How to Recover a Hacked Social Media Account: The Step-by-Step Recovery Guide (2026)

How You Know You Have Been Hacked

A hacked account rarely announces itself politely. Watch for these signs, and treat even one of them as a reason to act immediately:

• Posts, messages or stories you did not send: Crypto promotions, "investment opportunities", links to strange websites, or messages asking your friends for money or codes. Attackers use your trusted name to reach your contacts.
• Password or email changed without you: Login alerts, "password changed" emails, or a sudden inability to log in at all usually mean the attacker changed the recovery details to lock you out.
• New devices, locations or apps: A login from a city you have never visited, or a new connected app you never approved, in your account's security settings.
• Friends report strange messages from you: Often your friends notice before you do. If two people tell you the same thing, believe them.
• Your profile details changed: A new profile picture, bio link, phone number or email address you did not set.

Do not wait for proof. If something looks wrong, start the recovery steps below right now — every minute the attacker keeps access, more of your contacts can be targeted in your name.

Step 1: If You Can Still Log In — Lock the Attacker Out

Speed matters more than elegance here. Work through these in order, from a device you trust:

1. Change the password immediately to a long, unique one you have never used anywhere else. Do this from your own phone or computer, not from a shared or public device. If you reuse passwords, the attacker may already know the new one too — uniqueness matters as much as length. See our Password Security Guide for how to build a strong passphrase.
2. Sign out of all sessions everywhere. Every major platform has a "log out of all devices" or "active sessions" screen in security settings. Use it. This kills the attacker's session even if they still have an old password or token.
3. Check and fix the recovery details. Look at the email address and phone number on the account. If the attacker changed them, change them back to yours now, before they can use a password reset against you.
4. Turn on two-factor authentication (2FA) with an authenticator app, not SMS, if the platform offers the choice. Our Two-Factor Authentication Guide explains the setup step by step. This single step blocks most repeat attacks even if a password leaks again.
5. Review connected apps and permissions. Attackers often connect a third-party app to keep access after a password change. Remove anything you do not recognise.

Only after the account is locked down should you start cleaning up posts and messages. Lock first, clean second — otherwise the attacker can simply re-post faster than you delete.

Step 2: If You Are Locked Out — Recover Access Properly

Being locked out is frightening, but platforms have official recovery paths, and they work if you follow them carefully:

1. Use the official "Forgot password" flow only. Go to the platform's own login page or app — never through a link someone sent you. A recovery link from a stranger is a classic second attack.
2. Use your recovery email or phone. If the attacker changed them, look for the platform's "I no longer have access to these" option, which starts an identity-verification process instead.
3. Complete identity verification honestly. Platforms may ask for a photo of you, a government ID, or confirmation from trusted contacts. Provide only what the official flow asks for, on the official site, and nothing more. Never send ID photos to a "support agent" who contacts you by chat or email — real support never works that way.
4. Never pay anyone for recovery. Anyone offering to recover your account for a fee — especially on social media or messaging apps — is almost certainly a scammer, and often the same person who took the account. Recovery through the platform is free.
5. Be patient and keep records. Verification can take days. Save every case number, email and screenshot. If one attempt is rejected, read the reason, fix the issue, and try again rather than submitting the same thing repeatedly.

While you wait, protect the accounts connected to the hacked one: change your email password first (your email is the master key to every reset link), then the passwords of any service that shared the same password. Our Secure Your Google Account Guide covers the email side in detail.

Step 3: Warn Your Contacts Before the Attacker Reaches Them

A hacked account is not just your problem — it is a weapon aimed at everyone who trusts you. The moment you know, warn people through a channel the attacker does not control:

• Post from another account or ask a close friend to post: "My account was hacked — please ignore any messages, links or money requests from it until I confirm I am back."
• Message your closest contacts directly: Family members and anyone who might send money or codes are the priority targets. A short message now prevents a costly mistake later.
• Tell people what the attacker is sending: If the attacker is pushing a fake investment link or a "help, I need money" story, name it. Specific warnings are far more effective than vague ones.
• Do not feel embarrassed: Account takeovers happen to careful people every day, usually through phishing or a leaked password from another site. Warning others quickly is the responsible move, not a shameful one.

Step 4: Clean Up and Check for Hidden Damage

Once you are back in control, audit what the attacker did while they had access:

• Delete posts, messages and stories you did not send, and check your sent messages folder — the attacker may have messaged people whose replies you need to correct.
• Check for changed settings: Privacy settings loosened, new followers or blocked contacts, changed bio links, new payment methods, or ad accounts created in your name.
• Check your email for password resets the attacker requested on other services. If they had your social login, they may have tried to pivot into your email, shopping or banking accounts.
• Review financial activity: If any payment method was connected to the account, check recent transactions and remove the payment method until you are sure the account is clean.
• Scan your devices for malware: If the compromise started with a malicious app or link you clicked, your device may still be infected. Update your operating system and run a reputable security scan.

Step 5: Lock It Down So It Never Happens Again

Recovery is only half the job. The same weakness that let the attacker in will let the next one in unless you close it:

• One unique password per account, stored in a password manager. Reused passwords are the single most common cause of account takeovers — a breach on one site hands attackers the key to all the others. Our Password Security Guide and Data Breach Recovery Guide explain the full routine.
• Authenticator-app 2FA on every account that offers it, especially email and social media. SMS codes are better than nothing, but they can be intercepted through SIM swapping — see our SIM Swapping Protection Guide.
• Login alerts on. Every platform can email or notify you on a new login. Keep those alerts on and act on them the same day.
• Think before you click. Most takeovers start with a phishing message — a fake login page, a "verify your account" link, or a too-good prize. If a message asks you to log in, open the app yourself instead of tapping the link. Our Phishing Protection Guide lists the red flags.
• Audit connected apps twice a year. Old quiz apps, games and tools keep access long after you forget them. If you do not use it, revoke it.

What If Money or Identity Was Stolen?

If the attacker used your account to take money, impersonate you, or steal personal information, the recovery steps above are not enough on their own:

• Report the account to the platform as compromised and the fraudulent posts as fraud — reports create a record that helps later.
• Contact your bank immediately if any payment was made, and ask about reversing it. Time matters: the sooner you report, the better the chances.
• Report the crime to your local cybercrime authority and keep the reference number. In many countries you can file online, and the report helps if the impersonation causes further problems.
• Tell anyone who sent money or information to the attacker so they can take their own protective steps.
• Watch for follow-up scams: Victims of one attack are often targeted again by "recovery" scammers promising to get money back for a fee. Real help never asks for payment upfront.

The Recovery Checklist

Print this or save it somewhere safe — it is much easier to follow a checklist than to think clearly during a real incident:

• Change the password from a trusted device (long, unique, never reused)
• Sign out of all sessions everywhere
• Fix the recovery email and phone number
• Turn on authenticator-app two-factor authentication
• Remove unknown connected apps and sessions
• Change your email password, then any password reused elsewhere
• Warn your contacts through a channel the attacker does not control
• Delete posts and messages you did not send
• Check settings, payments and connected services for changes
• Report the compromise to the platform and, if money was taken, to your bank and cybercrime authority

Losing an account feels personal, because it is: your photos, your conversations, your reputation. But accounts are recoverable, and the steps above work. Act fast, follow the order — lock, recover, warn, clean, protect — and the attacker ends up with nothing but a closed door.