Someone took over my email, Facebook, or Instagram: what to do in the first hour

Account takeover rarely looks dramatic. It usually looks like this: your phone vibrates at two in the morning, a code arrives that you didn’t request. Or a friend writes: “Someone hacked you, you’re sending strange links.” Or simply, your password stops working.

The first hour is the most important. During this time, the attacker is usually just settling in: changing the recovery address, adding their phone number, setting up their own two-factor authentication. If you act quickly, recovering your account is possible. If you don’t, it becomes much harder.

This plan is organized by time, not by platform. You start from the top and go down. Separate instructions for Google, Microsoft, Facebook, Instagram, WhatsApp, and Apple accounts are in the guide Recovering a taken over account step by step, and future security measures (passwords, passkeys, protecting your number from SIM swap) are in the guide How to secure accounts after takeover.

How to check if your account has really been taken over

Not every strange event is a hack. Before you start putting out fires, check if there’s a fire.

Signs that usually indicate a takeover

• Your password stopped working, even though you definitely didn’t change it.
• The recovery email address or phone number associated with the account has changed.
• Friends are receiving messages from you that you didn’t send, or there are emails in the “Sent” folder that you don’t remember.
• Your inbox is suddenly empty or emails from the bank are missing.
• Two-factor authentication has appeared that you didn’t enable.
• You’ve disappeared as the administrator of your own Facebook page, or there are campaigns on your ad account that you didn’t start.

Signs that may or may not indicate a takeover

• Notification of “new login”: sometimes it’s your own phone after an update.
• Request for a code that you didn’t request. This usually means that someone knows your password and is trying to get further. The account is not yet taken over, but the password is no longer secure. Change it immediately and never share that code with anyone.
• Email “we detected suspicious login” with a link. Very often this is phishing. Do not click, just go to the service’s website by typing the address manually.

How to recognize unknown logins

Every major platform has a list of recent logins or active sessions. Look for three things at once: unknown country or city, unknown device model, and the time when you were definitely asleep. Location alone is not enough, as it can be inaccurate due to VPN or carrier network.

What to do immediately

Three decisions before you start clicking:

1. From what device am I acting? If you suspect malware, changing the password from infected equipment won’t help, as the new password will leak too.
2. Am I at risk of financial loss? If your email is linked to a bank, PayPal, Zelle, or BLIK, call the bank simultaneously, not after everything.
3. Do I have a way to log in? If the password still works, you are in a much better situation. Go to the section for someone who still has access to the account.

First 5 minutes

1. Disconnect the suspicious device from the internet if you suspect a virus: turn off Wi-Fi and mobile data. Do not format or delete anything, as it may be evidence.
2. Switch to a secure device: your partner's phone, a work computer, a tablet.
3. Change the password for your main email. Not for Facebook. For email. It resets everything else.
4. Secure the main email address: check immediately if the recovery address and phone number have not been changed.
5. Call the bank if there is any financial risk. Do not email, call. Ask to block cards and halt transfers.

Only Poland: call the number on the back of your payment card or from the official bank app. Do not call back the number from the SMS. Only USA: you can find the number on the back of the card or in the bank app. Ask for a “fraud alert on the account.”

First 15 minutes

1. Log out of all sessions. On Facebook and Instagram, the section is called “Where you’re logged in”, in Google it’s a list of devices in security settings. Logging out invalidates stolen cookies. Often this is the only way to kick out an attacker who doesn’t know your password but stole an active session.
2. Remove unknown devices from the account device list.
3. Check the phone numbers associated with the account. Remove any that you do not recognize.
4. Check recovery and backup addresses. Attackers often add their address here to be able to return after you change your password. Remove foreign entries.
5. Change passwords: first email, then financial accounts, then social media. Each one different. Save them in a password manager.
6. Enable or improve two-factor authentication. If the attacker managed to enable their own, remove their method and add yours. It’s best to use an authentication app or hardware key, not SMS.

Important order: first log out of all sessions, then change the password. The reverse order sometimes leaves the attacker with an active session.

