"I got hacked" — the first 5 things you should do right now

You notice something isn't right. Your email is sending messages you didn't write. Your bank account shows a charge you don't recognize. Your social media password suddenly stopped working. Or someone calls to say they got a strange message from you.

Whatever tipped you off — act fast. The first hour after discovering a compromise matters enormously. Here are the five things to do right now, in order.

Step 1: Change your passwords immediately — starting with email

Your email account is the master key to everything else. If an attacker controls your email, they can reset the password on every other account you own. Change your email password first, then move on to your bank, social media, and any other accounts that may be affected.

Use a strong, unique password for each account — not a variation of the one that was compromised. If you use the same password on multiple sites (most people do), assume those accounts are also at risk and change them too.

Step 2: Turn on two-factor authentication

Two-factor authentication (2FA) means that even if someone has your password, they still can't get in without a second code — usually sent to your phone or generated by an app. If you don't have 2FA on your email and bank accounts right now, enabling it is the single most impactful thing you can do after changing your passwords.

Use an authenticator app (Google Authenticator, Authy, or 2FAS) rather than SMS text messages when possible — SMS-based 2FA can be intercepted, while app-based codes cannot.

Step 3: Check what's connected to your accounts

Most major platforms — Google, Facebook, Apple, Microsoft — have a "security" or "active sessions" page that shows every device and app currently logged into your account. Review these immediately and revoke access to anything you don't recognize.

Also check "connected apps" or "third-party access" sections. Attackers sometimes grant themselves ongoing access through a connected application even after you change your password. Removing unknown apps cuts that off.

Step 4: Contact your bank if any financial accounts are involved

If your bank account, credit card, or any financial service was accessed or charged, call the institution directly using the number on the back of your card — not a number from an email or search result. Report the unauthorized activity, dispute the charges, and ask them to flag your account for suspicious activity.

If you suspect identity theft — someone opening accounts or taking loans in your name — you can place a free credit freeze with all three bureaus (Equifax, Experian, TransUnion). A freeze prevents new credit from being opened in your name and costs nothing to set up or remove.

Step 5: Figure out how it happened

Once you've stopped the bleeding, take a breath and trace back to the source. Common causes:

• Reused password from a data breach — your email and password were leaked from another service and tried on your accounts. Check haveibeenpwned.com to see if your email appears in known breaches.
• Phishing link — you clicked a link in an email or text that captured your credentials on a fake login page.
• Malware on your device — software was installed that logged your keystrokes or stole saved passwords from your browser.
• Weak or guessed password — your password was short, common, or easy to guess.

Understanding the root cause helps prevent it from happening again — and tells you which other accounts may be at risk from the same vulnerability.