Published: · by kodewright
Account Hacked? What to Do in the First Hour (2026)
What to do if your account is hacked: an ordered first-hour checklist for Instagram, Facebook and Telegram, plus the email step most people skip.
If your account is hacked, do things in this order: secure the email account behind it, get back in through the platform's official recovery page, end every session you don't recognize, set a new password and turn on two-step verification, then warn your contacts. The first hour matters because the attacker is doing their own checklist at the same time: changing the email and phone, adding their own 2FA, and messaging your friends.
This guide covers Instagram, Facebook and Telegram. Other services differ in menu names, but the order still applies.
Start with your email, not the hacked app
Every "forgot password" link and every new-login warning goes to your email. If the attacker controls that inbox, they can undo anything you fix on Instagram in a minute, and they'll see each recovery code before you do.
This is also where most recoveries I've helped with got stuck. The people had set up their email years ago, signed in once on their phone, and never typed that password again. When the social account was gone and the only way back was a code to that email, they didn't know how to get into it, and none of their accounts had 2FA turned on.
So before anything else:
- Sign in to the email account linked to the hacked profile. If you can't, recover the email first through Google's or Apple's own recovery flow; the social account can wait.
- Change the email password to a new one you've never used anywhere.
- Check the email's own settings for a recovery phone or address you don't recognize, and for forwarding rules. An attacker who adds a forwarding rule keeps receiving your mail after you change the password.
- Turn on 2FA for the email. A passkey or an authenticator app is better than SMS.
If your email is a Google or Apple account, my guide to securing a Google Account and Apple ID walks through those settings screen by screen.
Your first hour, minute by minute
| Time | What to do | Why now |
|---|---|---|
| 0–10 min | Secure the recovery email (section above) | Every other fix depends on it |
| 10–25 min | Recover the account through the official page | The attacker is about to change the email and phone |
| 25–35 min | End unknown sessions, set a new password | Changing the password alone may leave their session alive |
| 35–45 min | Turn on 2FA with your own method | Stops them logging in again with the old password |
| 45–60 min | Warn contacts, check other sites that shared the password | Friends trust messages that come from your account |
If you can still log in:
- Open your profile, tap the menu, then Accounts Center > Password and security > Where you're logged in. Log out every device and location you don't recognize.
- In the same Password and security screen, change the password, then open Two-factor authentication and add an authenticator app.
- Check Accounts Center > Personal details: is the email and phone still yours?
If you're locked out, search your inbox for a message from [email protected] about an email or phone change. It contains a link to reverse that change and secure the account. Use it before anything else. If there's no such email, go to instagram.com/hacked and request a login link or a security code. Instagram may ask for a short video selfie, which it compares with photos on your profile; automated checks can finish in minutes, manual ones take days. Send one request and wait. Firing off requests from several devices can look like bot activity.
Facebook uses the same Meta Accounts Center, so the "still logged in" steps match Instagram: Settings > Accounts Center > Password and security > Where you're logged in, end every unknown session, change the password, turn on 2FA. If Instagram and Facebook are linked in the same Accounts Center, check both: an attacker inside one can see and change the other.
Locked out? Start at facebook.com/hacked. Look in your email for a Facebook message about a changed email address; like Instagram's, it carries a link to undo the change. If you manage a business page, check Meta Business Suite afterwards for admins you didn't add.
Telegram
Telegram has two rules that work for you or against you, depending on which device you're holding.
First, a session that is less than 24 hours old can't terminate other sessions. Telegram's API rejects the request with FRESH_RESET_AUTHORISATION_FORBIDDEN. That's good news if the attacker logged in recently and you still have your old phone or desktop signed in: they can't kick you out, and you can kick them. It's bad news if you just installed Telegram on a new phone to fight back, because that new session can't end theirs until tomorrow. So use your oldest signed-in device:
- Settings > Devices (on some versions, Privacy and Security > Active Sessions), then Terminate All Other Sessions.
- Settings > Privacy and Security > Two-Step Verification: set a password and add a recovery email. The phone number alone then isn't enough to sign in.
Second, the two-step password itself. If you set one with no recovery email and later forget it, Telegram makes you wait 7 days before you can reset it from a signed-in device. With no signed-in device left, the only way out is deleting the account, which wipes your chats and contacts. That's why the recovery email in step 2 matters: set it while you're still in control, and make sure it's the email you secured at the start.
Never forward a login code to anyone. Telegram's codes arrive inside the app from the official Telegram account, and a common takeover starts with a message asking you to "confirm" something or "vote" for someone by sharing one.
Lock the door you came through
Once you're back in, figure out how they got in, or they'll do it again:
- If you reused that password elsewhere, change it on every site that shared it. Credential stuffing (trying leaked email and password pairs on other sites) is automated and fast.
- Remove third-party apps and websites you don't recognize in each account's settings.
- Replace SMS codes with an authenticator app or a passkey. My 2FA vs MFA comparison explains which second factor stops which attack.
For the new passwords, use the Password Generator. It builds passwords inside your browser and nothing is sent to a server, so the password you choose for the recovered account exists only on your screen and in your password manager. To see whether your phone and browser can use passkeys instead, run the Passkey Checker.
If the hack came with a data breach (your email shows up on Have I Been Pwned, or several accounts fell at once), the 48-hour breach checklist covers banks, phone carriers and identity theft.
Warn people before the attacker does
Post a story or send a message from another account: "My Instagram was hacked, ignore any message from it asking for money, codes or votes." Attackers use a hijacked account to scam the people who trust it, and a warning from you lands faster than a takedown from Meta.
Don't pay anyone who offers to recover the account. Instagram, Facebook and Telegram recovery is free, and the "recovery specialists" who reply to your public posts are mostly scammers looking for a second victim.
FAQ
Does deleting the app log the hacker out?
No. A login lives on the service's servers, not in the app on your phone. Deleting or reinstalling the app only removes your own session. To remove the attacker, end their session in Where you're logged in (Instagram, Facebook) or Settings > Devices (Telegram).
Can I phone Instagram or Facebook to get my account back?
Meta has no phone line for personal accounts. Recovery runs through instagram.com/hacked and facebook.com/hacked and is free. Anyone who calls or messages you offering to recover the account for a fee is running a second scam.