If you are hacked: step-by-step recovery and reporting

Getting hacked feels personal and frightening, but recovery follows a clear order. Work through it calmly: regain control, lock the doors, check for damage, then report. This lesson focuses on accounts; for lost money, see the Scams and Fraud module (sc-08).

Watch the 1-minute overview

Watch the full video guide for this module

Signs that an account has been taken over

• You cannot log in, or your security settings have changed (NCSC).
• Your account has sent messages, posts or notifications you do not recognise (NCSC).
• You see logins or login attempts from unfamiliar places or at odd times (NCSC).
• Money has left your accounts, or purchases have been made, that you did not make (NCSC).
• Friends message you to ask about something strange 'you' sent them.

First hour: get back in and lock the doors

• If you cannot sign in, use the service's official account recovery process, found on its help pages (NCSC). For Google, go to the account recovery page and answer the questions as best you can (Google).
• Check your email for forwarding rules and filters you did not set, and remove them. The NCSC says criminals often set up a rule that copies every incoming email to them, which lets them reset your passwords.
• In Gmail, Google also says to check for unfamiliar automatic forwarding, filters and remote access through IMAP or POP.
• Change the password on the hacked account, then on any other account that used the same password (NCSC).
• Log out all other devices and sessions from the account's settings, so the new password is needed everywhere (NCSC).

Same day: close the back doors

• Review recent security events and your list of signed-in devices, and remove any you do not recognise (Google).
• Check which third-party apps have access to your account and remove any you do not recognise (Google).
• Turn on 2-step verification, ideally a passkey or authenticator app (lesson cy-03), so a stolen password alone is not enough (NCSC).
• Update your devices and apps, at home on a reliable connection with the device plugged in (NCSC).
• Tell your friends and followers the account was hacked and ask them to treat recent messages from it with suspicion (NCSC).

Check for knock-on damage

• A compromised email account can lead to others being compromised, so check bank and shopping accounts for unusual transactions (NCSC).
• Contact your bank through official channels, never through links in messages (NCSC).
• If your phone suddenly lost signal before the hack, contact your mobile provider at once, as this can be a sign of a SIM swap (see sc-07). The FBI advises checking for unknown devices linked to your accounts (BleepingComputer).
• If a device with passkeys was lost or stolen, remove those passkeys from your accounts (Google).
• Tell a parent or trusted adult. If the hacker is threatening you or demanding anything, follow the blackmail steps in lesson cy-06.

Reporting in the UAE and abroad

• The UAE Government portal lists these channels: the Ministry of Interior's eCrimes platform in the MOI UAE app, Dubai Police's eCrime website, Abu Dhabi Police's Aman service, the My Safe Society app, your nearest police station, or 999.
• The Ministry of Interior's platform is in the MOI UAE app and on moi.gov.ae, and Dubai Police's eCrime platform is at ecrimehub.gov.ae (Gulf News, July 2025). Emirates 24|7 (October 2026) reports that the eCrime Hub lets you report 24/7 and upload evidence.
• The UAE Government portal says victims of electronic fraud should not give in to threats and should report the incident to official authorities immediately.
• Before reporting, gather screenshots of suspicious messages, login alerts and changed settings, with dates and times.
• If you study abroad, report locally. In the UK, for example, the NCSC points people who have lost money to Report Fraud at reportfraud.police.uk.

If you cannot get the account back

• Create a new account if you want to keep using the service (NCSC).
• Tell your contacts your new details and that you have abandoned the old account (NCSC).
• Update any bank, utility and shopping accounts that used the old details (NCSC).
• Report the old account to the platform as compromised, so it can be locked or removed.