Recover a hacked account

Use a trusted device and save a record

1. If you installed remote-control software or suspect malware, disconnect that device from the internet. Use another updated device you control for recovery. Before reusing the affected device, follow the device-control section of the Emergency checklist.
2. Write down the account name, when you noticed the problem, and what changed. Save screenshots of unfamiliar sign-ins or purchases where available. Do not delay stopping an active loss to gather evidence.
3. Open the provider's app or type its website address yourself. Do not use a recovery link or phone number supplied by the suspected attacker.

Keep passwords and recovery codes out of your incident notes and printed checklist.

Regain access through your provider

If you can still sign in, go straight to the password step below. If you cannot, open only your provider's option.

Check access. Confirm you have reached the correct account and can open its security settings. If recovery is pending, record the next action and date; do not mark the remaining recovery tasks complete.

Replace the password and repair recovery methods

1. Open account security settings. For Google, start at Google Account; for Microsoft, Microsoft account; for Apple, Apple Account.
2. Set a new, unique password generated and saved by your password manager.
3. Inspect recovery email addresses and phone numbers. Add and verify your own working recovery method before removing anything you no longer control. Remove unfamiliar methods.
4. Review two-step verification methods, security keys and passkeys. Remove entries you did not add. Turn on two-step verification if it is off, using the email sign-in guide where applicable.
5. If the account offers backup codes, replace the old set and save the new set somewhere you can reach without this account.

Check the list. Every remaining recovery and sign-in method should belong to you. Keep your trusted session open until you know your new sign-in and recovery methods work.

Remove other sessions and connected access

A password change may leave some sessions or app permissions active. Review them separately.

For other services, find Sessions, Where you're logged in, or Connected apps in security settings. Sign out other sessions and revoke unfamiliar access. If app passwords are offered, revoke unused or unfamiliar ones and replace any you still need.

Check your sign-in. After securing the methods above, use a second browser window to confirm your new password and verification method work. Do not approve verification prompts you did not initiate.

Undo email forwarding and account changes

If the affected account includes email, use its webmail settings, preferably on a computer.

Inspect Sent, Deleted and Trash folders for messages you did not send and password-reset notices. Send yourself a test message from another account you control and confirm it arrives. If impersonation messages went out, warn affected contacts through another trusted channel and tell them to disregard those messages.

Secure affected accounts and schedule a follow-up

1. In your password manager, find accounts that reused the exposed password. Replace each with a different generated password, starting with email, financial and shopping accounts.
2. Inspect the affected account's purchases, payment methods and sharing settings. Save details of changes you did not make and use the provider's official reporting process.
3. If money or identity information was misused, follow the relevant Emergency checklist section. Contact your financial institution using its app or the number on your card.
4. Set a calendar reminder for tomorrow to recheck security activity, forwarding and recovery methods. Add another reminder for one week later and record any provider case follow-up date.

If unfamiliar access returns, use a different trusted device and contact the provider through its official support site. Revisit malware, connected apps and recovery methods.