First hour

1. Email filters. A favorite trick of the attacker: a filter that marks every email with the word “bank” as read and sends it to the trash so you don’t see alerts about transfers. Remove filters that you didn’t create.
2. Forwarding. Check if your email is quietly being copied to a foreign address. In Gmail, the tab is “Forwarding and POP/IMAP”, in Outlook.com Settings → Mail → Forwarding.
3. Mailbox rules. In Outlook.com: Settings → Mail → Rules. Remove rules that you do not recognize.
4. Delegation and remote access. In Gmail, check who has access to your inbox (mail delegation), enabled IMAP and POP, and automatic replies, as these can be used to spread scams.
5. Apps with access to the account. The attacker may have linked their own, and you probably have old ones that you forgot about. In Google account: myaccount.google.com/connections (the older address myaccount.google.com/permissions still works). Revoke access to anything you do not recognize.
6. Passkeys and security keys. If the attacker added their passkey, they will still have access even after you change your password. Remove foreign entries and add your own.
7. Login history. Review it and take screenshots. This is material for the bank and police.
8. Sent and deleted messages. See what and to whom was sent in your name. Take screenshots. Do not delete these messages, evidence comes first.
9. Warn your friends. A message template can be found below.
10. Check bank accounts and shopping platforms linked to this address: bank, Allegro, Amazon, eBay, PayPal, Apple, Google Play. Look for new delivery addresses and unknown orders.

First 24 hours

1. Scan devices with antivirus, update the system and browser. If you suspect an info stealer, consider restoring the system to factory settings. As long as the computer is infected, any password change is useless.
2. Change passwords for the most important accounts: bank, government account, work, second inbox, stores with saved cards.
3. Contact your phone operator and secure your number against transfer or issuing a duplicate SIM card. Details in the guide How to secure accounts after takeover.
4. Check cards and transactions for the last 30 days. Report any unknown, even minor ones: test payments of a few zlotys or dollars are a sign of something bigger.
5. Secure business pages and ad accounts: check the list of administrators, set spending limits, remove unknown payment methods.
6. Save evidence outside the taken over account: screenshots of login history, headers of suspicious emails, transaction numbers, dates, and times.
7. Report the incident. Where exactly, we describe below.

Next days

• Monitor accounts. For 2–4 weeks, check the login history and inbox daily. An email “someone requested a password reset” means the attacker is still trying.
• Review bank statements for the last three months, not just the last week.
• Check your credit report if your personal data has leaked. Only USA: you can freeze your report with Experian, Equifax, and TransUnion. It’s free and effective. We have a separate guide on freezing credit reports. Only Poland: consider blocking your PESEL number on gov.pl or in the mObywatel app, the service is free. Details in the guide How to block your PESEL number step by step.
• Inform clients or your employer if the account was business-related. A message template can be found below.
• Assess legal obligations. Only Poland: the obligation to report a breach to UODO within 72 hours applies to the data controller, i.e., the entrepreneur or institution processing other people's data. A private individual whose private email or Instagram was hacked is not a controller and has no such obligation. However, if you run a business and your clients' data has leaked, you may be subject to this obligation. Reporting is only electronic, via the form on biznes.gov.pl.

Instructions for someone who still has access to the account

You have the advantage. Act in this order and do not skip points.

1. Log out of all sessions and devices.
2. Change the password to a long and unique one.
3. Check and clean: recovery address, phone number, two-factor login methods, passkeys.
4. Check and clean: filters, forwarding, rules, delegations, IMAP/POP, automatic replies.
5. Revoke access from unknown apps.
6. Enable strong MFA (app or key), write down backup codes on paper.
7. Download a copy of important data: photos, contacts, invoices. If you lose the account later, you will still have it.
8. Take screenshots of the login history before it disappears.

Instructions for someone who has completely lost access

Do not panic and do not create a new account at first instinct. A new account with the same name will not recover the old one, and it can complicate verification.

1. Use the device and network from which you usually logged in. Platforms recognize known hardware and browser, which increases your chances. Facebook advises this directly.
2. Follow the official recovery procedure of the given platform (instructions in the guide Recovering a taken over account step by step). Do not use “help” from ads, Facebook groups, or paid “account recovery hackers.” This is almost always another scam.
3. Provide true information. Forms compare what you enter with what the system knows about the account. Guessing lowers your chances.
4. Warn your surroundings immediately, without waiting to recover.
5. Disconnect the account from the rest of your life: change your email address at the bank, in stores, at work, with your operator. Unregister the taken over account as a login method wherever possible.
6. Report impersonation if the scammer is using your photos and name.
7. Be patient. Some procedures take days, some weeks. No platform guarantees account recovery.

