Social media account hacked: what to do

Secure your email first: it's the master key.

The answer in 2 lines. If you can still log in, change the password right away, sign out of all other sessions, and turn on two-step verification. If you're locked out, use the official recovery process in the app or on the website. Secure your email account first: it's what lets you recover everything else. Warn your contacts another way, and never pay someone who promises to get your account back.

The first 4 steps

Secure your email first: change its password and turn on two-step verification. It's the key to recovering other accounts.
Still have access? Change the password, sign out of all other sessions, turn on two-step verification, and check the email and phone number on the account.
Locked out? Start the "hacked account" or "forgot password" process from the official app or website only.
Warn your contacts another way: the hacker may message them pretending to be you.

Then check what the hacker changed

Recovery email and phone number, linked apps and devices, and login alerts.
Posts, messages or ads sent in your name: delete them and tell your friends.
Payment methods saved in the account, and any shop or ad account linked to it.
If you reused that password elsewhere, change it there too.

What not to do

Paying a "recovery expert" who contacts you or advertises online: these are usually scams.
Clicking links in messages claiming to be from the platform's support team: go through the app or website yourself.
Sending a code you received by text to anyone, even a "friend" asking for help.

If money or your identity is at stake

Hacker asking friends for money: tell them it's not you, and report the account to the platform.
Card details or bank info exposed: call your bank at its official number.
Personal information used to open accounts: go to IdentityTheft.gov for a recovery plan.
Report the fraud to the FTC at ReportFraud.ftc.gov; online crime involving losses can also go to the FBI's IC3.

Good to know

Two-step verification with an authenticator app is harder to steal than a code sent by text.
A different password for every account limits the damage when one leaks. A password manager helps.

In San Diego, Tyler's Instagram suddenly posts crypto ads. He changes his email password first, then uses Instagram's "hacked account" process in the app. He texts his friends not to click anything from his account, and ignores a "recovery specialist" who offers help for $200.

A made-up story, for illustration.

Good habits for next time

Turn on two-step verification on email and social accounts now.
Keep your recovery email and phone number up to date.
Be suspicious of "copyright violation" or "account suspended" messages: they're classic phishing.

Bobby

Sources, verification, confidence

Verified on October 18, 2026, for the United States. Confidence: high for the general steps (FTC guidance); medium for menu names, which differ between platforms and change often. No paid recovery service is recommended. This guide describes common cases, not a diagnosis or legal advice.