How to Check if an Account Was Hacked
If you suspect an account has been compromised, speed matters.
This guide explains how to check if account was hacked, what signs to look for across email, banking, social media, and cloud accounts, and how to verify suspicious activity without missing subtle clues.
Hackers often leave behind small traces: unfamiliar logins, changed recovery details, unexpected alerts, or messages sent without your knowledge.
The fastest way to confirm a breach is to compare account history, security settings, and connected devices against what you recognize.
Common Signs an Account May Be Hacked
Many compromised accounts show more than one symptom.
A single odd event may be harmless, but several together usually indicate unauthorized access.
- Unrecognized login alerts: Notifications about sign-ins from new devices, unusual locations, or odd times.
- Password changes you did not make: You can no longer sign in, or the password reset link stops working.
- Unknown emails, posts, or messages: Sent items or published content you did not create.
- Recovery information altered: New phone numbers, email addresses, or security questions added to the account.
- Account settings changed: Forwarding rules, filters, privacy settings, or payment details modified unexpectedly.
- Locked out of your account: The attacker may have changed the password or enabled extra protection.
- Security alerts from the provider: Messages about suspicious activity, new devices, or disabled two-factor authentication.
How to Check if Account Was Hacked: A Step-by-Step Verification Process
The best way to confirm compromise is to inspect account activity from the account itself, the provider’s security dashboard, and your own device records.
Use the steps below in order.
1. Review recent sign-in activity
Most major services, including Google, Microsoft, Apple, Meta, and many banks, show a login history.
Look for unfamiliar devices, IP addresses, cities, countries, browsers, or operating systems.
Pay attention to repeated access at odd hours or sign-ins that do not match your travel or work schedule.
2. Check connected devices and active sessions
Attackers often stay logged in after stealing credentials.
Open the account’s security page and review active sessions, trusted devices, and connected apps.
If you see a device you do not own, sign it out immediately and change the password.
3. Inspect account recovery details
Verify the phone number, backup email, and recovery methods attached to the account.
If any recovery method was changed, that is a strong indicator of compromise because it gives the attacker a way to regain access after you recover it.
4. Review security and forwarding rules
Email accounts are especially vulnerable because hackers can set up mail forwarding, hidden inbox rules, or auto-delete filters.
Check for rules that send messages to another address, mark alerts as read, or move security emails out of your inbox.
5. Look for unauthorized transactions or purchases
For banking, payment, shopping, and subscription accounts, review recent charges, saved cards, payout destinations, and linked bank accounts.
Any payment method you do not recognize should be treated as a possible fraud event, not just a login issue.
6. Search for sent messages or posts you did not create
On social platforms and messaging services, attackers often use compromised accounts to spam contacts or spread phishing links.
Check your sent folder, timeline, direct messages, story archive, and linked business pages for suspicious content.
7. Confirm the account from a separate, clean device
If your phone or computer may also be infected, verify the account from a device you trust.
A compromised device can distort what you see, capture your password again, or block security notifications.
How to Tell Whether the Problem Is Hacking or a Device Issue
Not every strange account event means the account itself was hacked.
Sometimes the real issue is malware, a browser extension, or phishing.
The distinction matters because the recovery steps differ.
- Likely account compromise: New logins, changed recovery info, unauthorized emails or posts, and unknown devices in the account history.
- Likely device compromise: Multiple accounts acting strangely from the same phone or computer, random pop-ups, browser redirects, or saved passwords being exposed.
- Likely phishing: A fake sign-in page, urgent login email, or text message asking you to enter credentials, often followed by immediate suspicious account activity.
If several accounts are affected at once, prioritize scanning the device and changing passwords from a different trusted device.
What to Do Immediately If You Confirm a Hack
Once you have enough evidence, act quickly and in the right order.
Early containment can limit damage and cut off the attacker’s access.
- Change the password: Use a strong, unique password that has never been reused on another site.
- Sign out of all sessions: End active logins on every device so stolen sessions are invalidated.
- Enable two-factor authentication (2FA): Use an authenticator app or hardware security key when available.
- Restore recovery details: Replace unknown phone numbers, email addresses, or backup methods.
- Remove suspicious forwarding rules and third-party access: Revoke unknown apps, browser extensions, or OAuth permissions.
- Check financial exposure: Freeze cards, notify your bank, and dispute unauthorized charges if money or payment data is involved.
- Warn contacts if necessary: If your email or social account sent malicious links, let your contacts know not to click them.
How to Check Major Account Types
Different platforms expose different clues.
Knowing where to look saves time and reduces the chance of missing evidence.
Email accounts
Email is usually the highest-priority account because it controls password resets for many other services.
Review sign-ins, forwarding, filters, delegated access, recovery options, and sent mail.
Gmail, Outlook, and iCloud Mail all provide security activity pages or account dashboards.
Social media accounts
Check login locations, active sessions, linked advertising accounts, and any recent posts or messages.
Review profile changes, new followers, page admin roles, and connected business tools on platforms such as Facebook, Instagram, X, and LinkedIn.
Financial accounts
Examine transaction history, payees, linked bank accounts, and alerts.
Even if no money is missing, unknown login attempts or changed payout details can indicate account takeover in progress.
Cloud storage and productivity tools
In Google Drive, OneDrive, Dropbox, and Microsoft 365, look for shared links, file deletions, new devices, and permission changes.
Attackers may use these accounts to steal documents rather than make obvious public changes.
When You Cannot Log In Anymore
If the attacker changed the password or recovery method, use the provider’s account recovery flow immediately.
Be prepared to prove ownership with previous passwords, security codes, billing information, or a trusted device.
Avoid repeated failed login attempts if the platform has lockout rules, because that can delay recovery.
If recovery fails, contact support through the official help center, secure your email first if possible, and review any financial or identity-related exposure tied to the account.
How to Reduce the Risk of Future Account Hacks
Prevention is mostly about reducing password reuse, limiting exposure to phishing, and making stolen passwords less useful.
- Use a password manager to create unique passwords for every account.
- Turn on two-factor authentication for email, banking, and social accounts.
- Prefer authenticator apps or hardware security keys over SMS when possible.
- Keep operating systems, browsers, and apps updated.
- Review account activity and security settings regularly.
- Avoid signing in through links in unsolicited emails or texts.
- Remove old apps and browser extensions you no longer trust.
Account security is not only about strong passwords; it is also about detecting unusual behavior early enough to stop it before damage spreads.