Hacked Account? What to Do in the First 24 Hours

In the first 24 hours after a hack, work in this order: secure your email, start the platform's official recovery (for example instagram.com/hacked or facebook.com/hacked), warn your contacts that messages from you may be fake, and save evidence. If any money moved, call your bank straight away and report it to the authorities in your country. Don't pay anyone who messages you offering to "get it back". The UK's National Cyber Security Centre, the US FTC and the Australian Cyber Security Centre all give the same core advice: use the provider's own recovery process.

#Hour 0-1: What should I do immediately?

#1. Check whether you can still log in

If you can, change the password at once, sign out of all other sessions, and turn on two-step verification. The NCSC tells hacked users to change the password immediately, and to change it on any other account that uses the same one (NCSC).

#2. Secure your email account

Your email is the master key. The FTC explains that someone who controls your inbox can request password resets for your other accounts and lock you out (FTC). If the email was compromised too, recover that first through your email provider.

#3. Look for the platform's security email

When your email address or password changes, some platforms send a notice to the old address. Instagram also lets you review recent emails it has sent you, which helps you tell real messages from fake ones (Instagram Help Center).

#4. Start the official recovery flow

• Instagram: instagram.com/hacked
• Facebook: facebook.com/hacked
• TikTok: TikTok hacked-account help
• WhatsApp: WhatsApp compromised-account help
• YouTube: YouTube hacked-channel help
• Meta business portfolio: Recover a hacked or compromised business portfolio

The NCSC's advice is simply to go to the provider's website and search its help pages, because the recovery process differs from service to service (NCSC).

"Repeated failed attempts and deleting the platform's security emails are the two things that make recovery harder later. Slow down, keep every email, and don't click recovery links sent by DM." - Md Shariar Shanaz Shuvon, Founder, AwareXone

#Hour 1-3: How do I contain the damage?

#Warn your contacts

Attackers often use a hacked account to message friends asking for money, codes or "votes". The NCSC recommends telling contacts and followers you were hacked and warning them to be suspicious of recent messages from you (NCSC). Use another channel, like SMS, another platform or a story from a friend's account. AwareXone's guide on a hacked account messaging friends has message templates.

#Check accounts linked to the hacked one

The Australian Cyber Security Centre advises checking accounts linked through "sign in with Facebook" or "continue with Google", and any account that uses the compromised email for recovery (cyber.gov.au). Start with banking, shopping, cloud storage and work accounts.

#Collect evidence

• Screenshots of security emails and notices
• The time you lost access and the time any settings changed
• Scam messages sent from your account, and their recipients
• Your original username, email and phone number
• For businesses: Page IDs, ad account IDs and invoices

#If you clicked a link or installed something

Change passwords from a different, clean device, and run a security scan. The FTC suggests making sure your security software is up to date and running a scan before you start recovery (FTC). See clicked a phishing link.

#Hour 3-24: When and where should I report it?

Report it if money was lost, your account was used to scam people, or someone is impersonating or blackmailing you.

#What if the hacker turned on their own two-factor authentication?

This is common, and it makes things harder. Don't keep trying codes. Use the platform's "trouble logging in" or "hacked" route, which can offer identity checks like a video selfie or ID. AwareXone covers this in hacker turned on two-factor.

#What should I *not* do in the first 24 hours?

• Don't pay "recovery hackers." The FTC warns that unexpected offers to recover a loss for an upfront fee are scams (FTC). See account recovery scams.
• Don't call "support numbers" from search results. Meta says it has no general public customer-service phone number (Meta).
• Don't share one-time codes, including with "friends" who message you.
• Don't spam recovery attempts. Repeated failures can trigger extra locks.
• Don't delete the platform's security emails. They're evidence.

#What if I still can't get in after 24 hours?

Many cases take longer than a day. Keep a record of every attempt and reference number. The NCSC notes that sometimes recovery through the online service isn't possible, and you'll need to create a new account and tell your contacts (NCSC). Before giving up on a valuable account, consider whether you have stronger ownership evidence, like ID, business documents or the original email, that you haven't used yet.

If the account is a business asset or you're stuck in a loop, a transparent recovery provider can help. AwareXone, which publishes this guide, works only through official channels, never asks for passwords or OTPs, doesn't promise outcomes, and replies to new cases within five hours (9am-11pm MYT, every day). Recovery cases start from the quoted fee in Malaysia, and clients outside Malaysia are quoted and billed in USD, with the fee confirmed after case review. See when to get professional help.

#After you're back in: the 10-minute lockdown

1. Change the password to a unique one.
2. Sign out of all sessions and devices.
3. Turn on app-based two-factor authentication or passkeys where offered. The NCSC strongly encourages passkeys where available (Report Fraud, Oct 2026).
4. Check that the recovery email and phone are yours.
5. Remove unknown connected apps, admins and linked accounts.
6. Delete scam posts and messages sent while the account was out of your hands.
7. Save backup codes offline.

"The step people forget is checking where they're still logged in and which apps or partners have access. If an old session or a connected app is left active, an attacker can come straight back after you change the password." - Md Shariar Shanaz Shuvon, Founder, AwareXone