How to Recover a Hacked Account: Gmail, Instagram, and Everything Else, in Order

How to recover a hacked account, in the right order

Finding out an account has been hacked is a horrible feeling, and the instinct is to panic-click everything. Do not. Recovery is a sequence, and the order matters: secure your email first, then work outward to the hacked account, then lock everything down so it does not happen again. Most recovery attempts fail because people start in the wrong place.

The single most important fact: your email is the master key. Most platforms send password resets to your email, so if an attacker controls your inbox, they can intercept every reset you request and lock you out forever. Recover the email account first, even if the hacked account is the one you care about most.

Step 1: take back your email

Go to your email provider's official recovery page from a device you trust, not the one you suspect is compromised. For Gmail, that is g.co/recover. Google's flow asks for the last password you remember, then sends a code to a recovery email or phone if those are still under your control. It may also ask about the account creation date and places you usually sign in from. Answer as accurately as you can, and do not hammer the form: repeated failed attempts can lock the recovery process for 24 hours.

Once you are back in, change the password immediately, sign out of all other sessions, and check the settings an attacker would have touched: forwarding rules that send your mail to an unknown address, recovery email and phone numbers, and app passwords you did not create. A forwarding rule to an attacker's inbox is the classic trick, and it survives a password change if you do not delete it. Turn on two-factor authentication with an authenticator app, not just SMS, and review recent login activity for sessions you do not recognize.

Step 2: use the platform's official hacked-account flow

With your email secured, go to the platform's own recovery page, and only the official one. For Instagram, that is instagram.com/hacked. For Facebook, facebook.com/hacked. For Gmail, the recovery page again. Never pay a third-party service that promises to recover your account: they are usually scams, and the ones that are not scams will ask for credentials that give them the keys to everything.

On Instagram, pick the option that says you cannot access the email or phone number, give a new email address you control, and follow the identity check sent to that address. Instagram may ask for a video selfie, where you record a short clip turning your head, and a reviewer compares it with your photos. That can take up to two business days, and Meta says it deletes the video within 30 days. If the attacker changed your email, look for the change-alert email from [email protected]: it includes a link to undo the change.

For Facebook, the automated flow at facebook.com/login/identify lets you use an alternate email or phone to receive a login code. There is also a Trusted Contacts option, where three to five friends you chose in advance receive recovery codes. If you have not set up Trusted Contacts, do it after you recover, not during the crisis.

Step 3: clean up, warn people, and check the damage

Once you are back inside an account, change the password immediately and enable two-factor authentication. Then log out of all other sessions and revoke third-party apps you do not recognize. On Instagram, that means removing shady analytics or follower apps that probably harvested your login in the first place. Delete any spam posts the attacker made, and post a brief note telling your followers the account was compromised, so nobody falls for the crypto scheme or fake giveaway the attacker posted in your name.

Then check the blast radius. If you reused the same password, or a small variation of it, on other accounts, change those too, starting with anything tied to money: your bank, your payment apps, and any shopping accounts with saved cards. If the attacker solicited money from your contacts, tell them directly and immediately. Our guide on how to check if your data was in a breach can tell you whether your credentials were exposed elsewhere, and what to do after a data breach is a calm checklist for the aftermath.

Step 4: make it much harder next time

Recovery is miserable, so the real win is never needing it again. Start with a password manager and give every account its own unique, random password. Our guide to setting up a password manager walks through it in plain language. Then turn on two-factor authentication everywhere, with an authenticator app or a passkey where the platform supports it. Our passkeys guide explains why passkeys beat passwords and how to set them up.

A few habits matter more than any tool. Check your email forwarding rules and recovery details every few months. Do not click password-reset links in emails you did not request; go to the site directly instead, and read our guide on how to spot a phishing email if you are unsure what a fake one looks like. And remember that Meta says it has no general public phone number for customer service: any number claiming to be Meta support is a scam.

Most hacked accounts can be recovered if you act fast and in the right order. The window is usually measured in days, not hours, but the first day matters most. Secure the email, use the official recovery flow, clean up the damage, then harden everything. It is a bad afternoon of work, but it is the difference between losing an account and losing your identity to someone else.