How did my social media account get hacked?

The most common ways social media accounts get compromised: phishing (you clicked a fake login link and entered your credentials on a fraudulent site), credential stuffing (hackers used your email and password from a previous data breach on your social accounts — if you reuse passwords, this is extremely common), malware on your device capturing login credentials, session hijacking through public WiFi, or weak/guessable passwords brute-forced. Check haveibeenpwned.com to see if your email has appeared in any known data breaches — this is often the root cause.

What should I do first if I think my account has been hacked?

Act immediately in this order: (1) Try to log in right now — if you still have access, change your password immediately using a strong, unique password. (2) Check and revoke suspicious third-party app access in your security settings. (3) Review active sessions and log out of all unknown devices. (4) Change the email address and phone number on the account if they've been changed by the attacker. (5) Enable two-factor authentication if it wasn't on. (6) Check your linked email account — attackers often compromise the email first to control password resets. (7) If you've lost access, use each platform's account recovery process immediately.

Can I recover a hacked social media account that I've been locked out of?

Recovery is possible but can take days to weeks depending on the platform and how thoroughly the attacker changed your information. Each major platform has a dedicated account recovery process: Instagram uses 'Get More Help' on the login screen; Facebook has 'Find and recover your account'; Twitter has a dedicated support form; TikTok has in-app account recovery. You'll typically need to verify your identity through your original email, phone number, or in some cases government ID. Recovery is faster if you still have access to the original email or phone number on the account. If the attacker changed these, prepare for a longer identity verification process.

How do I prevent my social media account from being hacked again?

The most effective protection stack: (1) Enable two-factor authentication using an authenticator app (not SMS) on every social account. (2) Use a unique, strong password for each account — a password manager makes this manageable. (3) Never click login links in emails or texts — always type the platform URL directly. (4) Regularly review and revoke third-party app access in your security settings. (5) Check active sessions monthly and log out of unrecognized devices. (6) Never log into social accounts on public computers. (7) Keep your linked email account highly secured — it's the master key to your social accounts.

Should I report a hacked social media account to police?

For most personal account hacks, a police report is rarely effective at recovering the account but can be useful in specific scenarios: if the attacker posted illegal content using your account (you want documentation you weren't responsible), if they've committed financial fraud or identity theft through the hack, or if you're being harassed or blackmailed. For identity theft involving financial accounts, report to the FTC at identitytheft.gov. For platform-level reporting, use each platform's built-in reporting tools, which are more effective than police for actual account recovery.

10 Signs Your Social Media Account Has Been Hacked (And What to Do)

My colleague came to me in a panic one morning — she'd woken up to dozens of direct messages from her Instagram followers asking about a "cryptocurrency opportunity" she'd apparently been promoting overnight. She hadn't sent any of those messages. While she slept, someone had accessed her account, DM'd her 800+ followers a crypto scam link, and changed her profile bio.

By the time she realized what happened, she'd already been locked out of her own account. The recovery process took 11 days.

Social media account compromises are happening at scale in 2025. Hackers target accounts not necessarily because of who you are personally, but because your followers are their audience for scams. An account with 2,000 followers is a ready-made audience for phishing links. An account with 50,000 followers is worth hundreds of dollars to hackers who sell account access.

Knowing the signs early — and knowing exactly what to do — can mean the difference between a 10-minute fix and an 11-day recovery nightmare.

10 Signs Your Account Has Been Compromised

1. You're Suddenly Logged Out

If you're unexpectedly logged out of an account you're normally auto-logged into, treat it as suspicious. Attackers often change passwords to lock out the original owner after gaining access. Don't wait — attempt recovery immediately.

Most social platforms send email or push notifications when someone logs in from a new device or location. An email saying "New sign-in from Moscow, Russia" when you're in Chicago means your credentials have been used elsewhere. Check your email and notification history now.

3. Posts, DMs, or Comments You Didn't Make

Friends messaging you about posts you didn't create, DMs you didn't send, or comments you didn't leave are major red flags. By this point the account is actively compromised.

4. Your Password Has Stopped Working

This is the clearest sign: the attacker has changed your password to lock you out. Go directly to account recovery — don't delay.

5. Your Email or Phone Number Has Changed

Check your profile settings. If the linked email or phone number has been changed to one you don't recognize, the attacker is trying to control your recovery options. This is an emergency — use the platform's identity verification recovery immediately.

6. Active Sessions From Unrecognized Devices

Every major social platform shows your active login sessions (Settings > Security > Active Sessions or similar). An iPhone in London when you own an Android in New York is not yours.

7. You're Sending "Verified Account" or Giveaway DMs

A common hack pattern: compromise the account, DM followers claiming "I've been verified and I'm giving away $500 to 10 followers." Your followers report it to you. By now the account has been used for fraud.

8. New Apps or Services Connected to Your Account

The third-party apps with access to your account (Settings > Apps or Connected Accounts) should only show services you personally authorized. Unknown apps are potential data access backdoors.

