What to do when a social media or email account is hijacked

Why the email account comes first

Most people start with the profile they can see, such as Instagram or Facebook. That is understandable, but it is the wrong order. Your email account is the master key to your online life. Password resets, login alerts, two-factor backup codes and "was this you?" warnings all go to it. If an attacker still controls your email, any password you change elsewhere can be reset again within minutes.

Secure the email account first, from a device you trust. Change the password, sign out of all other sessions, and then check three settings that attackers quietly change:

• Recovery options: a backup phone number or secondary email address the attacker added so they can reset the password later.
• Forwarding and filters: rules that copy your mail to an outside address or send security alerts straight to the trash.
• Connected apps: third-party services granted access to read or send mail on your behalf.

Only when the email account is clean should you move on to the social profiles. The same principle applies to a Google account, which also controls Gmail, YouTube and often an Android phone: one takeover can expose all three.

How accounts are hijacked

Account takeover (when someone else gains control of an existing account and locks out the owner) rarely involves sophisticated hacking. The common paths are ordinary:

• Phishing: a fake login page, often sent as a copyright warning, a verification badge offer or a message from a friend.
• Password reuse: credentials leaked in one breach and tried on other sites, a technique called credential stuffing.
• Code theft: a message asking you to read back a verification code "sent by mistake."
• Malicious apps: quiz, analytics or follower tools granted permission to act on the account.
• SIM swaps: taking over your phone number to receive text-message codes, covered in our SIM swap guide.

The scale is significant. Social media accounts made up 19% of existing accounts taken over in 2024 to 2025 (down from 25%), and reports involving personal tech accounts such as Apple and Google rose 754%, according to the Identity Theft Resource Center, 2025 Trends in Identity Report. That sample is victims who contacted ITRC, not a representative survey, but it shows attackers moving toward the accounts that unlock everything else.

A national survey points the same way. In UK incidents of unauthorized access to personal information, offenders got in through a social media or messaging app in 26.3% of cases and through an email account in 16.2% (year ending March 2025; unweighted base 335), according to the UK Office for National Statistics, Nature of Crime: Fraud and Computer Misuse, Table 4. Those are UK data, but the pattern is familiar to anyone who has handled a hijacked account in the United States.

Using each platform's official recovery flow

Every major platform has its own recovery process, and the official process is the only one that works. Start it from the app itself or from the platform's own help center, never from a link in a message. Recovery usually asks you to confirm an old password, a previous email address or phone number, or a code sent to a contact method you still control. Some platforms ask for a video selfie or photo identification.

Meta: Facebook and Instagram

Meta publishes a hacked-account flow at facebook.com/hacked, and Instagram offers a "need more help" path from its login screen. Look for a security email from Meta about a changed address; it often contains a link to reverse the change.

Google: Gmail and YouTube

Google's account recovery process, reachable from the sign-in page and the Google Help Center, covers Gmail, YouTube and other Google services together. Recover the Google account and you recover the YouTube channel tied to it.

X, TikTok and LinkedIn

X, TikTok and LinkedIn each provide a password reset from the login screen and a form for hacked or compromised accounts in the platform's official help center. When an attacker has changed the email and phone number, the help-center form is usually the only route back. Answer every field accurately and keep the case or ticket number.

Recovery can take days. Submit once, respond promptly to follow-up emails, and avoid filing many duplicate requests, which can slow review.

Recovery scams target people who just lost an account

Within hours of posting "I've been hacked," many victims receive messages from strangers who claim they can restore the account. They describe themselves as ethical hackers, platform insiders or recovery specialists. Some reply under your post; others send a direct message or email. Their pitch is the same: pay a fee, often in cryptocurrency or gift cards, and the account comes back.

It does not come back. These are recovery scams, a second fraud aimed at people already under stress. Some operators ask for your remaining passwords or verification codes and use them to take more accounts. Keep three rules in mind:

• Platforms do not charge to restore an account.
• Platform staff do not reach out by direct message to offer recovery.
• No genuine helper needs your password or login codes.

If you have already paid one of these operators, stop contact, keep the messages and payment records, and report the loss to the FBI Internet Crime Complaint Center.

Locking the account down after you get back in

Regaining access is only half the job. Until you close the attacker's remaining doors, the account can be taken again.

• End every session. The security settings list logged-in devices; sign them all out.
• Revoke app access. Remove third-party apps and "log in with" connections you do not recognize.
• Replace the password. Use a unique password generated by a password manager.
• Upgrade authentication. Turn on multi-factor authentication (MFA, a second proof of identity beyond the password).

The type of MFA matters. Text-message codes are better than nothing, but they depend on your phone number, and a phone number can be transferred to an attacker's device. An authenticator app such as Google Authenticator, Microsoft Authenticator or Authy generates codes on your own device. A passkey (a sign-in credential stored on your phone or computer and unlocked with your fingerprint, face or device PIN) goes further, because there is no code to phish. Where a platform supports passkeys or hardware security keys, use them, and save the backup codes offline.

Business pages, ad accounts and multiple admins

A hijacked business page is a business problem, not only a personal one. Attackers who take a Facebook page or Instagram business profile often run ads on the attached ad account, message customers, or remove the real owners as admins.

The best defense is redundancy. Every business page should have at least two trusted admins, each with MFA turned on, so that one lost login does not mean a lost page. After an incident, review every role, including admins, editors, advertisers and partner agencies, and remove anyone you do not recognize. Check the payment methods on linked ad accounts and dispute any unauthorized ad spend with your card issuer. Keep a written record of who holds which role, and review it whenever an employee or agency leaves.

Warning contacts and reporting impersonation

Attackers use a hijacked account to reach the people who trust you. Typical messages ask for an emergency loan, a gift card, a cryptocurrency investment, or a login code "sent to the wrong number." Warn contacts through a separate channel, such as a text, a phone call or a post from another account, and tell them to ignore any request made during the takeover.

Sometimes the attacker also creates a copycat profile using your name and photos. Report it through the platform's impersonation process, available from the fake profile's menu or the official help center, and ask friends to report it too. If you remain locked out, the impersonation route can sometimes lead to removal of the hijacked account even before you recover it.

When money is lost, and how to report the account

If the takeover led to a financial loss, report it. The FBI counted approximately 4,700 account takeover complaints in 2025 with $359.7 million in losses, largely tied to scammers impersonating bank support staff, according to the FBI IC3 2025 Internet Crime Report. That category covers financial accounts, not social media, but it shows how often a hijacked login ends in stolen money. File a complaint with the FBI Internet Crime Complaint Center, contact your bank or card issuer, and keep every confirmation number. If personal information was used to open new accounts, follow our identity theft guide.

Confirmed Stolen accepts reports of hijacked social media accounts for verification at our report page. We verify and document cases so the record is public and searchable. We are not law enforcement and not a recovery service, and we do not restore accounts. For broader context, see the theft statistics hub.

When the hijacked account is a cryptocurrency exchange or wallet, speed and records matter even more; the stolen cryptocurrency checklist covers securing what remains, recording transaction hashes and reporting to IC3.