Recovering a hacked account

Go to the account provider's website and search their help or support pages. These will explain in detail the account recovery process (it's likely to be different for each account). If you can't find what you need on the website, use a search engine query (for example, 'How do I recover my Twitter account') and follow the links. 

Check your email filters and forwarding rules. A common tactic used by cyber criminals is to set up a forwarding rule, which means that they will automatically be sent a copy of all emails sent to your account (which would allow them to reset your passwords). Again, you can find detailed instructions about how to do this on the email provider's website, or you can use a search engine.

Once you have confirmed there are no unwanted email forwarding rules in place, you need to:

a. change the password for any account that has been hacked

b. change the password for any accounts that are using the same password

Both steps are important because cyber criminals know that many people use the same password for different accounts, and so will try the same 'hacked' password across multiple accounts. You can refer to the NCSC's guidance for help on how to create strong passwords.

Once you have changed your passwords, you need to make sure that any devices and apps (that may still be logged in) are logged out of the relevant account. This can usually be done from the Settings menus of the app or website (or it may be part of the Privacy or Account options). For specific instructions on how to do this, you'll need to refer to the support page for the relevant service. Once you've done this, anyone else attempting to use your account will be prompted to supply the new password.

Many online accounts and services allow you to set up two-step verification (2SV), which means that even if a criminal knows your password, they won't be able to access your accounts. 2SV (which is also known as two-factor authentication or 2FA) usually works by sending you a PIN or code, often sent by SMS or email, which you'll then have to enter to prove that it's really you. It's worth taking the time to set up 2SV on important accounts like email and banking, even if these are already protected using a strong password. It only takes a few minutes, and you're much safer online as a result.

You should apply updates to your apps and your device's software as soon as they are available. Updates include protection from viruses and will often include improvements and new features. Applying these updates is one of the most important (and quickest) things you can do to prevent your account from being hacked. You should also turn on 'automatic updates' in your device's settings, if available. This will mean you do not have to remember to apply updates. Note that updating your device may take some time and requires a reliable internet connection, so it’s best to do it at home where you can access your Wi-Fi (and keep your device plugged in).

Get in touch with your account contacts, friends or followers. Let them know that you were hacked, and suggest they treat any recent messages sent from your account with suspicion. This will help them to avoid being hacked themselves. 

Often a hacked email account can lead to compromises elsewhere. Keep a look-out for unauthorised purchases, or check your bank accounts for any unusual transactions. You can contact your bank directly for further support. Always use official websites or social media channels, or type the address directly into your browser. Don't use the links in any messages you have been sent.

If you've lost money, tell your bank and report it as a crime to Report Fraud, the UK's reporting centre for cyber crime (in Scotland, contact the police by dialling 101). You'll be helping the NCSC and law enforcement to reduce criminal activity, and in the process, prevent others from becoming victims.