Finding out an account has been hacked is stressful. Work through these steps in order: the first few stop the damage, the rest clean up and prevent it happening again.
1. Secure your email first
Your email is the key to everything else, because password resets go there. If your email is still in your control, change its password now and turn on 2-step verification. If it has been taken, start its recovery process immediately (for Gmail, see how to secure your Google account).
2. Protect your money
- If a banking or card account may be affected, call your bank on its official number and block the card or online access.
- If your MoMo PIN or phone may be compromised, change your PIN and call your network. See mobile money security checklist.
3. Recover the hacked account
- Facebook or Instagram: use facebook.com/hacked or Instagram’s hacked account flow. See recover a hacked Facebook account.
- WhatsApp: re-register your number on your phone. See WhatsApp account hacked.
- Google: follow Google’s steps for a compromised account.
- Use only the platform’s official recovery tools. Never pay a “recovery expert”.
4. Kick the hacker out
- Change the password to a long, unique one.
- Log out of all other sessions or devices (most services have “log out everywhere” or a list of devices).
- Remove unknown recovery emails and phone numbers the hacker may have added.
- Turn on 2-step verification.
5. Change reused passwords
If you used the same password anywhere else, change it there too. Hackers try stolen passwords on other sites.
6. Warn your contacts
Hacked accounts are used to ask friends for money or codes. Post or send a message on another channel telling people not to respond to requests “from you”.
7. Report it
8. Find out how it happened
- Did you click a link or enter a password on a page you reached from a message? See how to spot phishing messages.
- Did you share a code someone sent you? See never share your OTP.
- Did you reuse an old password? Use a password manager from now on.
Email first, money second, everything else third.
This guide was checked in October 2026. Menus and services change, so if something looks different on your phone, check with your provider.
Common questions
Which account should I secure first?
Your email, because password resets for your other accounts go there. Then any account linked to money, then social media.
Should I delete the hacked account?
Usually no. Recover it first so you can remove anything the hacker did and stop them using it to scam your contacts.
How do hackers usually get in?
Most often through a phishing link, a shared OTP, a reused password from another breach, or an unlocked phone.
Do I need to report a hacked account?
If money is involved or your contacts are being scammed, report it to the Cyber Security Authority and the police, and to the platform.
