Account Hacked: What to Do Immediately and How to Recover Your Account

Introduction

If your account has been hacked, act quickly but do not panic. First secure the email account that controls password resets, then use the service’s official app or website to change the password, end unknown sessions and restore your recovery details. If money or payment information is involved, contact your bank immediately and report the transaction through the appropriate official channel.

A compromised account can show several signs: an unfamiliar login alert, a changed password, messages you did not send, a new recovery phone number or activity from an unknown device. Sometimes the only warning is a friend asking why you sent a strange message. The goal is to stop further access, preserve evidence and recover control without giving another person your password, OTP, UPI PIN or recovery code.

This guide explains what to do for email, social media, WhatsApp, banking and UPI accounts in India. It also covers device checks, reporting and common recovery scams. For broader safety advice, see the CYBERoinfo guide to [cyber crime in India](/articles/cyber-crime-in-india-types-laws-prevention).


**Key Takeaways**

- Secure your email first because it may control password resets for other accounts.

- Use only the service’s official app or website; never send a password, OTP, UPI PIN or recovery code to someone offering help.

- Change the password, sign out unknown devices, check recovery details and enable two-factor authentication.

- For unauthorised banking or UPI activity, contact the bank or payment provider immediately and preserve transaction evidence.

- Be cautious of “recovery experts” who promise guaranteed access or demand an upfront fee.

Signs Your Account Has Been Hacked

### Unknown Login Alerts

An alert about a login from an unfamiliar location, browser or device can indicate that someone has your password or an active session. Check the time, approximate location and device shown in the alert. Location estimates can be imperfect, especially on mobile networks, but an unfamiliar device or a login that happened while you were asleep deserves attention.

### Password or Recovery Details Changed

A password that suddenly stops working is a serious warning, especially if you did not change it. Also check whether the recovery email, phone number, security questions, passkeys or two-factor authentication method has changed. An attacker may alter these details to prevent you from taking the account back.

### Unknown Messages or Transactions

Look for emails, social posts, direct messages, WhatsApp chats, password-reset requests or payments you did not initiate. A hacked account may be used to ask your contacts for money, send malicious links or change a business page. In a banking app, an unfamiliar beneficiary, transfer, card payment or UPI collect request should be treated as urgent.

### Unrecognized Devices and Sessions

Most major services provide a list of active sessions, devices or connected applications. An unfamiliar phone, browser, location or third-party app can reveal how access is being maintained. Review the list from a clean, trusted device and remove sessions you do not recognise.

What to Do Immediately If Your Account Is Hacked

### Secure Your Email Account First

Start with the email account used for password resets. From a device you trust, change its password to a new, unique password and review forwarding rules, filters, delegated access, recovery details and logged-in devices. Remove any forwarding address or app access you did not add. If your email account is locked, begin its provider recovery process before trying to reset other accounts.

### Change Your Password Using the Official Website

Use the account’s official app or website, not a search advertisement, social-media message or link sent by a supposed support agent. Choose a long, unique password that has not been used anywhere else. A password manager can create and store one safely.

### Sign Out of Unknown Devices

Open the account’s security or session settings and sign out of every device you do not recognise. When available, use the option to sign out of all sessions, then sign in again only on devices you trust. Remove unknown browser extensions, connected apps, API access or app passwords.

### Enable Two-Factor Authentication

Turn on two-factor authentication after changing the password and removing unknown sessions. An authenticator app or security key can provide stronger protection than text messages, although any supported second factor is generally better than a password alone. Store backup codes offline in a secure place and never send them to a caller.

### Check Recovery Email and Phone Number

Confirm that the recovery email address and phone number belong to you. Check for a new number, unfamiliar email, changed name or altered profile details. Update them only after securing the account, and verify each change using the service’s normal process.

How to Recover a Hacked Email Account

### Google Account Recovery

For a Google account, start with the provider’s account recovery option from a device and location you commonly use. Provide accurate information about a previous password, recovery email or phone number when asked. If you regain access, change the password, review signed-in devices, remove unfamiliar third-party access, check mail forwarding and filters, and enable two-factor authentication.

### Microsoft Account Recovery

For a Microsoft account, use the official sign-in recovery flow and complete the verification form as accurately as possible. After access is restored, review recent activity, connected devices, aliases, forwarding rules, app permissions and security methods. Change the password and turn on two-step verification.

### Other Email Provider Recovery Options

For another provider, look for “forgot password,” “account recovery” or “account compromised” inside the provider’s known app or website. Check the provider’s help centre through the app, a saved bookmark or an address you already know. Avoid paid services claiming they can access the provider’s internal systems.

How to Recover a Hacked Social Media Account

### Instagram Account Recovery

If Instagram access is lost, use the app’s built-in hacked-account or login-help route and follow the identity checks offered there. If you still have access, change the password, sign out unfamiliar sessions, remove unknown linked accounts and check the email and phone number on the profile. Review direct messages and posts for scams, then warn followers through a trusted channel.

### Facebook Account Recovery

For Facebook, use the account recovery and compromised-account options available from the known app or website. After regaining access, inspect recent logins, active sessions, contact details, connected apps, page roles and advertising or payment settings. Remove unfamiliar administrators and review posts, messages and marketplace activity.

### WhatsApp Account Recovery

If someone registers your WhatsApp number on another phone, open WhatsApp on your phone and request a new verification code. Enter the code only in the official app. Completing registration generally logs the other device out. If you cannot receive codes or your number has been taken over, contact your mobile operator through its known customer-care channel and WhatsApp support through the app or known help route.

Tell contacts that recent requests for money or codes were not from you. After recovery, inspect linked devices, remove anything unfamiliar and enable two-step verification with a PIN and a secure recovery email. Never share the WhatsApp registration code or two-step PIN.

