MyRecon OSINTYour Account Was Hacked: What to Do in the First Hour
Someone else is in your account. The order in which you do the next few things decides whether you get it back cleanly or spend three weeks being locked out again every few days, because the step nearly everyone starts with is not the step that evicts an attacker.
First, confirm it is real
A significant share of "your account has been compromised" messages are themselves the attack, and panic is exactly the state they are engineered to produce. Before acting on a notification, verify it independently: open the service through your own bookmark or app, not through anything in the message, and look at the account's own security or activity page.
Real indicators are things you can see from inside the account: sign-ins from places you have not been, messages in the sent folder you did not write, a changed recovery address, a second factor you did not enrol, new connected applications, or contacts telling you they received something odd from you.
Work from a device you trust. If there is any chance malware is involved, a file you ran, a command you pasted, several accounts falling at once, then the machine is the problem and every password you type on it is captured as you type it. Use a different computer or phone for everything below. This single decision is the difference between recovering once and recovering repeatedly.
The order that actually works
1. Go to the email account first, whatever was taken
Email is the master key. Nearly every other account can be reset through it, so if the mailbox is compromised, securing anything else is temporary. If the breached account is the mailbox, you are already in the right place.
2. Regain access
Change the password to something long, unique and generated. If you are locked out, use the service's account recovery flow, and expect it to be slow and to want evidence. Do not pay a third party promising to recover an account; recovery services for consumer platforms are overwhelmingly fraudulent, and the legitimate route is always the platform's own.
3. Revoke every session: this is the step people skip
Changing a password does not, on most services, log anyone else out. A session cookie already issued keeps working: no password prompt, no second factor, because the service considers that session already authenticated.
Find "sign out of all devices", "revoke active sessions" or similar in security settings and use it. If you change the password and stop, and the attacker holds a live session, you have changed nothing they need.
4. Hunt the persistence
A competent attacker assumes you will eventually change the password and leaves a way back in first. Work through every one of these, because finding six of seven is the same as finding none:
- Mail forwarding rules. The classic. A silent rule copying everything to an outside address survives every password change you make, and is the standard setup for intercepting future reset links.
- Filters and blocks. Rules that delete or archive messages matching words like "security", "password" or a bank's name, so you never see the alerts.
- Recovery email and phone. Check both. A changed recovery address means the attacker can simply reset the account again later.
- Registered second factors. Remove any authenticator, phone number or key you do not recognise, then regenerate the backup codes, old ones may have been copied.
- App passwords and API tokens. These bypass two-factor by design. Revoke everything you do not currently use.
- Connected applications and OAuth grants. An authorised third-party app keeps its access after a password change. Revoke anything unfamiliar.
- Delegated access. Mailbox delegates, shared calendar permissions, account managers, and on business systems, added administrators.
- Auto-replies and signature blocks, which have been used to redirect payments quietly.
5. Re-secure properly
Now enable or re-enable two-factor authentication, preferring a passkey or authenticator app over SMS, and store the fresh backup codes offline. See the two-factor guide for what to choose.
6. Find out what they did
Read the sent, deleted and archived folders. Check whether messages were sent in your name, whether financial documents were downloaded, and whether the account was used to reset anything else. On platforms with an activity or login history page, read it and screenshot it before it ages out, most retain only a limited window.
7. Work outwards
Anything that resets through the compromised account is also exposed. Change the password on any service where you reused that password, and check your banking and payment accounts for new payees, changed addresses and saved cards. If the account was used to contact people, tell them directly, the follow-on scam aimed at your contacts is usually where the real money is made.
If it was the device, not the password
Suspect this when several unrelated accounts fall at once, when the attacker was inside without your second factor ever firing, or when you recently ran an installer or pasted a command you did not fully understand.
In that case the order changes: clean or rebuild the device first, then change passwords from somewhere else, then revoke sessions everywhere. Cleaning is not reliable against modern infostealers, and a rebuild is the only outcome you can be confident in. The full picture is in why your password leaked when nobody was breached.
If it was your phone number
Sudden loss of mobile service, immediately followed by password reset messages, is a SIM swap rather than an ordinary account compromise. The fix starts with the carrier, not the account, see SIM swap attacks.
If it is a work account or a work device, report it now. Not after you have tidied it up, and not once you are sure. Corporate credential theft is how a large proportion of serious intrusions begin, and the gap between the first hour and the first day is the difference between a password reset and an incident. No security team has ever been annoyed by an early report.
Preserve the evidence before you clean up
If there is any chance of a police report, an insurance claim or a dispute with the platform, capture what you can before it disappears: screenshots of the unfamiliar sessions and login history, the full headers of any phishing message that started it, transaction records with timestamps, and the dates and times of everything you changed. Logs age out on a schedule that suits the platform rather than you.
Where to report
- The platform, through its compromised-account process, which is separate from ordinary support.
- Your bank, immediately, if money or card details were involved. Speed is the only variable that matters for recall.
- Your national fraud or cybercrime reporting body, which in most countries takes online reports and issues a reference number. That number is frequently required for claims.
- Your employer's security team, for anything touching work.
Afterwards: closing the route in
Once the immediate work is done, identify how it happened, because otherwise it recurs. Check whether the credentials were in a known breach, retire every reuse of that password, move the important accounts to a manager and a phishing-resistant second factor, and review the recovery paths, which are where the next attempt will go.
Find out which breaches your address appears in, and which password of yours is already in circulation, with the MyRecon tools. The password check runs in your own browser and sends only a partial hash.
Questions people ask
Should I change my password first?
Only if you are confident the device you are typing on is clean. If there is any chance malware is involved, change it from a different device, otherwise the new password is captured as you type it. And a password change alone does not evict an attacker who holds a valid session cookie; you must also sign out of all sessions.
I changed my password but I keep getting logged out. Why?
Because the attacker still has an active session, or a persistence mechanism you have not found yet, often an app password, a connected application, or a changed recovery address. Revoke all sessions, then work through the persistence checklist on this page.
Should I delete the compromised account?
Usually not, and not immediately. Deletion destroys the evidence you may need, removes your ability to warn contacts from the account itself, and can free the handle for someone else to register. Secure it first; decide about deletion later.
How do I know whether it was my password or my device?
If the credential appears in a breach corpus and you reused it, the password is the likely route. If several unrelated accounts were taken at once, or the attacker was logged in without triggering your second factor, suspect the device and session theft instead.