If someone has taken control of your social media account, report the hacked account through the platform’s official recovery system as soon as possible. Do not rely on messages from people claiming they can recover it for a fee. The correct process depends on the platform, but the basic approach is the same: secure the email account connected to the profile, use the platform’s official hacked-account recovery page, document unauthorized changes, and remove the attacker’s access after you regain control.
A hacked account can be more than an inconvenience. An attacker may use your profile to send phishing messages, scam your contacts, change your recovery information, access private conversations, or impersonate you. If the account is connected to a business page, advertising account, payment service, or other social profiles, the consequences can extend beyond the original account.
How to Tell If Your Social Media Account Was Hacked
Not every strange notification means that someone has taken over your account. However, several signs strongly suggest unauthorized access.
Look for changes you did not make, including:
- A new password that no longer works
- An unfamiliar email address or phone number
- Posts, comments, stories, or messages you did not publish
- New followers or accounts being followed without your permission
- A changed username, profile picture, or biography
- Security alerts about unfamiliar devices or locations
- Two-factor authentication that suddenly stops working
- Password-reset emails that you did not request
- Friends telling you that your account sent them suspicious messages
- An account that has been logged out of all your devices unexpectedly
Facebook specifically lists unauthorized posts, changed profile information, login problems, unexpected security notifications, and unfamiliar devices as signs that an account may have been compromised.
A strange post alone does not always prove that your password was stolen. A connected third-party application can sometimes have permission to perform actions on your behalf. That is why checking connected applications and active sessions is important once you can access the account again.
What to Do Before Reporting a Hacked Social Media Account
The first few actions matter because attackers often try to maintain access after changing the password.
Secure Your Email Account First
Your email account is particularly important because it may be used to reset your social media password. If the attacker also has access to your email, recovering the social account without securing the email can become an endless cycle.
Change your email password from a device you trust and make sure the recovery phone number and email address are correct. Review recent sign-ins and remove unfamiliar sessions if your email provider offers that option.
If you reused the same password on other websites, change those passwords too. A password stolen from one service can be tested against other accounts.
Do Not Delete Evidence
Take screenshots of suspicious messages, changed profile information, login alerts, emails, and unauthorized posts before removing anything.
Save useful details such as:
- Your original username
- The previous email address connected to the account
- The phone number previously associated with it
- Approximate date and time you last had normal access
- The date you noticed the compromise
- Screenshots of unauthorized activity
- Security emails showing password or email changes
You may not need all of this information, but having it available can make an account recovery request easier to complete.
Warn Your Contacts
If the attacker is sending messages from your account, tell your friends, followers, customers, or coworkers not to click links or send money in response to messages from the compromised profile.
This is particularly important if the attacker is pretending to be you and asking contacts for financial assistance, login codes, cryptocurrency, gift cards, or other sensitive information.
How to Report a Hacked Social Media Account
There is no universal social media reporting form. Each platform has its own recovery process, and the safest approach is to start from the platform’s official website or app.
Do not search randomly for a “hacker recovery expert” and give them your password or verification codes. Someone who claims to work for Instagram, Facebook, X, TikTok, or another platform should not need your password to recover your account.
If your Facebook account has been hacked, use Facebook’s official hacked-account recovery process.
Facebook hacked account recovery
Facebook recommends using a device that you have previously used to log into the account. The recovery system can search for your account using an email address or mobile number and then guide you through available security steps.
If you still have access to Facebook, immediately change the password and review the devices that are logged into the account. Facebook’s recovery documentation also explains that if an attacker changed the email address, a message may have been sent to the previous email account with an option to reverse that change.
If you cannot access the email address or phone number associated with the account, use Facebook’s account recovery options rather than creating a new account and abandoning the old one.
Facebook account recovery help
For Instagram, start with the official Instagram Help Center and use the hacked-account recovery process.
Instagram Help Center hacked account guidance
The exact recovery screens can vary depending on whether you can still log in, whether your email or phone number was changed, and what security information remains attached to the account.
If Instagram sent a security message about an email-address change, check the original email account carefully. An attacker changing the email address can be one of the most important points in the takeover, and the original security notification may contain an option to reverse the change.
Do not trust random Instagram recovery forms found through social media posts or search results. Use the Instagram Help Center or recovery options presented directly by Instagram.
X
X provides a dedicated process for compromised accounts.
If you can still log in, X recommends changing the password, securing the email address associated with the account, and revoking access to third-party applications you do not recognize.
If you cannot log in, use the official compromised-account support form.
X hacked or compromised account support form
X asks users who submit a compromised-account request to provide information such as the username and the date they last had access to the account.
