Gmail or Facebook account hacked: how to recover it

A hacked email or social media account is a nightmare: your contacts receive messages in your name, you can no longer log in, and the backup email address may have been changed. The good news: by acting fast and in the right order, most accounts can be recovered. Here's what to do.

The signs of a hacked account

• Your password no longer works, even though you haven't changed it.
• Contacts tell you about strange messages sent ‘by you’.
• Login emails from an unfamiliar device or country.
• Messages in your ‘sent items’ that you didn't write.
• A notification about a password change or a recovery address change that you didn't request.

The first 5 minutes: act fast

Order matters. The sooner you react, the less time the hacker has to lock down the account.

1. Change the password of the affected account if you still have access to it — and choose a completely new one, not a variation of the old one.

2. Log out of all active sessions. Most services offer ‘Sign out of all devices’: this kicks the hacker out immediately.

3. Check the recovery email address and phone number. Hackers change them to keep control. Put yours back.

4. Change the password of your main mailbox as a priority. It is the key to everything else: whoever controls your email can reset your other accounts.

Recovering a Google / Gmail account

Go to the official page g.co/recover (or ‘Google Account Recovery’). Google will ask you questions: the last password you remember, your usual device, the approximate creation date. Answer from a device and location you normally use — Google uses this to recognise you.

If a valid recovery email address or number is still linked, you'll receive a code to regain control. Once you're in: change the password, turn on two-step verification, and review the ‘connected devices’ and ‘third-party app access’ to revoke anything you don't recognise.

Recovering a Facebook / Instagram account

For Facebook, use facebook.com/hacked; for Instagram, the option ‘Need more help?’ on the login screen. These flows let you report a hack even if the hacker has changed the email address.

Meta may ask for proof of identity to prove that the account is indeed yours — this is normal and it's often what unblocks the situation when everything else has been changed. Be patient: these checks sometimes take a few days.

Securing it for good

• Turn on two-factor authentication (2FA) wherever possible. It's the most effective protection: even with your password, the hacker can no longer get in.
• Use a unique password for each account. Impossible to remember? A password manager takes care of it for you.
• Check your devices. If your credentials were stolen by spyware, changing the password isn't enough: you need to clean up the computer.
• Beware of ‘urgent’ emails. Most hacks start with a fake email (phishing) that gets you to enter your credentials on a fake site.

If you're stuck

Sometimes nothing works: the recovery address has been changed, you no longer have access to the linked phone, the form goes round in circles. Before giving up on the account, a methodical helping hand (proof of prior ownership, the right forms, checking that the computer itself isn't infected) often makes the difference.