If you see an unfamiliar login, messages you did not send, or settings you did not change, act quickly. Open the official app or website, change your password, end other sessions, and enable two-factor authentication (2FA). If you are locked out, secure your email account first and use the platform’s official recovery process.
Recognize the warning signs
A login alert may be harmless if you recently changed devices or traveled. Check it inside the app or account settings rather than through the alert link. Treat the account as compromised if you notice:
- A login from an unfamiliar device, browser, or location.
- Posts, stories, likes, follows, or direct messages you did not create.
- Password, username, email address, or phone number changes you did not make.
- New connected apps, page roles, or linked accounts.
- Contacts reporting spam, scam links, or money requests from you.
- Security alerts, failed login notices, or repeated 2FA prompts.
- Missing posts, blocked users, changed privacy settings, or unfamiliar payments.
If an activity looks unfamiliar, take screenshots and note the time, device, location, and any reference number before changing settings. Do not reply to a suspicious alert or give anyone a login or verification code.
Secure the account step by step
- Use a trusted entry point. Open the social media app already installed on your device or type the service’s known web address yourself. Do not use a login link from an unexpected email, text, or message. If the page requests a 2FA code you did not request, close it.
- Change the password immediately. Go to the account’s security or login settings and create a long, unique password that you do not use anywhere else. A password manager can generate and store it. If the password has already been changed and you cannot log in, follow the locked-out instructions below.
- End every unfamiliar session. Find the section for active sessions, logged-in devices, or login history. Review each device and location, then select the option to log out of all other sessions or remove unfamiliar devices. Changing a password does not always end an existing login, so complete this step separately.
- Turn on 2FA. In the security settings, enable two-factor authentication. An authenticator app or physical security key is generally safer than SMS when supported. Save the backup codes in a secure place. Never share a code, even with someone claiming to be platform support.
- Undo unauthorized changes. Check the email address, phone number, username, recovery options, linked accounts, connected apps, page roles, privacy settings, and blocked-user list. Remove anything unfamiliar. Also review advertising, payment, shop, or monetization settings if your account uses them.
- Report the compromise and warn your contacts. Use the platform’s “hacked account,” “compromised account,” or Help Center reporting option. Save the report or case number. If strangers received scam messages or payment requests, post a brief warning through a verified channel so they do not trust messages from the account.
Do not delete the app or account as your first response. Neither action necessarily removes an intruder, and deleting the account can make recovery or reporting more difficult.
Common causes of suspicious social media activity
- Phishing: A fake login page captured your password or 2FA code.
- Password reuse: A password exposed in another company’s data breach was tried on your social account.
- Malicious connected app: A quiz, giveaway, or third-party tool received access and acted through your account.
- Compromised email: Someone used password-reset messages or recovery links sent to your email account.
- Stolen active session: Malware, a fake login page, or an unsafe device preserved access even after the password changed.
- Benign activity: You forgot a session on another device, shared a device, or logged in while traveling.
The cause affects what else you should secure. A compromised email needs its own password and 2FA review. An unauthorized charge requires action from your card issuer. If you suspect malware on your device, update the operating system, remove suspicious software, and run a reputable security scan before logging in again.
What to do if you cannot log in
- Secure your email first. From a trusted device, change its password, enable 2FA, and check recovery details, forwarding rules, filters, and delegated access. Remove anything unfamiliar. An attacker who controls your email can often reset the social account again.
- Start official account recovery. Open the social media app or known website and choose “Forgot password,” “Can’t log in,” or the support option for a hacked account. Avoid recovery pages reached through ads or direct messages.
- Select a recovery method you control. Use the original or current email address or phone number associated with the account. If those details were changed, choose the platform’s “no longer have access” or similar option when available.
- Provide only the requested proof. The service may ask for a username, previous contact details, account creation information, or identity verification. Upload identification only through the platform’s official secure recovery page—not by email or chat.
- Stop repeated guessing. Too many incorrect attempts may trigger another lock. Record each case number and continue through the official support route.
- Act quickly if your phone number disappeared. If service stopped unexpectedly or a new SIM was issued without your request, contact your mobile carrier immediately. Then tell the social platform that the phone-based recovery option may be unsafe.
After regaining access, change the password again, end all sessions, enable 2FA, and repeat the full settings review. Check whether the intruder changed recovery details after your first password reset.
Protect accounts connected to the compromised profile
- Email: Treat it as high priority because it can reset passwords for your other services.
- Accounts with the same password: Change them to unique passwords, starting with email, banking, shopping, and cloud storage.
- Payment services: Remove unknown cards or payout details and contact the card issuer about unauthorized charges.
- Business pages and creator accounts: Check administrators, partners, payout profiles, ad accounts, and connected business tools.
- Friends and followers: Warn them not to open links, download files, or send money in response to messages posted during the compromise.
Avoid these recovery mistakes
- Never provide a 2FA code, password-reset link, or remote-access request to someone who contacts you first.
- Do not pay a “recovery hacker” or send account details through social media. Use only the platform’s official support channels.
- Do not delete evidence before recording suspicious posts, transactions, messages, and support case numbers.
- Do not assume a new password is enough; revoke active sessions and connected-app access as well.
When to seek further help
Contact the platform’s support team if you cannot complete recovery or the intruder keeps returning. Also seek help from the appropriate organization when:
- Money, gift cards, or advertising charges were stolen: contact your bank or card issuer immediately.
- Your phone number was hijacked: contact your mobile carrier.
- Identity documents, private images, threats, or extortion are involved: preserve evidence and contact local law enforcement or an official cybercrime reporting service.
- A business, community page, or creator account is affected: notify every authorized administrator and review financial and publishing access.
The practical takeaway
Secure the account through the official app or website, change to a unique password, end other sessions, enable 2FA, and review recovery and connected-account settings. If access is blocked, protect your email first and work through the platform’s official recovery process. Speed matters, but avoid rushed decisions that give scammers another way in.