Social Media Account Hacked? What to Do First on Instagram, Facebook, TikTok, and X

Overview

Start here if you searched for social media account hacked because something feels wrong right now. Maybe your password stopped working, your email was changed, your followers received strange messages, or you noticed posts you did not create. The details vary by platform, but the recovery logic is broadly similar.

The goal is not just to get back in. It is to secure the account, limit the spread of scam messages, protect linked business tools, and preserve enough evidence in case you need support or need to warn collaborators, clients, or your audience.

Use this order:

1. Confirm what changed. Check whether you can still log in on any device, whether your recovery email or phone number still matches, and whether suspicious posts, ads, or direct messages were sent.
2. Secure the email account tied to the profile. If your email is compromised, every social account linked to it may stay vulnerable.
3. Change passwords and sign out other sessions. Do this for the social platform first if you still have access, then your email, password manager, and other sensitive accounts.
4. Turn on two-factor authentication. App-based authentication is generally stronger than SMS if the option is available to you.
5. Review connected apps and business tools. Remove unknown third-party access, ad account permissions, and suspicious linked devices.
6. Document everything. Take screenshots of emails, login alerts, unauthorized posts, and changes to profile information.
7. Warn affected contacts carefully. Tell your audience or team not to click links or respond to recent messages from the account if it was used to spread scams.

One important principle: avoid random recovery links shared in comments, direct messages, or unofficial videos. Hackers often target victims twice, first by taking the account and then by offering fake recovery services. If you are already dealing with fraud or deceptive messages, our guide to bank scam alerts may also help you recognize follow-on account lock texts and fake verification notices.

What counts as a hacked account?

Not every access problem is a hack. Common scenarios include:

• You were locked out after forgetting a password.
• Your account was disabled or restricted by the platform.
• A linked email account was compromised, which then exposed your social accounts.
• You entered your credentials into a phishing page.
• A third-party scheduling, analytics, or creator tool was abused.
• A former employee, contractor, or collaborator still had access.

The practical response is similar at first, but the support path may differ. If you still have partial access, move quickly before the attacker changes your recovery details.

First-response checklist for any platform

Before the platform-specific steps, work through this short list:

• Check your email inbox for security alerts, password reset notices, or warnings that your email or phone number changed.
• Search your sent folder and trash for deleted alerts.
• Change the password on the affected social account if you can still log in.
• Change the password on the connected email account.
• Review logged-in devices and active sessions.
• Remove unfamiliar connected apps.
• Save screenshots of suspicious activity.
• Tell close contacts not to trust recent DMs, crypto requests, sponsorship pitches, or urgent payment messages.

Instagram hacked: what to do first

If you still have access to Instagram, change your password immediately, review login activity, and enable two-factor authentication. Then inspect your profile details for changes to your email address, phone number, linked Meta accounts, bio links, and display name. Attackers sometimes alter all of these at once to slow recovery.

If you are locked out, use Instagram's account recovery flow from the login screen and look for options that address a compromised account rather than a simple forgotten password. Be prepared to verify your identity through the methods the app offers at that time. Recovery tools can change, so focus on official in-app or official help center pathways, not screenshots from old tutorials.

After you regain access, check for:

• Unknown linked accounts in Meta's account center or related settings
• Unauthorized reels, stories, or DM spam
• Changed recovery contact details
• Suspicious bio links pointing to scams, fake giveaways, or crypto pages
• Saved payment methods or ad tools you do not recognize

Facebook account recovery basics

With Facebook, the biggest risk is often broader than the profile itself. A compromised personal account can expose Pages, ad accounts, Business Manager access, Marketplace conversations, and linked Instagram tools. If you still have access, start by changing your password, signing out of other sessions, and reviewing where you are logged in. Then inspect Page roles, business permissions, payment settings, and linked accounts.

If you cannot log in, use Facebook account recovery options tied to your known email, phone number, or identity confirmation route. Avoid searching for recovery shortcuts on third-party sites. Once inside again, review recent posts, private messages, Marketplace activity, ad campaigns, and security alerts.

Also check whether scammers messaged your friends or followers pretending to sell items, ask for emergency payments, or push “investment” schemes. That cleanup is part of recovery.

TikTok hacked help

TikTok compromises often show up as login problems, changed profile details, unexplained follows, or spammy posts. If you can access the account, change the password, review devices, enable extra login protection where available, and verify that your phone number and email are still yours. Remove suspicious devices and unknown social logins.

If you are locked out, use TikTok's official support and recovery options from the app or help center. Document username changes, profile edits, or unauthorized content before it disappears. If your account has a creator or brand role, notify team members not to approve any unusual partnership messages or file downloads sent from the account while recovery is in progress.

