Account hacked? Here's how to recover it.

Three ways do almost all the damage: reused passwords leaked in another site's data breach, phishing emails or texts that trick you into typing your password into a fake login page, and SIM-swap or 2FA bypass attacks that steal text-message codes. Using a unique password per account and an authenticator app (instead of SMS 2FA) blocks the vast majority of takeovers.

Only if you also sign out all other sessions. Changing the password alone doesn't always log existing sessions out — most platforms keep them logged in until you go into security settings and tap 'log out all devices' or revoke active sessions. Always do both.

Your primary email — always. Whoever controls your email can reset the password on every other account that uses it. Lock down your email first (new password + authenticator-app 2FA + recovery details checked), then move to banking, then social media and shopping accounts.

It's much better than no 2FA, but it's the weakest form because of SIM-swap attacks. Where the platform offers it, switch to an authenticator app (Authy, Google Authenticator, Proton) or a hardware security key — especially for email, banking, and any high-value account.

Use the platform's official 'I think my account has been hacked' or account recovery flow (every major service has one). Be ready to prove your identity with old passwords you've used, devices you used to sign in from, and government ID. Our platform-specific guides walk you through each one step by step.

Yes, in two places. First, report it inside the platform itself so they can lock the attacker out and notify your contacts. Second, if money was stolen or your identity was misused, file a report with your national cybercrime unit (IC3.gov in the US, Action Fraud in the UK). A police report is often required by banks for fraud refunds.