi-Fi and unplug any network cable, so nothing more leaves it.

2. Change important passwords from a different device, starting with email and bank. Anything typed on the infected device may have been recorded.

3. Back up your files, not your apps. Copy photos and documents to a drive or cloud storage. Don’t restore a full backup made after the trouble started; it may bring the problem back.

4. Erase it and start fresh.
   iPhone

   Settings → General → Transfer or Reset iPhone → Erase All Content and Settings.

   Android

   Settings → System → Reset options → Erase all data (factory reset). The wording varies a little by phone maker; search settings for “reset” if you can’t find it.

   Mac

   System Settings → General → Transfer or Reset → Erase All Content and Settings.

   Windows

   Settings → System → Recovery → Reset this PC → Remove everything.

I gave something away on a call

Scammers call pretending to be your bank, the IRS, tech support or a family member, and they rush you. Real banks never ask for your password, PIN or a login code. If you shared something, act on what you gave away:

• A password or login code: follow the hacked account steps for that account now.
• Card or bank details: follow the money steps, starting with locking the card.
• Your Social Security number: freeze your credit at all three bureaus (links in the money section), and get an IRS Identity Protection PIN so nobody can file a tax return in your name.
• They had you install an app to “fix” something (AnyDesk, TeamViewer and similar): treat the device as infected.
• You paid with gift cards: call the gift card company right away with the card numbers; sometimes they can freeze the balance.

Then report it at ReportFraud.ftc.gov. If they claimed to be a company you deal with, hang up and call that company on the number from its website or your statement.

Once it’s under control

The same two things prevent most of this: a password manager, so no password is reused, and two-factor that isn’t text messages. How to Secure Your Digital Life sets up both in an afternoon, and Passkeys removes passwords from the accounts that support them.