An unfamiliar login alert can be unsettling, especially when your account contains private messages, photos, or contact details. The important thing is to act carefully rather than clicking the first warning that appears in your inbox.
Start by checking the account through its official app or website. If you can still sign in, secure it in the order below. If you have been locked out, go straight to the recovery section. The exact menu names vary by platform, but the same priorities apply: change the password, end unfamiliar sessions, protect the recovery details, and check what the intruder may have changed.
How to tell if your social media account may be compromised
One alert does not always mean someone has taken over your account. A new phone, browser, travel location, or privacy setting can sometimes trigger a security notification. Open the service directly and check its security activity instead of trusting the link in an unexpected email or message.
Take the warning more seriously if you also notice any of these signs:
- Login activity from a device or location you do not recognize.
- Posts, stories, comments, follows, or direct messages you did not make.
- A changed password, username, profile photo, email address, or phone number.
- Password-reset emails or verification codes you did not request.
- Unknown connected apps, page roles, linked accounts, ad purchases, or payment activity.
- Friends telling you they received strange links, money requests, or messages from your account.
If it is safe to do so, take screenshots of suspicious activity and note the time, device, and any reference number shown. This information may help if you need to contact support. Do not delay urgent security steps just to collect evidence.
Never reply to a suspicious security message with a password or verification code. To check an alert, open the installed app or type the service's known address into your browser yourself.
If you can still log in: secure the account in this order
- Change your password. Choose a long, unique password that you have not used on another site. If you reused the old password elsewhere, those accounts may also be at risk. You can check whether your password has been exposed, but do not wait for a check before replacing a password you know or suspect is compromised.
- Log out unfamiliar devices. Open the account's security settings and look for a section called “Where you're logged in,” “Active sessions,” or “Devices.” Review the list and end sessions you do not recognize. On Facebook and Instagram, this is generally found through Accounts Center under Password and security; menu labels can change. Changing the password does not always end every existing session, so check the list separately.
- Turn on two-factor authentication (2FA). Use an authenticator app or security key if the platform supports it. Text-message codes are still better than no second step, but they can be vulnerable if someone takes control of your phone number. Save backup codes somewhere private and secure.
- Check recovery details. Confirm that the email address and phone number attached to the account are yours. Remove unfamiliar details, and check that the recovery options have not been changed to an address or number controlled by someone else.
- Remove unknown connected apps. Review apps, websites, integrations, and account permissions. Revoke access for anything you do not recognize or no longer use.
- Review recent changes. Check posts, messages, profile details, followed accounts, linked pages, advertising settings, and payment methods. Remove unauthorized content where possible, and contact the platform or payment provider if you find purchases you did not make.
- Enable login alerts. Turn on notifications for unrecognized logins if the service offers them. These alerts can help you notice another attempt, but they are not a substitute for a strong password and 2FA.
Secure the email account connected to your profile
Your email account is often the route back into social media, because password-reset links and security notices arrive there. If someone controls that inbox, they may be able to reset your social password again after you secure it.
Change the email password if it is reused, weak, or possibly exposed. Turn on two-step verification, review active sessions, and check for unfamiliar forwarding rules, filters, recovery addresses, or phone numbers. If you suspect the inbox itself has been accessed, check whether your email account was hacked and secure it before relying on it for account recovery.
What to do if you are locked out
Do not keep guessing passwords or follow recovery links sent by strangers. Use the platform's official hacked-account or account-recovery process. If possible, begin on a device and network you have used for that account before; a familiar device may help the service recognize you.
- Open the platform's official help center by typing its address yourself, then find the account recovery option.
- Check your email for genuine security notices about changes to your email address or phone number. Some platforms provide a way to reverse a change, but these links may expire, so act promptly.
- Follow the service's identity-verification steps. Depending on the platform and account, it may request a video selfie, an identity document, or other proof.
- If two-factor authentication is blocking access because you lost your device, look for backup codes or the platform's official recovery procedure. This guide can help if you need to recover access when two-factor authentication stops working.
Be wary of anyone in comments, direct messages, or search results who promises to recover your account for a fee. Some scammers target people who are already locked out. Never give them your password, backup codes, or verification codes, and do not install remote-access software at their request.
Protect other accounts and warn your contacts
If the compromised password was reused, change it anywhere else it appears, especially on your email account and services involving money. If you use social media to sign in to other apps, review those connections too.
If your account sent suspicious messages, warn friends through another trusted channel. Tell them not to click links or send money or verification codes in response. If payment information, an advertising account, or a business page was affected, contact the relevant platform and your bank or card issuer promptly.
Hacked account or fake profile? The response is different
If someone has taken control of your real account, use the security and recovery steps above. If someone created a separate profile using your name or photos, your original account may still be safe. Report the fake profile through the platform's impersonation or reporting option, keep screenshots as evidence, and let friends know not to trust requests from that profile.
A suspicious message alone also does not prove your account was hacked. It may be a phishing attempt designed to trick you into entering your password on a fake login page. Do not use links from the message; check your account directly.
Common mistakes to avoid
- Clicking the warning link. Fake security alerts often copy the look of real platform messages. Open the service independently instead.
- Changing the password but ignoring active sessions. Review and end unfamiliar sessions separately.
- Securing social media but not email. An exposed inbox can let an attacker reset your password again.
- Sharing codes with “support.” Legitimate support should not need you to send a one-time login code in a private message.
- Paying a recovery service found through an ad or message. Use the platform's official recovery process, not a stranger's promise.
When to contact the platform or your bank
Contact the platform through its official help center if you cannot recover access, the attacker keeps regaining control, or important account details have been changed. If money was spent, payment information was altered, or a business or advertising account was affected, contact your bank or card issuer as well. Keep your screenshots and case references for follow-up.
What to do next
If you still have access, change the password, end unfamiliar sessions, turn on two-factor authentication, verify your recovery details, and review connected apps. Then secure the email account tied to the profile. If you are locked out, use only the platform's official recovery process. Acting quickly matters, but so does avoiding fake alerts and recovery scams that can make the situation worse.