iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you are locked out, go directly to your email or social platform’s official account-recovery page. If you can still sign in, change the password, sign out other sessions, turn on two-factor authentication, and check for attacker-made changes. If the computer or phone may contain malware, scan it with updated, trusted security software before changing credentials when the provider’s guidance calls for that. Do not use recovery links sent unexpectedly by email, text, direct message, or a supposed “helper.”
First, decide which situation you are in
A hacked account can mean a confirmed takeover, an attempted takeover, or a warning that needs investigation. Treat these signs seriously without assuming every alert proves that someone successfully gained control:
- You cannot log in, or someone changed your password.
- You receive notifications about a password, email address, phone number, or other account change you did not make.
- You see unfamiliar sign-ins, devices, locations, or login attempts.
- Friends, family, or followers receive messages you did not send.
- Your account shows posts, comments, profile edits, password-reset notices, or other activity you do not recognize.
The Federal Trade Commission (FTC) describes these as warning signs and recommends using the provider’s own recovery instructions. See its account-recovery guidance and its October 2024 consumer alert.
Free tools Windows power users keep installed
One-click scans. No signup required.
If you are locked out
Open a new browser window or the provider’s official app and type the address yourself or use a bookmark you created previously. Start the provider’s “forgot password,” “account recovery,” or compromised-account flow. Do not click an unexpected recovery link or call a number supplied in a suspicious message.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you are still signed in
Keep the session open while you secure the account, but do not trust that a familiar-looking page is genuine. Navigate through the provider’s normal security settings, change the password, review active sessions, and remove anything you do not recognize.
Recover an account you cannot access
- Use the official recovery page. Google directs people who cannot sign in or whose account information was changed to its account-recovery process. Microsoft provides a sign-in helper for compromised Microsoft accounts. Other services have their own flows and may offer different verification options.
- Answer recovery questions as accurately as possible. Use a device, browser, and location you commonly use for that account when practical. Enter an older password or previously used recovery detail only on the provider’s genuine site.
- Check every recovery channel. Look for a provider notification at an alternate email address, phone, authenticator app, security key, or printed backup code. An attacker may have changed one method but not all of them.
- Follow the provider’s escalation path. Some services offer self-service only; others may route eligible users to additional support. No provider can guarantee that every account will be restored, and response times and human-support availability vary.
- Save evidence. Keep copies or screenshots of unfamiliar sign-ins, changed settings, fraudulent messages, and recovery notices. Preserve dates and sender addresses in case you need to explain the incident to the provider, your bank, contacts, or authorities.
Be wary of anyone who contacts you first and promises to recover the account for a fee, asks for a verification code, or requests your password. Account-recovery scammers often target people immediately after a takeover.
Check the device before changing credentials when malware is possible
An attacker may have obtained credentials through phishing, a reused password, a compromised app, or malware; the account incident does not by itself prove that the device is infected. If you installed an unknown program, opened a suspicious attachment, or see other signs of compromise, use a different trusted device for recovery if possible.
Recommended Free Tools
- Update your computer or phone’s security software and operating system.
- Run a full scan with trusted security software.
- Remove software the scan identifies as malicious and restart the device.
- Continue account recovery and password changes after the scan, following the provider’s instructions.
The FTC recommends updating security software, scanning, removing suspicious software, and restarting. Microsoft says to clear a PC of viruses or malware before changing a compromised-account password; Google likewise recommends removing harmful software and running trusted antivirus software when suspicious activity indicates that step is needed. The UK National Cyber Security Centre’s recovery guidance is another official reference for UK readers.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Secure the account immediately after access returns
- Set a new, unique password. Do not reuse the compromised password anywhere else. The FTC’s October 2024 alert recommends aiming for 12 to 15 characters or using a passphrase; that is the FTC’s guidance, not a universal requirement imposed by every service.
- End other sessions. Use the security page’s option to sign out all devices or all other sessions, then sign in again only on devices you trust.
- Turn on two-factor authentication (2FA). Add a second factor before you continue using the account. Keep a backup recovery method that you can access.
- Verify recovery details. Confirm that the recovery email address and phone number belong to you, are spelled correctly, and have not been replaced by an attacker’s details.
- Review security alerts. Check recent events, login history, devices, connected apps, and any setting changed around the time of the takeover.
The FTC summarizes the goal this way: “That’s why it’s critical to protect your email account by using a strong password and turning on two-factor authentication.”
Remove persistence and repair the damage
Email accounts
Attackers often leave settings that let them continue reading mail or intercept password resets after you change the password. Inspect each of these areas, removing entries you did not create:
- Automatic forwarding addresses.
- Inbox rules and filters that hide, delete, or redirect security messages.
- Delegated access, connected accounts, and third-party apps.
- Automatic replies, signatures, and scheduled messages.
- Sent, outbox, archive, spam, and deleted folders.
- Recovery email addresses, phone numbers, app passwords, and sign-in methods.
