My account has been hacked

Go to the site or app yourself, not through a link in an email or message. If the attacker changed your email address or phone number, look for the "account hacked" or "can't sign in" help page: most big services have one.

Make it long and unique. Three or four random words works well. Never reuse it on another site.

Look in the account's security or devices settings. This throws the attacker out even if they are still signed in.

An authenticator app, a passkey or a security key is best. A code by text message is still far better than nothing. Our guide "Turn on two-step verification" walks you through it.

Attackers often add their own so they can get back in later. Remove anything that isn't yours.

In email: forwarding rules, filters, auto-replies and connected apps. On social media: linked apps, new admins on your pages, and posts or messages you didn't send.

Start with email, banking and shopping. A password manager makes this much easier next time.

If the attacker sent messages from your account, a short note stops friends falling for them.

If money moved or a card was linked, call your bank on the number on the back of your card.

Most services have a form for hacked accounts. It helps them stop the attacker and can bring back lost content.