I think my account has been hacked

If you think an account has been hacked, act quickly but calmly. Signs include login alerts you did not expect, password reset emails you did not ask for, strange messages sent from your account, or being unable to sign in.

First steps

• Use a device you trust, ideally one that is not behaving oddly.
• Go to the official website or app, typed in yourself, not via a link in a message.
• If you cannot sign in, use the Forgot password option on the real site.

Step by step

1. Change your password to a new, strong, unique one. Do not reuse an old one.
2. Look for an option to Sign out of all devices in the account's security settings, and use it.
3. Turn on two-step sign-in so a stolen password is not enough.
4. Check your recovery email address and phone number are yours.
5. For email accounts, check settings for rules or forwarding you did not set up. Hackers sometimes forward your mail to themselves.
6. If you used the same password elsewhere, change it on those sites too, starting with your email and banking.
7. Tell friends and family not to open odd messages sent from your account.

If money or banking is involved

Phone your bank at once using the number on your card. Ask them to check recent activity.

Report it

• Report to Report Fraud (formerly Action Fraud) at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
• Forward scam emails to report@phishing.gov.uk, and scam texts to 7726.

When to get more help

Stop and ask for help if you cannot get back into the account, the hacker has changed your recovery details, your computer may also be infected, or money has gone. Please do not pay anyone offering to recover your account. Tell us which account, what you noticed and when.