Hacked email, WhatsApp or social media: what to do
A hacked account isn't just embarrassing. Your email holds password resets for everything else, your WhatsApp is used to scam your friends and family, and a hacked business inbox is how most invoice fraud starts. Here's how accounts get taken over, how to get them back, and how to keep them.
How accounts get taken over
- Reused passwords. A password leaked from one website is tried on your email, Facebook and Amazon. This is the number one cause.
- Phishing. "Your account will be suspended, log in here." The page is fake and your password goes straight to the criminal. See phishing.
- The code trick. "Hi, I sent you a code by mistake, can you forward it?" The message comes from a friend's already-hacked WhatsApp. The code is the one that registers your WhatsApp on the criminal's phone.
- Fake "verification" or "copyright" messages on Instagram and Facebook, and fake "Meta support" accounts.
- SIM swap. Criminals persuade your mobile network to move your number to their SIM, then receive your codes. A sudden loss of signal when everyone else has it is the sign.
Signs your account is compromised
- Friends receive messages from "you" asking for money or a code.
- Password reset or "new login" emails you didn't request.
- You're logged out and your password no longer works.
- Emails you never saw show up as read, or there's a forwarding rule or filter you didn't create.
- Posts, adverts or listings appear under your name, often selling tickets, puppies or crypto.
Getting it back, in order
Email first
Your email account resets everything else. Use the provider's account recovery page (typed in by hand), change the password, and check the recovery phone, recovery email, forwarding rules and "apps with access". Remove anything you don't recognise and sign out all other devices.
Then your bank
If the hacked account could be used to reach your bank, for example by receiving codes or password resets, tell your bank on 159, check recent payments and payees, and change your banking password.
Then WhatsApp and social media
WhatsApp: reinstall and re-register with your number; the criminal is logged out when your code arrives on your phone. Set up a two-step verification PIN straight away. Facebook, Instagram and others have "hacked account" recovery pages; use them rather than any "support" account that messages you.
Warn your contacts
Tell people by another channel not to send money or codes to messages from your account. Hacked accounts are used for "Hi Mum" style scams and fake sales.
Change passwords everywhere you reused that one
Start with shopping sites that store your card. Use a password manager so every account has its own long password.
Turn on two-step verification
On email, banking, social media, Apple or Google account, and your mobile network account. Use an authenticator app or a security key where offered rather than text codes.
Check for identity theft
If your inbox contained ID documents or bank statements, consider Cifas Protective Registration and check your credit report for applications you didn't make.
If you run a business
A hacked business mailbox lets criminals send your customers "new bank details" in your name. Change the password, remove forwarding rules, enable two-step verification for every mailbox, and tell customers by phone that you've been compromised and that your bank details have not changed. See invoice and bank detail scams.
Reporting
Report hacked accounts to Report Fraud (0300 123 2040) or Police Scotland on 101, especially if money was lost or your identity was used. Report the hacked profile to the platform so it can be locked. The National Cyber Security Centre has step-by-step recovery guidance for each major service. Bank Safe Online can't recover accounts or contact platforms on your behalf.
Last reviewed: October 2026