X also explains that changing your password does not automatically sign every mobile application out. You may therefore need to revoke application access separately after recovering the account.
TikTok
TikTok provides account recovery and reporting options through its Help Center and app.
If you can still access the account, change the password from the account settings. TikTok’s current instructions place the password option under Profile, Menu, Settings and privacy, Account, and Password.
If you cannot log in, start from the TikTok login screen and use the password recovery options. TikTok also provides a “Report a problem” route through the app under Settings and privacy.
The recovery options presented to you may depend on the information still associated with the account, so follow the specific verification steps TikTok displays rather than relying on instructions intended for a different account configuration.
YouTube
A hacked YouTube channel usually involves a compromised Google Account because YouTube channels are associated with Google Accounts.
YouTube hacked channel recovery help
Google explains that channel takeovers can involve unauthorized changes to the channel, uploaded videos, profile information, or other settings. The recovery process begins with recovering and securing the associated Google Account.
If you manage a YouTube channel, also check for unauthorized videos, changes to channel information, and unexpected account activity after recovering your Google Account. YouTube recommends scanning devices for malware and using stronger account protection such as passkeys or other forms of two-step verification.
What Information Should You Include in a Hacked Account Report?
When a platform asks you to describe the problem, keep your explanation factual and specific.
A useful report should explain:
- The username or profile URL of the compromised account.
- When you last had normal access.
- When you noticed the unauthorized activity.
- What changed without your permission.
- Whether the password was changed.
- Whether the email address or phone number was changed.
- Whether two-factor authentication was changed.
- Whether unauthorized posts, messages, or other activity occurred.
- Which original recovery methods you still control.
- Any relevant security notification or recovery email you received.
For example, instead of writing, “My account was hacked. Please help,” provide a short sequence of events:
I last accessed the account normally on August 10. On August 11, my password stopped working. I received a security email showing that the account email address had been changed, and unauthorized messages were sent from my profile. I still have access to the original email address and phone number.
That gives the support system or reviewer useful information without adding unnecessary details.
Never include your password, authentication code, backup codes, recovery codes, or private security answers in a support request unless the platform’s official process specifically and securely requires information of that type. In normal circumstances, a legitimate support representative should not need your password.
What If the Hacker Changed Your Email Address and Phone Number?
This is one of the more difficult takeover situations, but it does not necessarily mean the account is permanently lost.
Start by checking the original email account for security notifications from the social platform. If the attacker changed the account email address, the platform may have sent a notification to the previous address.
Facebook, for example, says that when an email address associated with an account is changed, the previous email account may receive a special link that can reverse the change.
If that option is no longer available, return to the platform’s official hacked-account recovery process. Use the original username, email address, or phone number where the system allows it.
You may be asked to verify that you are the legitimate owner. The exact verification method varies by platform and account, so do not assume that every service will request government identification or a selfie.
If the platform cannot immediately verify ownership, avoid repeatedly submitting random information. Follow the recovery instructions carefully and keep records of the requests you have already made.
What If You Can Still Log In?
If you suspect someone else has access but you are still logged in, do not wait for the attacker to log you out.
Start by changing the password to a new, unique password. Then review active sessions and sign out unfamiliar devices.
Next, check:
- Email address
- Phone number
- Two-factor authentication
- Connected applications
- Authorized devices
- Login history
- Recovery options
- Recent posts and messages
- Business or advertising access
X specifically recommends revoking third-party applications that you do not recognize after an account compromise.
The same principle applies to other platforms. An attacker may have gained access through a connected application rather than directly stealing your password. Simply changing the password may not remove every form of authorization.
What If You Cannot Recover the Account?
If the standard recovery process fails, make sure you are using the correct recovery route.
A login problem, hacked account, disabled account, impersonation report, and stolen business page can be treated as different issues by the platform. Choosing the wrong category may send you through a process that cannot restore the account.
For example, if an attacker took over your Facebook profile and then used it to create unauthorized activity, start with the hacked-account recovery process rather than treating the situation as an ordinary password problem. Facebook provides separate recovery guidance for hacked accounts and accounts that are locked for security reasons.
If you have already submitted a legitimate recovery request, keep the information consistent. Changing the story, supplying conflicting dates, or repeatedly entering different ownership information can make it harder to explain what happened.
Also check the email account associated with your recovery request, including spam and junk folders. Some platforms send verification instructions or follow-up messages by email.
Be Careful of Social Media Recovery Scams
A hacked account creates the perfect situation for a second scam.
