In short: start with your email account, as it is the key to the other accounts. Act from the device and network you usually log in from, and only use the official recovery pages provided below. If you just discovered the takeover, first follow the plan What to do in the first hour.
Each platform has its own procedure for recovering a compromised account. Below are the official starting points and key settings for Google, Microsoft, Facebook, Instagram, WhatsApp, and Apple accounts, followed by a checklist of settings to verify after regaining access.
Recovering Google and Gmail Account
Official Google guide: Secure a hacked or compromised Google Account.
- Access recovery: accounts.google.com/signin/recovery. Answer questions from the device you usually log in from.
- After recovery: go to Security Checkup: the wizard guides you through devices, security events, passwords, and apps with access.
- Devices: myaccount.google.com/device-activity.
- Third-party apps: myaccount.google.com/connections.
- Gmail: forwarding (“Forwarding and POP/IMAP”), filters, labels, mailbox delegation, auto-reply.
- Passkeys: g.co/passkeys.
- If you are particularly at risk (journalist, activist, public figure, owner of a large ad account), consider the Advanced Protection Program, Google's strictest mode. It requires a passkey or hardware key and intentionally complicates account recovery, so do not enable it hastily.
Recovering Microsoft and Outlook Account
Official guide: How to recover a hacked or compromised Microsoft account. Microsoft outlines three steps: remove viruses from your computer, change or reset your password, check your account settings, especially connected accounts, mail forwarding, and automatic replies.
- Recent activity: account.live.com/activity: logins from the last 30 days; entries in the “Unusual activity” section have “This was me” and “This wasn’t me” buttons.
- Security and devices: account.microsoft.com/security → “Manage how I sign in” and account.microsoft.com/devices.
- Outlook.com: Settings → Mail → Forwarding and Settings → Mail → Rules.
- Recovery form if nothing else works: account.live.com/acsr. Fill it out from the device and network you usually use.
- Important change: Microsoft has announced the phasing out of SMS as a method for logging in and recovering personal accounts. Switch to Microsoft Authenticator or passkey.
Recovering Facebook Account
- Starting point: facebook.com/hacked, the recovery wizard. Start from the device you usually use. If you don't even remember your login: facebook.com/login/identify.
- Common point for Facebook, Instagram, and Threads: meta.com/account-recovery-support.
- Active sessions: section “Where you’re logged in” in security settings (currently in the Account Center). Official article: unfamiliar locations in “Where you’re logged in”.
- Hacked business page: Recover a hacked Facebook Page you manage. Meta states that the fastest way is the page recovery form, even for Meta Verified users, and that action will only be taken after confirming the takeover.
- Report impersonation: form for reporting a fake profile, also works without logging in.
- Note: the “trusted contacts” feature mentioned in older guides is no longer present in Meta's current documentation. Do not base your recovery plan on it. Set up an authenticator app, backup codes, or passkey.
Recovering Instagram Account
- Starting point: instagram.com/hacked.
- Official guide: How to fix and secure hacked Instagram accounts.
- Video selfie verification: Instagram still uses this. According to Meta's help, it will ask for a short video where you turn your head in different directions to confirm you are a real person. The video is not published and disappears within 30 days.
- Login history: View your recent Instagram login activity. In the app: Settings → Account Center → Password and Security → “Where you’re logged in”; in the older interface Settings → “Login Activity”.
- Instagram security emails come from
security@mail.instagram.com. Any other sender is phishing. - Report impersonation: form for Instagram and Threads. Requires an ID document; Meta states it will be removed within 30 days.
Recovering WhatsApp Account
Official guide: How to recover a compromised account.
The mechanism is simple and effective: whoever last registers the number has the account. Log back into your number and enter the six-digit code from the SMS. WhatsApp states that upon re-registration, all other devices logged into that account are automatically logged out. Three important things:
- If the attacker enabled two-step verification, WhatsApp will ask for a PIN that you do not know. According to the official help, you must wait 7 days and try again. This is a security measure, not a malfunction.
- Do not report your own account as violating rules while trying to recover it. WhatsApp warns that such a report may result in a ban.
- Check “Linked Devices” and log out of anything you do not recognize. Enable two-step verification and set your own PIN.
If you lost your phone: block the SIM card with your operator and order a duplicate for the same number. WhatsApp states that without a SIM card with the same number, account recovery is not possible.
Recovering Apple Account
Official guide: If you think your Apple Account has been compromised. Apple now uses the term Apple Account (formerly Apple ID).
- Change your password to a strong and unique one.
- On account.apple.com, correct personal information and security settings you do not recognize, and in the Devices section, remove unknown devices.
- Check with your operator if SMS forwarding has been set up. Almost no one remembers this, and Apple mentions this step explicitly.
- Enable two-factor authentication. Consider Security Keys and, on iPhone, Stolen Device Protection.
