Skip to content

Social Media Account Takeover and Hacking

When hackers breach a social media account, they frequently change the registered email address, phone number, and password within seconds. They may use your profile to send phishing links to contacts, scam followers, or post unauthorized content. Rapid action limits damage and increases the likelihood of full account recovery.

Immediate Emergency Steps (First 15 Minutes)

  1. Check Official Security Emails: Look for security alert emails from the platform (such as Instagram, Facebook, X, or Google). Click the official Security Link or It wasn't me link inside the email to reverse unauthorized email changes.
  2. Request Password Reset via Linked Accounts: Attempt to reset your password using alternative verification methods, such as linked phone numbers, connected WhatsApp accounts, or backup security codes.
  3. Use Official Platform Recovery Portals:
  4. Instagram: Visit instagram.com/hacked to initiate identity verification via video selfie or trusted contacts.
  5. Facebook: Visit facebook.com/hacked to secure compromised profiles and log out active sessions worldwide.
  6. X (Twitter): Submit an account recovery ticket at help.twitter.com under compromised account.
  7. Google and YouTube: Go to accounts.google.com/signin/recovery to restore compromised Google channels.
  8. TikTok: Use the in-app Report a Problem or visit tiktok.com/legal/report/feedback.
  9. Warn Your Network: Post a notice on your remaining active channels or message close contacts to inform them your account has been breached and not to click any links sent from your compromised profile.

Securing Connected Accounts and Financials

  • Revoke Active App Permissions: Once logged back in, navigate to Security and Permissions settings to remove unrecognized third-party apps and active browser sessions.
  • Check Connected Credit Cards and Ads Accounts: If your social account is linked to business advertising accounts or payment methods, contact your bank immediately to pause card processing and prevent fraudulent ad spending.
  • Secure Your Primary Email: Hackers often gain access to social accounts by first breaching primary email inboxes. Change your email password immediately and enforce 2FA.

What to Do If You Cannot Recover the Account

If automated recovery fails, file a formal ticket with platform support submitting government-issued identification where requested. If the hacker is engaging in active financial extortion or identity theft, file a complaint with the Federal Bureau of Investigation Internet Crime Complaint Center (IC3 in the United States) or your national cyber crime agency.