If someone takes over your Instagram, TikTok, Facebook, X, or YouTube account, act in a fixed order: secure the linked email first, stop unauthorized sessions, restore changed contact details, use the platform’s official recovery route, preserve evidence, and warn your audience. This guide provides a repeatable account-takeover workflow for creators, influencers, publishers, and anyone whose online identity or community could be misused.
Overview
A hacked social media account can be more than an inconvenience. An intruder may change the password, replace the recovery email, publish fraudulent posts, send scam messages, access private conversations, or use your audience to spread malicious links. Speed matters, but rushing into an unverified “support” conversation can make the situation worse.
Begin with accounts you still control. Do not click recovery links sent through unexpected direct messages, comments, or emails. Instead, open the platform’s official app or type its known website address yourself. Platform menus and recovery forms change, so confirm the current route through the platform’s official help center or account-security page before entering information.
Use this order:
- Secure the email account and phone number connected to the social account.
- Record what happened, including alerts, changed details, posts, and timestamps.
- End unfamiliar sessions and change passwords from a trusted device.
- Reverse changed contact details through the platform’s official recovery flow.
- Warn followers through a channel you still control.
- Review access, connected apps, multi-factor authentication, and recovery options after restoration.
What to track
Warning signs of an account takeover
Common indicators include a password that no longer works, an unexpected password-reset notification, a new login alert from an unfamiliar device or location, changed email or phone details, posts you did not publish, new direct messages, unfamiliar linked apps, or followers reporting suspicious activity from your profile. A sudden loss of access is not proof of one specific attack method, so focus on documenting observable changes rather than guessing who is responsible.
Secure the linked email first
Your email account may be the recovery key for multiple profiles. Change its password from a trusted device, sign out unfamiliar sessions, check forwarding rules and filters, remove unknown recovery addresses or phone numbers, and turn on multi-factor authentication or a passkey where available. Review recent security activity and look for messages indicating that a social platform’s email, password, or phone number was changed.
If your phone number may be at risk, contact your mobile provider through an official channel and ask what account protections are available. Avoid sharing one-time codes with anyone who claims to be helping you. Genuine support processes should not require you to disclose a login code to a stranger.
Preserve evidence before deleting anything
Save screenshots of login alerts, changed profile details, suspicious posts, direct messages, payment requests, recovery emails, and support correspondence. Record the account username, profile URL, approximate time access was lost, the last password change you remember, and any case or ticket number. If content is harmful or fraudulent, capture the full context, including the visible username and destination link, without forwarding the scam.
Use the official recovery path
Recovery requirements vary by platform and may depend on whether you still control the original email, phone number, or device. Start from the platform’s official login screen or help center, select the option for a compromised or hacked account, and follow the requested verification steps. Do not pay a person who promises guaranteed restoration, and be cautious of accounts using terms such as “security team” in their username.
| Platform | Official recovery approach | After access is restored |
|---|---|---|
| Use the official login help or hacked-account flow from the app or Instagram’s Help Center. Check whether a security email allows you to reverse a recent change. | Review login activity, contact details, connected apps, two-factor authentication, and impersonation reports if needed. | |
| TikTok | Use the official account-recovery and report-a-problem options in the app or TikTok Help Center. Provide the requested account and ownership details. | Change the password, review devices and security settings, remove unfamiliar connections, and inspect recent messages and posts. |
| Use Facebook’s official hacked-account recovery flow from the login page or Help Center. Follow identity and account-ownership prompts carefully. | Check active sessions, email and phone settings, page or business access, advertising activity, and recent posts. | |
| X | Use the official account-access and compromised-account support forms. State what changed and provide the account handle and reachable contact information. | Review active sessions, connected apps, login verification, recovery details, and unauthorized posts or direct messages. |
| YouTube | Begin with the official Google Account recovery and YouTube hacked-channel support routes. Secure the underlying Google Account before focusing on the channel. | Review channel permissions, brand or manager access, uploads, livestreams, monetization-related settings, and security alerts. |
These routes and requirements can change. Treat the table as a starting point, not a substitute for the platform’s current instructions. For broader account protection after a breach, see How to Read a Data Breach Notice and Protect Your Accounts.