- If you cannot reset your password: iforgot.apple.com initiates account recovery. Apple warns that the process may take several days or longer, and if someone uses the account during this time, the procedure will be automatically canceled, so it advises disabling all logged-in devices during this time.
Settings Checklist
| Platform | Setting | What to look for |
|---|---|---|
| Security events, device list | Logins from an unknown country, foreign devices | |
| Recovery number and address | Foreign number or email address | |
| App connections | Apps you did not install | |
| Gmail | Forwarding and POP/IMAP | Forwarding to a foreign address, enabled IMAP/POP |
| Gmail | Filters, labels, mailbox delegation | Rules hiding emails from the bank, foreign persons with access |
| Microsoft | Recent activity | Entries in the “Unusual activity” section |
| Microsoft | Manage how I sign in | Foreign number, email, or passkey |
| Outlook.com | Settings → Mail → Forwarding and Rules | Forwarding and rules you did not create |
| Where you’re logged in | Unknown sessions and locations | |
| MFA settings | Login methods you did not add | |
| Page roles, ad account | Changes among administrators, new campaigns and payments | |
| Where you’re logged in, Account Center | Unknown devices, foreign account in the Center | |
| Linked Devices, two-step verification | Foreign browser, PIN you did not set | |
| Apple | Devices, trusted phone numbers | Unknown devices and foreign numbers |
| Operator | Duplicate SIM / eSIM / number transfer | Requests you did not make |
What Next
Once you recover your account, secure it to prevent a recurrence: How to secure accounts after a takeover: MFA, passkey, and protecting your number from SIM swap. If the scammer asked your friends for money or the account cannot be recovered, return to the plan What to do in the first hour: it contains message templates and information on where to report the incident in Poland and the USA.
Frequently Asked Questions
Someone took over my WhatsApp and enabled a PIN. What now?
According to WhatsApp's official help, you need to wait 7 days and re-register your number. This is an intentional security measure, not a malfunction.
Instagram is asking for a face recording. Is it safe?
According to Meta's help, this is a verification that you are a real person: a short recording where you turn your head in different directions. The recording is not published and disappears within 30 days.
How can I tell if an email from Instagram is genuine?
Instagram security emails come from the address security@mail.instagram.com. Treat any message from another address as phishing.
How long does Apple account recovery take?
Apple warns that the account recovery process may take several days or longer. If someone uses the account during this time, the procedure will be automatically canceled, so Apple advises disabling all logged-in devices during this time.
Sources
| Source | Type | Status / credibility |
|---|---|---|
| Google: “Secure a hacked or compromised Google Account” | Provider documentation | Official for this service |
| Google: account recovery page | Provider documentation | Official for this service |
| Google: Security Checkup | Provider documentation | Official for this service |
| Google: Advanced Protection Program | Provider documentation | Official for this service |
| Microsoft: “How to recover a hacked or compromised Microsoft account” | Provider documentation | Official for this service |
| Microsoft: “What is the Recent activity page?” | Provider documentation | Official for this service |
| Microsoft: account recovery form | Provider documentation | Official for this service |
| Meta / Facebook: recovery wizard for hacked accounts | Provider documentation | Official for this service |
| Meta / Facebook: “Recover a hacked Facebook Page you manage” | Provider documentation | Official for this service |
| Meta / Facebook: “Unfamiliar locations in the ’Where you’re logged in’ section” | Provider documentation | Official for this service |
| Meta / Facebook: impersonation reporting form | Provider documentation | Official for this service |
| Meta: Account Recovery & Support Hub | Provider documentation | Official for this service |
| Instagram: “How to fix and secure hacked Instagram accounts” | Provider documentation | Official for this service |
| Instagram: tool for hacked accounts | Provider documentation | Official for this service |
| Instagram: “View your recent Instagram login activity” | Provider documentation | Official for this service |
| Instagram / Threads: impersonation reporting form | Provider documentation | Official for this service |
| WhatsApp: “How to recover a compromised account” | Provider documentation | Official for this service |
| WhatsApp: “About two-step verification” | Provider documentation | Official for this service |
| Apple: “If you think your Apple Account has been compromised” | Provider documentation | Official for this service |
| Apple: “How to use account recovery when you can’t reset your Apple Account password” | Provider documentation | Official for this service |
| Apple: account portal | Provider documentation | Official for this service |
As of October 24, 2026. This guide is for informational purposes only and does not constitute legal or financial advice. Account recovery procedures, setting names, and help page addresses change frequently, especially in Meta, Google, and Microsoft services, so check the current provider help page before acting. No platform guarantees account recovery or refund. For legal obligations (e.g., reports to UODO) and financial losses, consult a lawyer, bank, or relevant authority.
Comments (0)
No comments yet. Be the first!