How to Tell if Your Account Was Hacked

The fastest way to confirm a hack is to open your account's own security log and look for sign-ins you did not make. Every major service keeps one: Google at myaccount.google.com/security under "Your devices," Microsoft at account.microsoft.com/security under "Sign-in activity," Apple in Settings > [your name] on an iPhone, and Instagram under Settings > Accounts Center > Password and security > Where you're logged in. If a device or city you do not recognize appears there, you have your answer without guessing.

The warning signs, ranked by how reliable they are#

Not all "signs" carry equal weight. Some are near-proof; others just warrant a look. Treat them in that order so you do not panic over the weak ones or ignore the strong ones.

Strong signals (act now):

• A device, browser, or geographic location in your login history that is not yours
• You are locked out despite entering a password you know is correct
• Your recovery email or phone number was changed without you doing it
• An email forwarding rule or inbox filter exists that you never created
• Two-factor authentication (2FA) was switched off, or a new authenticator was added

Softer signals (investigate, do not panic):

• Contacts report messages or posts from you that you never sent
• A password-reset or "new sign-in" email you did not request
• Your profile photo, display name, or bio changed on its own
• Charges, transfers, or subscriptions you do not recognize

Here is the nuance most guides skip: a single "new sign-in" or "reset your password" email is often the attacker being blocked, not succeeding. Services send those precisely when 2FA or a suspicious-login check stops someone. So one alert is a prompt to check your login log, not automatic proof you are compromised. Repeated resets you did not trigger, however, mean someone knows your password and is hammering the recovery flow.

Watch for the SIM-swap tell#

If your phone suddenly drops to "No Service" or "SOS only" in a place with normal coverage, and it does not come back after a reboot, suspect a SIM swap. Attackers port your number to their SIM to intercept SMS one-time codes, which is exactly why SMS-based 2FA is the weakest form. Call your carrier immediately from another phone.

Check your email account first, and check it properly#

Email is the master key. Almost every other service sends password resets there, so an attacker who owns your inbox owns everything downstream. "Checking" it means more than glancing at your inbox.

In Gmail, open Settings (gear) > See all settings > Forwarding and POP/IMAP and confirm no forwarding address was added. Then open Filters and Blocked Addresses and look for any filter that auto-forwards, deletes, or marks-as-read incoming mail. This is the single most common piece of persistence attackers leave behind: a filter that quietly forwards password-reset emails to them and deletes the copy before you see it, so they keep control even after you change your password. Also click Details at the very bottom-right of the Gmail inbox to see the "last account activity" table with IP addresses and access types.

In Outlook.com, check Settings > Mail > Forwarding and Rules for the same thing. Delete anything you did not set up.

What to do right away, in order#

The sequence matters. Doing these out of order lets an attacker back in through a door you left open.

1. Change the password to something long and unique you have never used elsewhere. Length beats complexity: a 16-plus character passphrase resists brute force far better than "P@ss1!". Generate it in a password manager.
2. Revoke active sessions. This is the step almost everyone forgets. Changing a password does not automatically log out sessions already signed in, because those run on separate session tokens. Use the service's "Sign out of all devices" or "Log out everywhere" button. Google, Instagram, Facebook, and Microsoft all have one on their security page. Without this, the attacker's existing session stays live.
3. Turn on or upgrade 2FA. Prefer an authenticator app (TOTP codes from Google Authenticator, Authy, or Microsoft Authenticator) or, better, a passkey or hardware security key using the FIDO2/WebAuthn standard, such as a YubiKey. Avoid SMS if a stronger option exists.
4. Reset your recovery email and phone, and confirm they still point to you. Attackers change these to seize the account back later.
5. Revoke third-party app access. In Google, go to Security > "Your connected apps and services" and remove anything unfamiliar. A malicious OAuth token can read your mail without ever needing your password.

If you cannot log in at all, use the service's official account-recovery page directly. Type the address yourself or use a bookmark. Never click the recovery link inside a suspicious email, because that email may be the phishing lure that started this.

Contain the spread#

Once the breached account is locked down, assume the credentials leaked further.

If you reused that password anywhere, change it on every one of those accounts. Credential-stuffing attacks take one leaked email-and-password pair and replay it automatically across hundreds of sites, so reuse turns one breach into ten. Check where you are exposed at haveibeenpwned.com, a free, reputable service run by security researcher Troy Hunt that tells you which known data breaches include your email. Google's built-in Password Checkup at passwords.google.com flags saved passwords that are reused, weak, or known-breached.

Tell contacts who received strange messages not to click anything, watch your bank and card statements for the next few weeks, and if money moved, call your bank on the number printed on your card, not a number from any email or text.

The mistakes that let attackers back in#

• Changing the password but not revoking sessions. The old session token keeps working. Always "log out everywhere."
• Ignoring inbox forwarding rules and filters. The password is fresh, but a filter is still shipping your reset emails to the attacker.
• Trusting SMS 2FA on a high-value account that is exposed to SIM swapping. Move banking and email to an app or hardware key.
• Clicking the link in the "suspicious login" alert. If the alert is genuine, you can reach the same page by navigating to the site yourself. If it is fake, you just handed over your credentials.
• Reusing a "new" password that is a small tweak of the old one. Attackers try obvious variations first.

Frequently asked questions#

Does changing my password log hackers out?#

Not on its own. Your new password stops future logins, but any session the attacker already has keeps running on its existing token until it expires. You must explicitly use "sign out of all devices" (or revoke sessions) on the account's security page to end active intrusions immediately.

Is SMS two-factor authentication safe enough?#

It is far better than no 2FA, but it is the weakest common method because codes can be intercepted through SIM swapping or malware. For your email, bank, and primary logins, upgrade to an authenticator app (TOTP) or a passkey or hardware key using FIDO2/WebAuthn, and keep SMS only as a last-resort backup.

How do I know if it was really me or an attacker in the login history?#

Compare the listed device, browser, IP location, and time against your own activity. A login from a city you have never visited, a browser or operating system you do not use, or a time you were asleep is a red flag. Remember that VPNs and mobile carriers can make your own legitimate location look off, so use it as one clue among several.

Should I report a hacked account, and to whom?#

Yes for anything serious. Report the account through the provider's official recovery and "report a hacked account" flow, contact your bank directly if money was involved, and report fraud or identity theft to the relevant authority in your country, such as the FTC in the United States or Action Fraud in the UK. This article is general guidance, not professional security or legal advice for your specific situation.