Printable incident-response checklist
- Account platform and username: ____________________________________
- Profile URL: _______________________________________________________
- Time access was first noticed as lost: _______________________________
- Last known legitimate login: ________________________________________
- Linked email secured? Yes / No Time: ______________________________
- Linked phone reviewed? Yes / No Time: ______________________________
- Unknown sessions ended? Yes / No Time: _____________________________
- Changed email or phone reversed? Yes / No Time: _____________________
- Official recovery form used: ________________________________________
- Case or ticket number: ______________________________________________
- Evidence saved to a secure location? Yes / No
- Followers warned through a trusted channel? Yes / No
- Password changed after restoration? Yes / No
- Multi-factor authentication or passkey enabled? Yes / No
- Recovery codes stored safely? Yes / No
- Connected apps and account permissions reviewed? Yes / No
Cadence and checkpoints
Account recovery is an incident process, but account security should be maintained on a schedule. During an active takeover, check the linked email, platform alerts, recovery messages, and support case at reasonable intervals without repeatedly submitting conflicting forms. Keep one record of every action so you can give support a consistent timeline.
After restoration, perform a full security review immediately. Then schedule a monthly check for creators and publishers who manage valuable audiences, brand partnerships, payment features, or multiple administrators. A quarterly review may be sufficient for lower-risk personal accounts. At each checkpoint:
- Review recent login activity and remove devices you do not recognize.
- Confirm the recovery email and phone number are current.
- Test that multi-factor authentication or a passkey is available to the rightful owner.
- Regenerate or safely store recovery codes if they may have been exposed.
- Review connected apps, browser extensions, page roles, channel permissions, and business managers.
- Check for unusual posts, messages, payment requests, or changes to profile information.
- Confirm that backup administrators use separate, protected accounts.
Creators can also use a recurring review alongside a broader social media privacy checkup, especially after a post receives unusual attention or is shared beyond its normal audience.
How to interpret changes
Not every unfamiliar login means an account was hacked. A new device, travel, a shared connection, or a privacy tool can produce an unexpected location. Treat an alert as a prompt to verify rather than as proof. Risk becomes more urgent when several signals appear together: the password fails, recovery details changed, unfamiliar posts were published, and security notifications arrive close together.
If only a suspicious message or post appears, secure the account before investigating the content. If the email account is also compromised, prioritize it because resetting the social password alone may not stop the intruder from regaining access. If payment information, private data, or identity documents may have been exposed, document the incident and contact the relevant provider through an official route.
Warn followers with a short, factual notice: state that the account was compromised, identify the approximate period, tell them not to click recent links or send money, and say where legitimate updates will appear. Do not amplify the malicious post by repeatedly quoting its link. For guidance on handling suspicious viral claims, see How to Verify a Viral Story Before Sharing It and the social media scam warning guide.
When to revisit
Revisit this guide immediately after a suspicious login alert, unexpected password reset, missing post, unusual direct message, or sudden change to your profile. Review it after a data-breach notice, a new device purchase, a change in staff or collaborators, or a viral post that brings unfamiliar attention to your account.
Editors should verify platform recovery links, support requirements, passkey and multi-factor authentication options, session-management controls, and impersonation-reporting instructions at least quarterly and after major platform security changes. Mark the review date in the article workflow so outdated instructions are not left in circulation.
For creators, the practical next step is to complete the checklist before an incident occurs. Record the official recovery pages, secure a separate email account for critical work, protect every administrator account, and tell your team never to share authentication codes. A small recurring review can limit the reach of a takeover and make recovery less dependent on memory during a stressful event.