After someone posts that their account has been compromised, scammers may contact them claiming to be “Instagram support,” “Facebook security,” “TikTok recovery,” or an independent hacker who can get the account back.
The scammer may ask for:
- Your password
- A two-factor authentication code
- A recovery code
- A screenshot of an authentication app
- Payment for guaranteed recovery
- Remote access to your computer
- Your email password
- A copy of sensitive identity documents
Do not give these people control of your accounts.
X explicitly warns users that it will not ask for their password through email, direct messages, or replies, and warns about fake login pages designed to steal credentials.
Use the platform’s official website or app instead of a link sent to you by someone claiming to be support. If you receive an unexpected security email, check where the link actually leads before entering any credentials.
How to Secure the Account After Recovery
Getting the account back is only half the job. You also need to close the route the attacker used.
Start with a completely new password that is not used on another website. A password manager can help you create and store unique passwords without requiring you to memorize each one.
Then enable two-factor authentication if the platform supports it. When several verification options are available, consider a passkey or authentication app rather than relying only on SMS, depending on what the service supports.
You should also:
- Review every active session and remove unfamiliar devices.
- Remove unknown third-party applications.
- Confirm the recovery email and phone number.
- Check two-factor authentication settings.
- Review recent posts, comments, messages, and profile changes.
- Remove unauthorized content.
- Warn contacts about scam messages that were sent from the account.
- Update the operating system and browser.
- Run a malware scan if you suspect the device was infected.
- Change reused passwords on other services.
Malware is particularly important to investigate if the attacker continues regaining access after you change your password. X lists malware, weak or reused passwords, malicious third-party applications, and compromised networks among possible causes of account compromise.
YouTube likewise recommends scanning devices for malware when protecting a compromised channel.
What to Do If Multiple Accounts Were Hacked
If several social media accounts were compromised around the same time, do not treat each incident as completely separate.
Look for a shared point of access.
For example, if Facebook, Instagram, and TikTok were all connected to the same email address and you clicked a suspicious login link shortly before the takeovers, the email account or your device may be the real problem.
Secure the primary email account first. Then change passwords for important services from a trusted device and enable stronger authentication.
If you downloaded an unfamiliar program, browser extension, or file shortly before the compromise, remove it only after preserving any evidence you may need, then run a reputable security scan. If you believe the device itself is compromised, recovering accounts from that device can expose the new credentials again.
Common Mistakes That Make Account Recovery Harder
One of the biggest mistakes is searching for unofficial customer-support phone numbers. Many social platforms do not offer ordinary telephone support for personal account recovery, and fake support numbers are frequently used to collect passwords or payments.
Another mistake is giving a recovery code to someone who contacts you. A one-time code can be enough to let an attacker complete a login or password reset. Treat authentication codes as confidential.
Do not repeatedly click password-reset links from messages you did not expect. Open the official platform directly and begin the recovery process there.
Finally, do not assume that recovering the password means the account is completely secure. Check sessions, connected applications, recovery information, and two-factor authentication before considering the incident resolved.
How to Prevent Another Social Media Account Hack
Good account security is mostly about reducing the number of ways an attacker can get in.
Use a different password for every important account. Protect your main email account especially carefully because it often controls password recovery for other services.
Enable two-factor authentication or passkeys where available. Keep your phone, computer, browser, and applications updated, and remove software or browser extensions you no longer trust.
Be cautious with messages that create urgency. Attackers commonly use fake copyright complaints, sponsorship offers, account warnings, verification requests, giveaway messages, and fake security alerts to persuade users to visit a fraudulent login page.
If a message tells you that your account will be deleted unless you log in immediately, do not use its link. Open the service yourself and check your account there.
For X, the company specifically recommends checking that you are on the legitimate X domain before entering your password and warns that phishing pages can be designed to look like the real login page.
Final Thoughts
Learning how to report a hacked social media account is important, but the recovery process should not stop at submitting a report. Secure the email account connected to the profile, use the platform’s official recovery channel, document the unauthorized changes, and never give passwords or verification codes to someone who promises to recover the account for you.
If you can still access the account, act immediately instead of waiting to see what the attacker does next. Change the password, remove unfamiliar sessions and applications, verify recovery information, and enable stronger authentication.
If you are locked out, use the official hacked-account recovery process for the specific platform. Facebook, Instagram, X, TikTok, and YouTube each have different recovery systems, and the available options can change depending on what information the attacker altered. The safest strategy is to follow the platform’s current official process rather than relying on outdated recovery tricks or unofficial support contacts.
If you think there’s been a mistake here, please do let us know by commenting on this post or Contact Us. And a member of our Content Integrity Team will review this decision with you.
