Cannot log in
A password has changed, recovery details look different or the account says it does not recognise you.
I've Been Hacked: Recovery Checklist
Follow this checklist in order: identify what happened, stop further damage, save evidence, secure email and money, recover accounts safely, then protect against further activity.
How do I know if I've been hacked?
One sign on its own may be a glitch. Two or more signs together may indicate a hack, scam or account compromise. If money, email or business systems are involved, act carefully before deleting anything or changing passwords from the affected device.
Unexpected MFA alerts
You receive password reset, sign-in or MFA prompts that you did not request.
Messages sent from your account
Friends, customers or colleagues say they received emails, texts or social messages from you.
Money or invoices look wrong
Orders, refunds, supplier bank details, payment requests or account activity do not look right.
Files have changed
Files are missing, renamed, encrypted or changed in a way you cannot explain.
Unknown devices or apps
You see sign-ins, connected apps, browser extensions or devices that you do not recognise.
Rules or forwarding look wrong
Mailbox rules, forwarding addresses, delegated access or sent items have changed without your knowledge.
Your site or domain has changed
Website content, DNS records, domain settings or admin users look different from what you expect.
Someone is pressuring you
A caller, message or pop-up asks you to install software, share codes, pay money or act immediately.
Two or more signs? Treat it seriously and move to the recovery steps below.
Identify what has happened
1
Identify the risk before you act
Before changing passwords or resetting devices, work out what looks affected. This helps you choose the safest recovery path and avoid destroying useful evidence.
- Is money moving or could bank details be exposed?
- Is the main email account still under your control?
- Which account, device or service looks affected?
- Was this a personal account, a work account or both?
- Has customer, staff or business data possibly been exposed?
Follow the right recovery route
Home Users
Personal email, bank, phone, computer, Microsoft, Google, Apple, shopping or social accounts.
- 2
Stop further damage
Use a clean device. Disconnect anything that may be infected. Call the bank if money is at risk.
- 3
Save evidence
Keep screenshots, alerts, messages, phone numbers, payment references and dates.
- 4
Secure
Secure your main email first, then passwords, recovery details, MFA and important accounts.
- 5
Recover
Review sign-ins, remove unknown devices and apps, then recover affected accounts safely.
- 6
Protect
Report where needed, replace reused passwords, scan devices and test backups.
Business Users
Work email, Microsoft 365, Google Workspace, staff devices, websites, customer data or shared systems.
- 2
Stop further damage
Contact trusted IT support. Do not wipe devices, delete accounts or restore backups yet.
- 3
Save evidence
Start an incident log and preserve alerts, emails, screenshots, timelines and case numbers.
- 4
Secure
Secure administrator accounts, email, Microsoft 365 or Google Workspace, devices and remote access.
- 5
Recover
Assess affected users, services and data, then restore safely from known-good backups.
- 6
Protect
Check insurer, ICO, legal and customer duties, then improve controls to reduce repeat risk.
What to do after choosing your path
Home Users
If money is involved, contact your bank using a trusted number before doing anything else. If your main email is affected, secure it early because it can reset other accounts. Keep screenshots, suspicious messages, dates, times, phone numbers, web addresses and case numbers.
Use official recovery pages for Microsoft, Google and Apple accounts. Avoid links sent in suspicious messages, and do not use an infected device for passwords or banking.
Business Users
If this involves work systems, customer data, Microsoft 365, Google Workspace or shared devices, stop and contact trusted IT support before wiping devices, deleting accounts or restoring backups.
Keep an incident log and preserve evidence. Check whether you need to notify your bank, insurer, ICO, legal adviser, customers or staff before returning systems to normal use.
Useful official links: NCSC hacked account guidance, Report Fraud, Have I Been Pwned, ICO breach guidance.
Prepare before a breach and recover in the right order
Use these PDFs to record the information you may need before something goes wrong, then follow the same staged recovery process used on this page.
Home user recovery checklist
For personal email, phones, computers, banking, shopping, social media, Microsoft, Google and Apple accounts.
Download Home User PDFBusiness recovery checklist
For Microsoft 365, Google Workspace, staff accounts, websites, shared systems, customer data and incident records.
Download Business PDFNeed guided help?
Contact your trusted support provider. IT Life-Raft customers can download the Support Toolkit. Confirm the technician's identity before allowing remote access.
Disclaimer
This guide gives general information only. It does not guarantee recovery of accounts, files, data or money. Every incident is different.