How to Secure Any Account After It's Been Hacked

The universal lockdown

Every platform has its own recovery page, but the principles of locking an account back down are the same whether it is your email, your bank, your Instagram, or your Xbox. This is the platform-agnostic checklist — the moves that apply to anyaccount. For the exact menu clicks on a specific service, jump to that service's guide at the bottom.

1. Clean the device first if malware is possible. Microsoft is explicit that you should run a malware scan before you change the password — otherwise malware on the device can simply capture the new one. If the account was used on a computer that may be infected, scan it before step 2.
2. Set a new, unique password. Long, and used on no other account. A password manager makes this painless and is the single highest-leverage habit here.
3. Sign out everywhere.Use the account's “active sessions” or “your devices” page to revoke every session. This is what actually ejects an attacker who is currently logged in.
4. Reclaim your recovery info. Review the recovery email and phone number and remove any you do not recognize — attackers swap these to theirs so they can reset their way back in.
5. Upgrade two-factor. Turn on the strongest second factor the account supports — an authenticator app or a passkey over SMS where possible (here is why SMS codes are the weakest 2FA).
6. Audit forwarding rules and connected apps.Remove mail forwarding and filters and revoke third-party apps or “sign in with” permissions you did not grant (email specifics: is a hacker still reading your email?).
7. Reset reused passwords. Any other account that shared the breached password is now exposed — change those too, starting with email and anything financial.

The exact clicks, by platform

The checklist above is the “what.” For the “where,” each major platform has a step-by-step recovery guide:

• Google / Gmail
• Microsoft / Outlook
• Apple ID / iCloud
• Meta — Facebook, Instagram, WhatsApp
• Amazon
• All account-recovery guides

If the same attacker keeps getting back in, money has moved, or you need to know exactly what was accessed, account compromise recovery is the SleuthX service for the cases a checklist does not close on its own.

Related services

• Account Recovery After Compromise