How Do You Recover a Hacked Account?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How do I recover a hacked email account?

Work from a device you know is clean, not from the compromised machine. Change the password there, then immediately revoke every active session and every registered application, because a stolen session token is unaffected by a new password. Remove any forwarding rules, inbox rules, delegates and app passwords you do not recognise, and reset any recovery email address or phone number the attacker added. Rotate the recovery codes and re-enrol two-factor authentication with a device you control. Then read the sent items, the deleted items and the login activity, and note what was forwarded or used to reset other accounts, because a compromised mailbox is a trusted sender and your contacts will act on whatever it sends next.

What if the attacker changed the recovery email or phone number?

Use the provider's own recovery path, not the account's email. For a business account, the domain administrator can reset the account from the admin console, remove the attacker's recovery address and restore access directly. For a consumer account, the provider's recovery flow asks for information only the real owner would have, and you should supply it so it demonstrates knowledge, not just possession of the old password. If the attacker also controls the recovery phone, that is a SIM swap or a port-out, so report it to your operator and ask them to reverse the port, otherwise every OTP goes to the attacker. Where the domain was hijacked, approach the registrar, whose security contact moves faster than a support ticket.

How do I recover a hacked WhatsApp or social media account?

Start with the linked identity, not the app. If a compromised email account was the root, fix it first, because social account re-registration depends on it. Then check for linked devices in the app's security settings and remove anything unfamiliar, and revoke third-party app permissions that could post on your behalf. Register the official mobile number with the platform if you have lost the SIM, and be careful about anyone who calls offering recovery, that being the standard social engineering route. Where an intruder has added a recovery email, it must be removed before a normal reset works. Report the takeover on the platform, and file on cybercrime.gov.in if money was involved.

What should I check after I regain control of the account?

Treat the account as hostile until proven otherwise. Read the sent folder and the deleted items, because the attacker often uses the mailbox to request password resets elsewhere. Check inbox rules, filters and delegates, and remove anything you did not create. Review the list of authorised third-party apps and connected accounts. Check the recovery settings again after the reset, since a reintroduced recovery address is a common way back in. Then look at what else shares that identity: a phone number linked to the account, a password manager, a cloud drive, and any account that used the compromised email for recovery. Those secondary accounts turn a single takeover into a full identity compromise.

What are the frequently asked questions?