How to know if my account has been hacked

The clearest signs are being unable to log in, security settings you did not change, messages sent from your account that you did not write, sign-ins from unfamiliar places or devices, and purchases or transfers you did not make. Check your account's security or login activity page to confirm.

The obvious signs

The UK's National Cyber Security Centre lists the signs that most often mean someone else has been in an account. Any one of them is worth acting on straight away.

• You cannot log in, even with the right password.
• Your security settings, recovery phone or recovery email have changed.
• Friends, followers or customers receive messages from you that you did not send.
• There are logins, or attempts, from strange places or at unusual times.
• Money has moved or purchases have been made that you did not make.

The quieter signs

A careful attacker tries not to be noticed, especially in email, where they can watch conversations and wait for an invoice to interfere with. Google's own guide to a compromised account mentions several of these.

• Forwarding rules or filters in your email that you did not create.
• Emails in your sent folder that you did not write.
• Contacts telling you they received spam or odd requests from you.
• Two-step verification turned off or changed without your action.
• Files deleted or shared, or posts and uploads you did not make.

Where to check

1. 1Open the security pageMost services have one: in Google it is Security in your Google Account, and many others call it login activity or where you're logged in.
2. 2Look at recent sign-ins and devicesAnything you do not recognise, in a place you have not been, deserves attention.
3. 3Check email settingsLook at forwarding, filters and connected apps, not just your inbox.
4. 4Check your bank and payment accountsLook for transactions you do not recognise.

Where Kahu fitsKahu AssistKahu Assist is an AI agent that runs your website, marketing, bookings and follow-ups from one chat, and asks before anything goes live. You keep the yes; it does the typing.Connects to your site, WhatsApp, calendar and emailAsks before anything goes liveSet up from one 15-minute chatSee Kahu Assist →Fill Thursday’s empty slots and let the cafe know the new brunch hours.Kahu · 3 actions readyTwo Thursday gaps at 11:00 and 14:30. Drafted messages to 6 waitlisted customers.Updated the hours on your site and Google profile to Sat–Sun 8–2.One post about the new hours, using your Sunday counter photo.ChangeApprove all

What to do if you see a sign

Do not wait to be sure. Change the password from a device you trust, sign out of all other sessions, turn on two-step verification and tell your bank if money is involved. If you cannot get in at all, use the service's official recovery page, which you should find by going to the site directly rather than following a link in a message. Our guide to recovering a hacked account walks through it step by step.

Frequently asked questions