Account Takeover: Warning Signs and What to Do

Account takeover means someone else is logging in as you. The early signs are easy to miss, and the first steps matter.

By Siddharth ShankarUpdated October 21, 2026

Account takeover is when a criminal gets into your online account, such as email, social media, shopping or banking, and uses it. It often starts with a leaked password reused somewhere else, or a phishing message.

Warning signs

The FTC lists these signs that an account was hacked:

• You cannot log in.
• You receive a notice that your username or password was changed and you did not do it.
• You get a login alert from a device or location you do not recognise.
• Friends or family say they received messages or emails from you that you did not send, sometimes with suspicious links or requests for money.

Other clues include posts or ads you did not create and unfamiliar devices in your account’s security page.

What to do first

After you are back in

The FTC suggests these steps once you have regained control:

• Change your password to a strong one that is hard to guess.
• Sign out of all devices.
• Turn on two-factor authentication if available.
• Confirm that your recovery email addresses and phone numbers are yours.
• Look for email forwarding rules you did not create and delete them.
• Check sent and deleted folders for messages you did not write.
• On social media, look for unfamiliar posts, messages or friends.
• Tell your contacts, warn them not to click links from your account and tell them to ignore requests for help or money.

Check the other accounts

If you used the same password anywhere else, change it there too. Criminals try stolen logins on many sites, which is called credential stuffing. Also check your bank, card and payment accounts for activity you do not recognise.

How takeovers usually begin

• A password leaked in a data breach and reused on another site.
• A phishing message that sent you to a fake login page.
• A text code you were tricked into sharing.
• A phone number moved to a criminal’s SIM.
• Malware on a device that captured what you typed.

Knowing the route helps you close it. If the cause was a reused password, change every copy of it. If it was a phone number takeover, contact your carrier and lock the line.

Keep a recovery kit

Write down, in a safe place, the backup codes for your main accounts, the email address used for recovery and the steps for each provider’s recovery page. When an account falls, people who prepared recover faster than those who must hunt for details under stress.

Prevent the next one

• Use a unique password for every account, kept in a password manager.
• Use an authenticator app or security key for two-step verification.
• Check whether your email appears in a breach. See how to check if your email has been exposed.
• Be careful with phishing. See how to tell if a breach notice is real.

For one platform in detail, read Instagram hacked and email changed.