Account recovery on a specific platform

Instructions for Google and Gmail, Microsoft and Outlook, Facebook, Instagram, WhatsApp, and Apple accounts, with links to official recovery pages and a table of settings to check, are in a separate guide: Recovering a taken over account step by step.

Table: symptom, possible cause, action

When damage has already been done

Scammer asked friends for money

Warn everyone immediately, through a channel other than the taken over account. If someone has already transferred money, they should call their bank right away; the sooner, the greater the chance of stopping the transfer. They should keep screenshots of the conversation and transfer confirmation. It is the victims who file a report about their loss; you report the account takeover and impersonation.

Scammer bought ads at your expense

Remove payment methods from the ad account and set a spending limit. Report the case to Meta support and simultaneously to the bank or card issuer, as unauthorized transactions can be disputed. Take screenshots of the campaigns, dates, and amounts before you delete anything.

Scammer removed you as the administrator of the page

Meta advises first checking if another real administrator didn’t remove you; if so, a request to be re-added is enough. If it’s a takeover, submit the page recovery form from the help article. Meta states that it will only take action after confirming the takeover, and that Meta Verified is not a faster route.

Message templates

Message template for friends

Hi, someone took over my account [Facebook / email / Instagram]. If you receive a message from me asking for money, an SMS code, BLIK, or a link – it’s not me. Do not click and do not reply. I’m writing from another number/account. I will reach out when I regain access. If you have already clicked on the link or transferred money, call your bank immediately.

Message template for clients

Dear Sir/Madam,

We inform you that on [date] there was unauthorized access to our account [email / Facebook / Instagram]. We have taken security measures and are regaining full control over the account.

Please be cautious of messages received from this account between [date] and [date]. In particular, please do not make transfers to account numbers provided in these messages without prior confirmation by phone at our regular number: [number].

Our billing details have not changed. If you received a message about a change of account number, please contact us immediately.

We apologize for the inconvenience. [Name, company, phone]

Short Facebook announcement template

Attention: someone took over my account. Messages asking for money, codes, or BLIK sent from [date], do not come from me. Do not click on links, do not transfer money. Report fake messages and share this further. Thank you.

If the account cannot be recovered

It must be said honestly: some accounts do not return, especially those that did not have an updated phone number or a second email address. What to do then:

1. Disconnect the old account from your life. Change your email address at the bank, with your operator, in offices, at work, in stores.
2. Create a new account and from day one set up MFA and current recovery data.
3. Report impersonation if the scammer continues to use your identity. Meta forms also work without logging in.
4. Publicly warn your surroundings in groups where you were active.
5. Be cautious of “account recovery” offers. Paid account recovery offers in comments are almost always a second wave of scams.

Securing accounts for the future

How to change your password, what a passkey is, why SMS is the weakest second factor, and how to block your number from SIM swap in Poland and the USA are described in the guide How to secure accounts after takeover: MFA, passkey, and protection against SIM swap. It also includes the most common mistakes and myths.

Where to Report Fraud or an Incident

Always, Regardless of Country

• To the platform: use the official recovery form and, if necessary, report impersonation.
• To the bank: if there has been or could be a financial loss. Bank first, then the rest.

Only Poland

• CERT Poland: report an incident via the form incydent.cert.pl or by email at cert@cert.pl. CERT also maintains a Warning List of dangerous domains.
• Number 8080: send a suspicious SMS "forward" or "share" to number 8080. This channel is for SMS only; emails and websites should be reported via the form or email. Limit: 3 messages every 4 hours from one number.
• Police: you can file a report in person at any Police station or prosecutor's office; you can also send a written report by email, fax, or mail to the appropriate unit. There is no national online form for reports: gov.pl provides a template for the report, and CBZC reminds that any Police unit will accept the report.
• UODO: only if you are a data administrator (company, institution) and the data of other people has leaked. Only electronically, via the form on biznes.gov.pl, within 72 hours of detecting the breach.
• PESEL Reservation: if your personal data has leaked.

