My email or social account was hacked

Your email is the key to your other accounts, because it's where password resets go. Get it back first, then lock it down.

Sign in and change the password, if you still can. Do it from a device you trust. Use a new password you've never used anywhere else.
If you can't sign in, use the company's own recovery page. Type the address yourself rather than following a link in a message: Gmail g.co/recover, Outlook and Hotmail account.live.com/acsr, Apple iforgot.apple.com, Facebook facebook.com/hacked, Instagram instagram.com/hacked.
Lock it down. Turn on the second sign-in step. Check the recovery phone number and email and remove any you don't recognize. Look for forwarding rules or filters you didn't make, and sign out of all other devices.
Change that password anywhere else you used it. Scammers try the same password on banks, shopping sites and other email.
Warn your contacts. A short message from another account or by phone: “My email was hacked. If you got a message asking for money or gift cards, it wasn't me.”
Check your bank and shopping accounts. Look for password-reset emails you didn't ask for, and new charges. If anything looks wrong, call the bank on the number on your card.
Report it. The FTC's guide: How to recover your hacked email or social media account.

Write it down now, while it's fresh. Feeling shaken is normal, and stress makes anyone's memory less reliable: within hours, times blur and details get mixed up. It's why professionals write an after-action report straight away. Your bank, the police and the FTC will all ask the same questions: when it happened, what they said, how you paid and who you've called. A written record helps you remember, and makes every one of those calls easier. Open the free record sheet: it walks you through it step by step, then prints or saves a copy. It stays on your device.

Who to call and where to report

Your bank or card company: the number on the back of your card. Call first if money or a card is involved.
FTC: ReportFraud.ftc.gov, for any scam. Your report helps stop the scammers.
Identity theft: IdentityTheft.gov, if someone used or may use your Social Security number or opened accounts in your name. It gives you a recovery plan.
FBI: ic3.gov, for scams that happened online or by email.
National Elder Fraud Hotline (U.S. Department of Justice): 833-372-8311 (833-FRAUD-11), for people 60 and older, or anyone calling about one. Free, seven days a week, 6 a.m. to 11 p.m. Eastern.
AARP Fraud Watch Network Helpline: 877-908-3360. Free support from trained volunteers, Monday to Friday, 8 a.m. to 8 p.m. Eastern.
Local police, non-emergency number: for a police report. Your bank or insurer may ask for the report number.

Watch for the second scam. After a scam, people often get calls offering to get the money back, for a fee, or from someone "from the FTC" or "the FBI." Those are scammers too. Real agencies never charge to help, and never ask you to pay with gift cards, a wire or cryptocurrency.

When this is over: have the plan ready for next time

A Family Security Playbook puts these steps on paper before you need them: who to call, your banks' real numbers, and what to do for each kind of scam, in large print for the fridge or the desk drawer.

See the playbook, from $39 Free one-page card (PDF)

Older adult in Maricopa County, Arizona, and want hands-on help cleaning up after a hack or scam? Jeff Cady Security's Elder Response.

This page is general information to help you act quickly. It isn't legal or financial advice, and following it can't guarantee money comes back. Last checked October 2026.