What to Do in the First 30 Minutes After an Online Account Is Hacked

First 30 minutes: work through this checklist

1. Use a trusted device. If you think a laptop or phone may contain malware, stop using it to change passwords or access banking. Use a different device you trust, with current updates and security software. If you only suspect an account password was exposed, a trusted personal device may be sufficient. Avoid public computers and shared devices.
2. Secure your primary email account first. Email is often the reset route for other accounts. Change its password from the trusted device, and check that the recovery email address and phone number are yours. If you have lost access, use the provider’s official account recovery page reached by typing its address yourself.
3. Change the compromised password. Set a new, unique password for the affected account. If the old password was used elsewhere, change it on those accounts too, starting with email, banking, cloud storage and work systems. A reputable password manager can help you create and store different passwords.
4. Sign out other sessions. Look in the account’s security or device settings for active sessions, remembered devices or recent sign-ins. Sign out sessions you do not recognise, and remove devices you no longer use. Some services offer a button to sign out everywhere; use it if you are unsure which session is yours.
5. Enable or reset multi-factor authentication. Turn on multi-factor authentication (MFA) if it is available. If MFA was already enabled, check that the attacker has not added their own method or changed your settings. Remove unknown authenticator apps, phone numbers, security keys or backup codes, then set up your own method again.
6. Check recovery details and account activity. Review recovery email addresses, phone numbers, trusted contacts, security questions, profile details and recent activity. Remove anything you did not add. Check for unfamiliar logins, sent messages, deleted items, new users or changed permissions. Take screenshots or notes before changing settings when it is safe to do so.
7. Remove forwarding rules and unknown app access. For email, inspect inbox rules, forwarding addresses, filters and delegated access. Attackers may use these to quietly receive messages or hide alerts. Review connected apps and website permissions too. Revoke access you do not recognise, but avoid removing a legitimate work integration until you know what it is.
8. Preserve evidence. Keep security alerts, unusual messages, payment requests, account notifications and suspicious file names. Save screenshots with dates and times, and write down what happened and what you changed. Do not forward suspicious attachments to other people. Evidence may help a provider, bank, employer or incident responder understand the event.
9. Contact banks or providers if money or payment details are involved. If bank details, payment cards, invoices or financial accounts may be exposed, contact your bank using the number on your card or its official website. Ask what protective steps are appropriate. Tell relevant online services and, for a business account, your IT support or security provider. Use known contact details, not numbers in an unexpected message.

Do not do these things

• Do not reuse the new password. A password changed on one service should not be used on another account.
• Do not delete evidence in a rush. Preserve alerts, messages and screenshots before removing suspicious content, when it is safe.
• Do not pay an unknown recovery service. Be cautious of unsolicited messages promising guaranteed recovery, asking for cryptocurrency, or requesting your password or one-time codes. Use the provider’s official recovery process.
• Do not keep using a device that may be infected. Disconnect it from networks if you suspect active malware and get advice before using it to access sensitive accounts.

When is professional help appropriate?

Get help from the relevant provider, your organisation’s IT support or a reputable incident response professional if you cannot regain control, the attacker keeps returning, several accounts are affected, or a work system, customer data or shared files may be involved. Contact your bank promptly if financial details or transactions are at risk. For a business, tell the person responsible for security and follow your incident reporting process.

When choosing help, use contact details you find independently, ask what the service will do, and do not share passwords or authentication codes. A legitimate technician should explain the steps and obtain your agreement before making changes. Account recovery may depend on the platform, device and type of access involved, so no provider can responsibly promise a guaranteed outcome before understanding the incident.

After the immediate response

Once you have secured the account, check other services that used the same password or email address. Review important accounts again over the next few days for unfamiliar sign-ins, messages, rules or recovery changes. Keep a short record of actions taken, dates and provider case numbers. If this is a workplace account, coordinate further changes with your IT team so that evidence and business access are handled consistently.

About this guide

Been Hacked Fix is a cyber-recovery information and support-routing service operated by IT LifeRaft.

Editorial disclaimer: This page provides general information only. It is not a substitute for advice tailored to a live cyber incident, and it cannot confirm whether a device or account is safe. Follow instructions from your bank, account provider, employer or qualified incident responder where they apply to your circumstances.