Account hacked? Where official guidance says to start

If someone else has got into your email, social media, shopping or other online account, official guidance starts with the account provider’s own recovery steps, done on a device you trust, and a call to your bank right away if money or card details are involved. It can feel urgent and confusing, so this page summarises what to do if your account is hacked, according to official guidance: the signs, the recovery steps and where to report. CyberThreats.au can’t recover accounts, take reports or assess your situation. The Australian Cyber Security Centre (ACSC), Scamwatch, IDCARE and the platform that runs your account can.

Signs an account has been taken over

The ACSC lists these signs that an online account may be compromised:

• changes you didn’t make, such as purchases you don’t remember or unfamiliar “recently watched” items
• an unexpected password reset notification
• being logged out on all devices, or being unable to log in with the correct details
• other people reporting suspicious messages, comments or activity from your account
• a last login time, location or device that looks wrong
• an alert from the account provider about suspicious activity.

The ACSC notes that login details that have leaked count as compromised, even if nothing suspicious has happened yet. Our data breach guide explains how to check whether you were affected by a breach.

For email specifically, the ACSC’s email compromise guidance points to logins at unusual times or places, forwarding rules or connected apps you don’t recognise, and contacts receiving unusual requests, such as changed bank details or odd links.

Before starting: use a device you trust

The ACSC notes that some malware steals login details, and says to follow recovery steps on a device you know is free from malware, or the account may be compromised again. If files can’t be opened or a ransom note appears, the ACSC says ransomware may be involved and points to its ransomware guidance. See how ransomware works.

If your email account was hacked

The ACSC explains that email is valuable to criminals because it can be used to impersonate you, spread scams and reset the passwords of other accounts. Scamwatch’s phishing guidance, for people who think they’ve been scammed, says to change passwords on devices and online accounts “like banking, email, government and shopping”.

What the ACSC says to do for a hacked email account

The ACSC’s guidance “My email has been compromised. What should I do?” lists these steps, and says to complete as many as possible:

1. Change the password or passphrase.
2. Update account recovery details, because attackers may change them to keep a way back in.
3. Sign out of all other sessions. The ACSC says this “will remove the cybercriminal’s access to your emails.”
4. Turn on multi-factor authentication, which the ACSC calls “the most important defence against cybercriminals.” Our accounts guide shows how to turn on multi-factor authentication for Google, Microsoft and Apple accounts.
5. Check mail settings and delete any forwarding rules you don’t recognise.
6. Check third-party app access and remove anything unfamiliar.
7. Review login activity regularly.
8. Check sent and deleted items, devices and other accounts to see what the attacker did.

The ACSC also describes warning customers, colleagues and suppliers so they can ignore fraudulent emails sent in your name. For Microsoft 365 work accounts, see responding to a compromised Microsoft 365 account and suspicious inbox rules.

If a social media, shopping or other account was hacked

For social media, shopping, streaming and similar accounts, the ACSC’s guidance says to follow the account provider’s own advice first, and to check the provider’s website for what to do if an account is compromised. If you can’t log in, the ACSC describes searching for the recovery options the provider offers, and, if the account can’t be recovered, telling the provider it’s compromised and that you no longer have access.

The ACSC then lists these steps:

1. Change the password by logging in directly to the platform, not through emailed or messaged reset links, which the ACSC says cybercriminals often fake. It notes that recovery options can take several days.
2. Check recovery options and remove any you don’t recognise, since attackers sometimes add their own.
3. Log out of all devices from the account’s security settings, if available.
4. Turn on multi-factor authentication if offered, and remove methods you don’t recognise.
5. Check other accounts, prioritising finance, email, business and cloud storage, including any that share the same password or use a “sign in with” option linked to the hacked account.
6. Note suspicious activity, such as purchases or scam messages sent from your profile.
7. Tell affected contacts that messages were sent in your name.
8. Work out how it happened. If unsure, the ACSC says malware may have stolen the login and points to its malware guidance. Our phishing guide explains how phishing messages are used to steal logins.
9. Record the incident: what happened, when, likely causes and what you did.

The ACSC’s general hacking guidance also describes disconnecting from the internet, scanning for viruses, changing passwords and passphrases, and alerting your social network to watch for strange links or attachments.

See also plan your account recovery and how to secure your online accounts.

Common questions

What do I do if my account has been hacked?

The ACSC says to follow the account provider’s own advice first, and to work on a device you know is free from malware. Its steps include changing the password by going directly to the platform, checking recovery options, logging out of all devices and turning on multi-factor authentication. If the account stores card details or can spend money, the ACSC says to call your bank right away. The full list is under If a social media, shopping or other account was hacked.

How do I know if someone has hacked my account?

The ACSC lists signs such as changes you didn’t make, an unexpected password reset notification, being logged out or unable to log in with the correct details, and other people reporting suspicious messages from your account. A last login time, location or device that looks wrong, or an alert from the provider, can also be a sign. See Signs an account has been taken over.

How do I get my hacked email account back?

The ACSC’s email compromise guidance lists steps and says to complete as many as possible: change the password, update recovery details, sign out of all other sessions and turn on multi-factor authentication. It also describes deleting forwarding rules and removing third-party apps you don’t recognise. The full list is under What the ACSC says to do for a hacked email account.

Can I use the password reset link in an email or text?

The ACSC describes changing the password by logging in directly to the platform instead, because it says cybercriminals often fake emailed or messaged reset links. It also notes that recovery options can take several days, and that attackers sometimes add their own recovery details. See the steps for social media, shopping and other accounts.

Where do I report a hacked account in Australia?

The ACSC says to report the incident through ReportCyber at cyber.gov.au, and directly to the account provider. It points to Scamwatch if a scam was used to get into the account or the account was used to scam others, and to IDCARE on 1800 595 160 if identity theft is a concern. See Where official guidance says to report it.

Should I accept an offer to help recover money I lost?

The ACSC warns against accepting offers from third parties to recover lost money, because it says this is a common scam tactic. The official channels in this guide are your bank, ReportCyber and IDCARE, a free identity and cyber support service. Our guide to money recovery scams explains how these offers work.

Where official guidance says to report it

• ReportCyber. The ACSC says to use ReportCyber, at cyber.gov.au, to report the incident to the ACSC and the relevant police jurisdiction. Its email guidance says to keep the report reference number.
• Scamwatch. The ACSC says to report to Scamwatch if a scam was used to access your account or your account was used to scam others. Scamwatch says reports help it stop scammers and warn others.
• The account provider. The ACSC says to report the incident directly to the provider.
• Your bank. The ACSC says to contact your bank or financial institution if the account holds card details or can spend money. If you’re unsatisfied with the bank’s response, the ACSC notes the Australian Financial Complaints Authority (AFCA) offers free advice.
• IDCARE. The ACSC’s email guidance points to IDCARE on 1800 595 160 if identity theft is a concern or personal information is at risk. IDCARE describes itself as providing assistance with identity theft, cyber incidents and data breaches. See how identity theft works.
• Australian Cyber Security Hotline. The ACSC lists 1300 CYBER1 (1300 292 371), staffed 24 hours a day, 7 days a week.

Watch for recovery offers

The ACSC warns against accepting offers from third parties to recover lost money, because this is a common scam tactic. See money recovery scams.

For a directory of every official service, see where to report scams and cybercrime in Australia.