How to recover a hacked account
Kahu team·Updated 2 Oct 2026·6 min read
If you can still log in, change the password, sign out all other sessions and turn on two-step verification straight away. If you are locked out, use the provider's official account recovery page. Then check your email rules, change any reused passwords, warn your contacts and check your bank.
First: can you still log in?
If you can still get in, move quickly before the attacker changes your recovery details. Use a device you trust, ideally not one you think may be infected. If you are locked out, go to the provider's official recovery page yourself. Do not search for a phone number and call it: fake support numbers are a common scam, and Google, for example, says it never asks for your password or verification codes by email, phone call or message.
The recovery steps in order
- 1Contact the providerUse its help or recovery pages. Google's is at accounts.google.com/signin/recovery, and Facebook, Instagram and most other platforms have their own.
- 2Check your email accountLook for forwarding rules and filters you did not set. Attackers use them to keep reading your mail after you change the password.
- 3Change passwordsOn the hacked account, and on every other account where you used the same password.
- 4Log out all devices and appsUse the account's settings to end every other session and remove apps you do not recognise.
- 5Turn on two-step verificationSo a stolen password alone is not enough next time.
- 6Update your devicesInstall the latest software and app updates.
- 7Tell your contactsAsk them to ignore recent messages from you, especially requests for money or links.
- 8Check bank and shopping accountsLook for purchases or transfers you did not make, and call your bank if you find any.
Where Kahu fits
Two Thursday gaps at 11:00 and 14:30. Drafted messages to 6 waitlisted customers.
Updated the hours on your site and Google profile to Sat–Sun 8–2.
One post about the new hours, using your Sunday counter photo.Tips for getting through recovery
- Answer as many recovery questions as you can rather than skipping them.
- Use a device and location you normally sign in from.
- Check your spam folder for verification codes.
- Be patient. Own Your Online warns recovery can be a long process.
If recovery is not possible, you may need to create a new account and tell your contacts and customers about the change. For a business, update your website, email signature and listings so customers are not sent to the old account.
Report it
In New Zealand, individuals and small businesses can report an online issue to the National Cyber Security Centre through Own Your Online, which also links to recovery pages for major platforms. If money was lost, contact your bank first. If a crime is happening or someone is in danger, call 111.
Frequently asked questions
How long does it take to recover a hacked account?
Sometimes minutes, sometimes weeks. It depends on the platform and whether your recovery phone and email were changed.
Should I pay someone who offers to recover my account?
No. Use only the platform's official recovery process. Recovery services that contact you are often scams.
What if it was my business account?
Follow the same steps, then check who else had access, remove anyone who should not, and warn customers if messages went out in your name.