Google specifically directs users to review security events, signed-in devices, recovery information, apps with account access, Gmail forwarding and filters, and suspicious activity in individual products. Microsoft calls out connected accounts, forwarding, and automatic replies. Menu names differ by provider, so use the service’s current help pages if you cannot find a setting.
Social-media accounts
- Delete posts, stories, comments, direct messages, or event invitations you did not create.
- Review new followers, follows, friends, group memberships, page roles, and advertising or payment settings.
- Remove unfamiliar linked apps, browsers, devices, and business integrations.
- Check profile email, phone, username, privacy, and recovery settings.
- Look for messages asking contacts for money, gift cards, codes, or urgent clicks.
Do not delete every security notification before recording what happened. A short evidence trail can help the platform investigate and helps you explain suspicious messages to people who received them.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Protect your email and accounts connected to it
Email should be a priority because it can receive password-reset links for many other services. After securing the mailbox, list accounts that use that address and change any password that was reused or exposed. Start with banking, payment, cloud storage, work, shopping, health, and government services, then review sign-in activity and recovery settings on each.
If you cannot yet regain the mailbox, use the official recovery process for each critical linked account and tell its support team that the associated email is compromised. Do not substitute a new email address until the provider confirms how to update the account safely.
Warn contacts and contain scams sent from your account
Tell friends, family, coworkers, and followers that the account was compromised. Ask them to ignore links, attachments, payment requests, password requests, and unusual messages sent during the incident. If the account is still sending messages, remove attacker access and contact the platform through its official help channel; do not try to negotiate with the attacker.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For a work or school account, notify the organization’s IT or security team promptly. An administrator may need to revoke sessions, reset tokens, check mailbox rules, and investigate other affected users.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose a second factor that you can actually retain
Availability varies by service. The FTC says authenticator apps and security keys are more secure than one-time codes sent by text or email. Google lists a phone, security key, or printed backup code among possible second factors. Select a method the account supports and keep a backup route that will remain available if your phone is lost.
| Second-factor method | Protection and practical considerations | What to verify |
|---|---|---|
| Authenticator app | Generally stronger than text or email codes and works without cellular service once configured. | Store recovery codes safely and confirm how to transfer the app if the phone is replaced. |
| Hardware security key, including a FIDO2 security key | Strong phishing-resistant option when supported; it is a physical device you must keep available. | Check platform compatibility and register a spare key or another backup method. A key protects future sign-ins; it does not recover a locked account. |
| Text message or email code | Often easier to set up but less resistant to phishing, SIM-swap, or mailbox compromise. | Keep the phone number or alternate email current and do not disclose a code to anyone who contacts you. |
| Printed or saved backup codes | Useful when the primary device is unavailable. | Store them offline, treat each code as sensitive, and replace the set after use if the service allows it. |
Report possible identity or financial harm
If personal information may have been stolen, U.S. readers can use IdentityTheft.gov to report it and receive a personalized recovery plan, as the FTC explains in its October 2024 alert. This destination is specific to the United States; readers elsewhere should use their country’s official identity-theft or data-protection reporting service.
Contact your bank or payment provider immediately if financial information, payment details, or transaction records may have been exposed. Ask what monitoring, account freeze, card replacement, or dispute steps apply. Google advises contacting the bank or local authorities when financial or identity information saved in the account may be at risk. Use the relevant local authority rather than assuming one reporting process applies worldwide.
Prevention after the incident
- Use a different strong password for every important service. A password manager can generate and store unique passwords; the FTC discusses this option in its guidance on protecting personal information.
- Enable 2FA on email first, then on financial, work, cloud, and social accounts.
- Keep operating systems, browsers, apps, and security software updated.
- Review account activity and connected apps periodically, not only after an alert.
- Use bookmarks or manually entered addresses for recovery pages. Treat urgent messages that ask for a password or code as suspicious.
- Store backup codes and, where appropriate, a spare security key in a secure place separate from your primary device.
Common problems and the safest response
“The recovery form keeps rejecting me.”
Stop guessing repeatedly. Try again from a familiar device and network, provide older account details accurately, and use the provider’s published help or escalation route. Do not pay an unsolicited recovery service or send anyone a verification code.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“I changed the password, but messages are still being sent.”
Sign out every session, revoke connected apps and app passwords, inspect forwarding and rules, and check social-media integrations. Scan the device if malware is possible. If the behavior continues, contact the provider through its official compromised-account channel.
“The attacker changed my recovery email and phone.”
Use the provider’s hacked-account flow and any prior-address notification or reversal option it offers. Recovery options differ by service, and restoration is not guaranteed.
“I received a security alert but can still sign in.”
Do not dismiss it. Open the provider directly, review recent events and devices, change the password if anything is unfamiliar, revoke sessions and apps, and confirm recovery details. An alert can represent an attempted login rather than a completed takeover, but it deserves verification.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