What to Do If Your Bank or UPI Account Is Compromised

### Contact Your Bank Immediately

If there is an unknown payment, transfer, card transaction, beneficiary or UPI activity, call the bank using the number printed on your card or shown inside the bank’s known app. Ask the bank to secure the account, review access and place appropriate holds or blocks. If your phone number or SIM may be affected, contact your mobile operator as well.

Give the bank a clear timeline: when you noticed the activity, amount, transaction ID, recipient details and any message or call connected to it. Do not wait for the person who contacted you to “reverse” the payment.

### Block or Secure Affected Payment Methods

Temporarily block a card, reset online-banking access, disable a compromised UPI handle or change the banking password through the official channel. Ask the bank what action is appropriate rather than sharing your PIN with support staff. Never install remote-access software because a caller says it is required to secure your account.

If your device is lost or suspected to be infected, use a clean device and ask the bank to secure mobile and online access. Preserve the original phone if it may contain evidence, but prioritise stopping additional loss.

### Report Unauthorized Transactions

Report unauthorised transactions to the bank and the relevant payment provider as soon as possible. In India, financial cyber-fraud victims can also use the national cyber-fraud reporting route and the 1930 financial cyber-fraud helpline, where applicable. Keep the complaint or acknowledgement number.

Save bank statements, screenshots, SMS alerts, UPI references, phone numbers, email headers and chat exports. Do not alter screenshots or invent details. Reporting does not guarantee a refund, but prompt, factual reporting gives the bank and investigators a better chance to trace and contain the activity.

How to Check Your Phone and Computer for Security Risks

Update the operating system, browser, apps and security tools. Remove applications, browser extensions and remote-access tools that you do not recognise. Check whether the device is rooted or has unusual administrator permissions. Review battery, data and accessibility settings for unfamiliar apps, but do not delete possible evidence before recording what you found.

Run a trusted security scan and change important passwords from a clean device if malware is suspected. Check your email and messaging accounts again after the device is secured. If the compromise continues, disconnect the device from networks where practical and seek qualified technical help. Do not download “hacking removal” software from an unsolicited message.

How to Report Account Hacking in India

Preserve evidence first: screenshots, dates, account names, profile addresses, device alerts, transaction IDs, phone numbers, emails and a short timeline. Contact the affected platform and bank through their official in-app or known support process. For financial loss, report promptly through the national cyber-fraud reporting route and the 1930 helpline, where applicable.

For threats, blackmail, stalking, identity misuse or an immediate safety concern, contact local cyber police or the nearest police station. Use factual language and keep complaint reference numbers. Do not publicly accuse a person based only on an account name, and do not confront a suspected attacker.

How to Prevent Future Account Hacks

Use a different long password for every important service and store it in a reputable password manager. Enable two-factor authentication, keep recovery details current and review active sessions every few months. Install updates promptly, limit unnecessary app permissions and avoid cracked software.

Treat unexpected urgency as a reason to pause. Verify payment, password-reset and account-suspension requests through a separate channel. Never share OTPs, UPI PINs, card PINs, passwords or backup codes. Keep secure backups of important files and teach family members that genuine support should not demand secrets.

Common Account Recovery Scams to Avoid

Recovery scammers often contact victims soon after a hack. They may pretend to be platform staff, police, bank employees or cybersecurity experts and promise guaranteed recovery. Warning signs include a request for your password, OTP, recovery code, screen sharing, remote access, cryptocurrency, gift cards or an upfront “release fee.”

Use only the service’s official recovery process. A helpful person can guide you to the correct support page without taking control of your account. If someone already received a code or payment, end contact, secure the account through a clean device and preserve the messages for reporting.

Frequently Asked Questions

### What should I do first if my account is hacked?

Secure your email account first, if you can, because it may control password resets. Then change the affected account’s password through its official app or website, sign out unknown devices, check recovery details and enable two-factor authentication. Contact your bank immediately if money or payment information is involved.

### Can I recover a hacked account?

Often, yes, especially when you still control the recovery email or phone number. Use the provider’s official recovery process and provide accurate information. Recovery is not guaranteed, but quick action, saved evidence and a clean device improve your chances.

### What should I do if a hacker changes my password?

Use the official “forgot password” or compromised-account flow from a familiar device. Check your email for a genuine security notification, but open the provider directly rather than clicking an unexpected link. If recovery details were also changed, complete the provider’s identity verification and do not pay someone who promises a bypass.

### How do I secure my account after recovery?

Change the password to a unique one, sign out all unfamiliar sessions, remove unknown apps and forwarding rules, confirm recovery details, enable two-factor authentication and review recent activity. Scan the phone or computer and update it before using the account normally.

### Where can I report account hacking in India?

For financial cyber fraud, contact your bank immediately and use India’s national cyber-fraud reporting route or the 1930 helpline, where applicable. For threats, stalking, blackmail or other account misuse, contact local cyber police or the nearest police station. Preserve evidence and save every acknowledgement number.

Conclusion

When an account is hacked, the safest order is to contain access, recover control, protect connected accounts and report any financial or personal harm. Start with email, use only official recovery routes, change passwords from a clean device, remove unknown sessions and enable two-factor authentication. For banking or UPI activity, contact the bank without delay and preserve transaction evidence.

Do not share secrets with a caller or pay a stranger for guaranteed recovery. A calm timeline, accurate reporting and stronger recovery settings can limit damage and make the next account takeover less likely. For related prevention guidance, continue with CYBERoinfo’s [cyber crime in India guide](/articles/cyber-crime-in-india-types-laws-prevention).

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. cisa.gov — CISA phishing guidance
2. support.google.com — Google Account recovery guidance
3. support.microsoft.com — Microsoft compromised account guidance
4. pages.nist.gov — NIST Digital Identity Guidelines