Only USA

• FTC: general fraud report: reportfraud.ftc.gov. If someone has used your identity: identitytheft.gov, where according to the FTC you will receive a personalized recovery plan.
• FBI IC3: ic3.gov, report via complaint.ic3.gov. This is the main point for reporting cybercrimes; the form accepts addresses from outside the USA, including Poland. IC3 notes that it does not respond individually to each report and warns that it never contacts victims on its own initiative regarding money or data.
• Local police: it is advisable to file a report in case of financial loss; the case number may be needed at the bank.
• Mobile operator: enable the blocks described in the guide How to Secure Accounts After Takeover.
• Credit bureaus: consider freezing your credit report.

How to Check if Your Email Has Leaked

• haveibeenpwned.com: an independent, widely used service that checks if your address has appeared in known leaks. Honestly: this is a private tool, not a government one, and shows only leaks that it is aware of, so a lack of results does not mean nothing has leaked. You only enter your email address, never a password.
• moje.cert.pl: a service from NASK and CERT Poland, among other things, for checking leaks. Only Poland.
• Built-in password checking in Google, Apple, or browser password managers will alert you if any of your saved passwords have appeared in a leak.

Key Principles

1. Email first. Always secure your email account before social media.
2. Secure device. Changing your password from infected hardware is worthless.
3. Log out sessions, then change the password. In that order.
4. Check what the attacker added, not just what they changed: recovery address, number, MFA, passkey, filters, applications.
5. Do not delete evidence. First take screenshots, then clean up.
6. Never give out the code. To anyone, ever, under any pretext.
7. Each account has its own long password in the password manager.
8. MFA is stronger than SMS, wherever possible.
9. Warn people immediately, do not wait for account recovery.
10. Do not pay anyone to recover your account.

First Hour Checklist

• I disconnected the suspicious device from the internet
• I am acting from a secure device
• I changed the password for my main email account
• I called the bank if there was a financial risk
• I logged out of all sessions and devices
• I removed unknown devices from the list
• I checked the phone numbers associated with the account
• I checked recovery and backup addresses
• I changed passwords for the most important accounts
• I enabled or improved MFA
• I checked email filters
• I checked email forwarding
• I checked mailbox rules and delegations
• I revoked access from unknown applications
• I checked the list of passkeys and security keys
• I reviewed the login history and took screenshots
• I checked the Sent and Trash folders
• I warned my friends
• I checked bank accounts and shopping platforms

First 24 Hours Checklist

• I scanned all devices with antivirus
• I updated the system and browser
• I changed passwords for other important accounts
• I contacted the phone operator
• I enabled number blocking (USA) or reserved PESEL (Poland)
• I checked card transactions from the last 30 days
• I checked company websites and administrator roles
• I checked the advertising account and payment methods
• I saved evidence outside the compromised account
• I reported the incident (CERT / FTC / IC3 / police)
• I saved new passwords in the password manager
• I wrote down MFA backup codes on paper

Frequently Asked Questions

Will I definitely recover my account?

There is no guarantee, and no honest person will give you one. The chances increase when you act quickly, from a device and network you usually use, and when the account had an up-to-date phone number and recovery address.

I changed my password, but the scammer is still messaging from my account. How is that possible?

They likely have an active session (stolen cookies) or an application with access. Log out of all sessions and revoke access from applications.

I received an SMS code that I didn't request. Am I hacked?

Not necessarily yet, but someone knows your password. Change it immediately and do not give anyone the code.

Should I create a new account?

First, exhaust the recovery procedure. A new account with the same name will not recover the old one.

Should I report to the police if I haven't lost anything financially?

You can. Filing a report organizes the matter, and the case number is useful if the scammer later tries to defraud something in your name. Only Poland: you file a report at any Police unit. Only USA: report to IC3 and, in case of identity theft, to IdentityTheft.gov.

Is it worth paying for account recovery?

No. People offering this in comments or private messages are almost always additional scammers.

I have a business and my business email has been compromised. Do I need to report to UODO?

Only Poland: if you are a personal data administrator and the data of other people has leaked, you likely do need to, within 72 hours of detecting the breach, via the electronic form. If the matter is serious, consult with a lawyer or data protection officer. This obligation does not apply to private individuals.

Sources

As of October 24, 2026. This guide is for informational purposes only and does not constitute legal or financial advice. Account recovery procedures, setting names, and help page addresses change frequently, especially in Meta, Google, and Microsoft services, so check the provider's current help page before taking action. No platform guarantees account recovery or refund. For legal obligations (e.g., reports to UODO) and financial losses, consult a lawyer, bank, or appropriate authority.