How to recover a hacked account
Recover a hacked account by using only the service's official recovery page, then changing the password, signing out all other sessions, turning on two-factor sign-in, and checking recovery email, phone, forwarding rules and connected apps for changes the hacker made. Do it on a clean device. Before it ever happens, save backup codes and keep your recovery details current.
Why it matters: Backup codes and current recovery details make recovery minutes instead of weeks.
Steps
- Use a device you trust and go to the service's official recovery page by typing its address, never through a link in a message.
- Reset the password to a new, unique one from your password manager.
- Sign out of all other sessions and devices in the security settings.
- Turn on two-factor sign-in if it was off.
- Check the recovery email and phone number, email forwarding rules, and connected apps, and remove anything you did not add.
- Warn your contacts not to trust recent messages from the account.
- Afterward, save backup codes for every important account, before you need them.
Common mistakes
- Following a recovery link from a text or email, which may be the scam.
- Changing the password but leaving the hacker's forwarding rule in place.
- Using the same new password somewhere else.
Teach this to someone
A one page sheet for showing a friend, a teenager or a parent: what to say, what to show, and one question to check it landed.
Teach: How to recover a hacked account
What to say
Recover a hacked account by using only the service's official recovery page, then changing the password, signing out all other sessions, turning on two-factor sign-in, and checking recovery email, phone, forwarding rules and connected apps for changes the hacker made. Do it on a clean device. Before it ever happens, save backup codes and keep your recovery details current.
What to show
- Use a device you trust and go to the service's official recovery page by typing its address, never through a link in a message.
- Reset the password to a new, unique one from your password manager.
- Sign out of all other sessions and devices in the security settings.
- Turn on two-factor sign-in if it was off.
- Check the recovery email and phone number, email forwarding rules, and connected apps, and remove anything you did not add.
- Warn your contacts not to trust recent messages from the account.
- Afterward, save backup codes for every important account, before you need them.
Check question
How should you reach the recovery page?
Answer: Type the service's address yourself. Links in messages may lead to fake recovery pages.
Your checklist
Saved only in this browser.
Quick quiz
Three questions. Your score is saved only in this browser.
Related skills
Sources
- US national cybersecurity guidance for individuals, 2026. Reviewed September 28, 2026.
Written in our own words from the sources above. It is general information, not advice for your situation; where a professional, your doctor or your lease says something different, follow them.
Last reviewed . First published .