Social media account hacked: what to do

Secure your email first, then get it back.

The answer in 2 lines. If you can still log in, change the password straight away, log out all other sessions and turn on two-step verification. If you are locked out, use the official recovery process in the app or on the platform's own help pages. Secure your email account first, because it is the key to all the others. Warn your friends by another route, keep screenshots, and never pay anyone who promises to recover your account: that is almost always a second scam.

The first 4 steps

Secure your email first: change its password. Your email is what lets you recover other accounts.
Still have access: change the password, log out of all other devices, turn on two-step verification, and check the email address and phone number on the account.
Locked out: use the "hacked account" or "forgotten password" option in the official app or on the platform's help pages.
Warn your contacts another way: the hacker may message them asking for money or codes.

Getting your account back

Use only the platform's official app or website. Most have a help page for hacked accounts, sometimes with an identity check such as a video selfie.
Look in your inbox for a message from the platform about a changed email address: it often has a link to undo the change.
Check your spam folder too.
Be patient: recovery can take several days.

Once you are back in

Pick a new password: long, unique, never used elsewhere. The NCSC suggests three random words.
Turn on two-step verification, ideally with an authenticator app rather than text messages.
Remove connected apps and devices you don't recognise.
Check posts and messages sent in your name and delete the hacker's.
Change the password on any other account that used the same one.

What not to do

Paying an "expert" who offers to recover your account.
Giving up and opening a new account straight away: the hacker could keep using the old one in your name.

Traps after a hack

Accounts or messages offering to recover your account for a fee are nearly always scams.
The hacker may demand money or threaten to post private content: don't pay, keep the evidence and report it to the police.
Your friends may get requests for money or codes: tell them not to send anything.

Good to know

Getting into someone's account without permission is a crime in the UK (Computer Misuse Act 1990). You can report it to Report Fraud, or to Police Scotland on 101 in Scotland.
If someone threatens to share private images of you, don't pay and call the police on 101, or 999 if you are in danger.

In Liverpool, Chloe can't log in: her email address has been changed. In her inbox she finds the platform's message about the change and taps "This wasn't me". She gets the account back, turns on two-step verification, deletes the hacker's messages and warns her friends.

A made-up story, for illustration.

Useful numbers and contacts (UK)

159: the Stop Scams UK number that puts you through to your own bank's real fraud team (most major banks take part).
7726: forward a scam text here, free on most UK networks.
report@phishing.gov.uk: forward a scam email here (National Cyber Security Centre).
Report Fraud: the national police reporting service for fraud and cybercrime in England, Wales and Northern Ireland, which replaced Action Fraud, at reportfraud.police.uk.
101: police non-emergency number. In Scotland, report fraud to Police Scotland on 101.
999: only if a crime is happening now or someone is in danger.

Bobby

Sources, verification, confidence

Verified on 18 October 2026, for England. Confidence: high for the recovery and security steps (National Cyber Security Centre); we found no recent official UK figure on hacked social media accounts, so we don't quote one. Each platform has its own recovery process. This guide describes common cases, not a diagnosis or legal advice.