9. Follower/Following Count Anomalies

Following thousands of accounts overnight, sudden large drops in followers, or new followers that are all fake-looking profiles — all indicate automated activity not initiated by you.

10. Friends Report Receiving Phishing Links From You

If someone tells you "you just sent me a suspicious link," the compromise has been going on long enough to reach your contacts. This is a critical emergency — act immediately.

Signs and Severity Table

Sign	Severity	How Long You May Have	Immediate Action
Unrecognized login notification	High	Hours to days	Change password immediately
Locked out (password not working)	Critical	Happening now	Go to account recovery
Email/phone changed on account	Critical	Happening now	Identity verification recovery
Unauthorized posts/DMs visible	High	Hours	Change password + revoke app access
Unknown active sessions	Medium-High	Days	Log out all devices, change password
Unknown apps connected	Medium	Weeks	Revoke all unknown app access
Friends report suspicious DMs	Critical	Happening now	Change password + notify followers
Profile bio/photo changed	High	Recent	Change password, review security
New followers (thousands overnight)	Medium	Days	Audit app access, check sessions
You can still log in (but suspicious)	Medium	Days	Secure account now, don't wait

Recovery Steps by Platform

Instagram

If you still have access:

Settings > Account Center > Password and Security > Change Password
Settings > Apps and Websites — revoke unknown apps
Settings > Account Center > Password and Security > Where You're Logged In — log out unknown sessions
Turn on two-factor authentication (use an authenticator app, not SMS)

If you're locked out:

Instagram login screen > Get more help
Select "I can't access this email or phone number"
Use video selfie verification (Instagram's identity verification)
If that fails, contact Instagram through their Help Center with your account details and proof of ownership

Facebook

If you still have access:

Settings > Security and Login > Change Password
Settings > Security and Login > Where You're Logged In — End all unknown sessions
Settings > Apps and Websites — Remove unknown apps
Settings > Security and Login > Use two-factor authentication

If you're locked out:

facebook.com/hacked — Facebook's dedicated compromised account portal
"Find and recover your account" using any trusted contacts you set up
Use "Trusted Contacts" if you previously set them up
Submit government ID verification as a last resort

Twitter (X)

If you still have access:

Settings > Security and account access > Security > Change Password
Settings > Security and account access > Apps and sessions > Log out all other sessions
Settings > Security and account access > Connected apps — Revoke unknown access
Enable two-factor authentication (use authenticator app)

If you're locked out:

Visit x.com/account/begin_password_reset using original email
If email was changed, submit a support ticket at help.twitter.com
Provide proof of account ownership (original email, phone number, account creation date)

TikTok

If you still have access:

Profile > Three lines > Settings > Security > Change Password
Profile > Three lines > Settings > Security > Manage devices — remove unknown devices
Enable two-factor authentication under Security settings

If you're locked out:

TikTok login screen > Forgot Password
Use "More ways to log in" if email/phone was changed
In-app support ticket: submit through TikTok's Help Center with account details
If all else fails, report through TikTok's web-based support at support.tiktok.com

After Recovery: Hardening Your Accounts

Once you've regained access, these steps prevent the same thing from happening again:

Enable two-factor authentication on every social account. An authenticator app (Google Authenticator, Authy) is far more secure than SMS-based 2FA. With 2FA enabled, someone with your password still can't log in without your physical device. Read our comprehensive two-factor authentication guide to set this up properly.

Use a unique password for every account. The most common attack method is credential stuffing — using credentials from one data breach to access other accounts. If your LinkedIn password and Instagram password are the same, a LinkedIn breach means an Instagram breach. A password manager (Bitwarden, 1Password) generates and stores unique passwords for every site.

Review third-party app access quarterly. Every app you've ever authorized "Login with Facebook/Google/Instagram" has some level of access to your account. Revoke anything you don't actively use.

Set up recovery options now, before you need them. Having a recovery email and trusted contacts set up before an emergency dramatically speeds up recovery if it ever happens.

Monitor haveibeenpwned.com. This free service checks whether your email has appeared in known data breaches. Enable notifications so you know immediately when your credentials are exposed.

For a comprehensive approach to protecting your online accounts, see our digital privacy guide and our guide to two-factor authentication. External resource: Google's Safety Center provides account security tools. Find more online safety guides at /category/skills-career/.

Conclusion

Account compromise moves fast. The difference between a minor inconvenience and a major incident is almost always how quickly you detect and respond. The attacker who got into my colleague's Instagram ran their scam for seven hours before she noticed — seven hours of her followers receiving fraudulent messages in her name.

Know the 10 signs. Check your active sessions monthly. Enable two-factor authentication today — right now, before you finish reading this. Use unique passwords via a password manager.

These aren't suggestions — they're basic account hygiene in 2025. The question isn't whether someone will try to compromise your accounts; it's whether your security setup makes it too difficult to be worth their effort.

Access our security checklists and account recovery resources on the /notes page.

10 Signs Your Social Media Account Has Been Hacked (And What to Do)