X account compromised: immediate steps

If your X account appears compromised, act quickly because attackers may use it to post scam links, impersonate you, or spread false urgent claims. If you can still log in, change the password, revoke other sessions, review connected apps, and enable two-factor authentication. Then audit recent posts, direct messages, profile changes, and email settings associated with the account.

If access is gone, use official recovery tools and check your email for notices about password resets, email changes, or suspicious login attempts. After recovery, remove third-party posting tools you no longer use. Old integrations are a frequent weak point for public-facing accounts.

Maintenance cycle

This topic stays useful because the exact buttons change, but the maintenance routine does not. If you manage a personal brand, a newsroom account, or creator channels across platforms, treat recovery prep as a recurring task rather than a one-time setup.

A practical maintenance cycle looks like this:

Every month

• Review active sessions and logged-in devices on each major social account.
• Check that your recovery email and phone number are current.
• Confirm that two-factor authentication is still enabled.
• Audit third-party apps, social schedulers, link tools, and creator platforms.
• Update passwords if you suspect reuse, phishing, or previous exposure.

Every quarter

• Review who has admin, editor, or business access.
• Remove former employees, agencies, contractors, or collaborators who no longer need entry.
• Export or back up important account information where the platform allows it.
• Test whether your team knows the recovery procedure and where to find official support links.

After any major event

• Change credentials after phishing attempts, suspicious sponsorship emails, or device theft.
• Review account security after travel, especially if you signed in on borrowed devices or unfamiliar networks.
• Audit permissions after connecting a new tool for analytics, automation, or content repurposing.

If you publish quickly across regions or languages, make one internal document with official recovery pages for each platform, primary backup contacts, and a short communications template for telling followers an account was compromised. That makes response faster and reduces confusion during live incidents.

For publishers and creators, the maintenance value is simple: when a support flow changes, you update one evergreen checklist instead of relearning the entire response from scratch.

Signals that require updates

If you are maintaining this as a newsroom utility, team handbook, or creator resource, revisit it whenever user behavior or platform workflows shift. The core advice stays stable, but certain signals mean your guide needs a refresh.

1. Login and recovery labels change

Platforms regularly rename menus, move account center tools, or change how they describe suspicious activity. If readers can no longer find the settings you mention, update screenshots, navigation terms, and troubleshooting notes.

2. The platform adds or removes security options

Two-factor authentication methods, backup codes, passkey support, and device review screens may change. If a stronger login option becomes available, your guidance should reflect it.

3. A scam trend shifts the risk

Phishing campaigns evolve fast. One season it may be fake copyright strikes, then fake brand deals, then urgent “verification” emails. If attackers are using a new lure to steal credentials, update the warning signs section. Similar scam patterns also appear in our guides to job scam warning signs and rental scam alerts, where urgency and impersonation are common tactics.

4. Readers are confusing hacks with platform enforcement

Search intent can shift. Sometimes readers looking for “account hacked” are actually trying to solve a suspension, lockout, or identity verification problem. If that happens, clarify the difference near the top of the article so users do not waste time on the wrong path.

5. Support response patterns change

Even without citing specific service-level claims, you may notice readers asking the same questions: whether they should try old usernames, what to do if the recovery email was changed, or how to protect linked business assets. Those questions are signs your guide needs stronger detail in practical sections.

Common issues

Most account recovery problems are not technical mysteries. They are delays caused by a few recurring mistakes. Knowing them in advance can save time.

The attacker changed your email and phone number

This is common and stressful, but not unusual. Search your inbox for any notice that your account details changed. Those messages sometimes contain a reversal link or at least a timestamp you can use in support requests. Save those emails before they are buried.

You can log in on one device but not another

If you still have one trusted session open, use it immediately to change your password, review active sessions, and verify recovery methods. Do not log out until you confirm the account is secured and your own recovery details are restored.

You used the same password elsewhere

If the compromised password was reused across email, commerce, banking, or creator tools, expand the response beyond social media. Change passwords for your email account first, then any high-risk linked services. Password reuse turns a single breach into a broader identity problem.

A linked app caused the problem

Old automation tools, browser extensions, analytics dashboards, and social scheduling platforms can create risk if they are abandoned or poorly secured. Revoke anything you do not recognize or no longer need. Keep the list short.

Your audience is being targeted

Attackers often use compromised accounts to send fake giveaways, investment links, romance scams, urgent money requests, or “brand opportunity” pitches. Post a clear update once you regain access. Keep it simple: the account was compromised, recent messages should be ignored, and followers should not click old links.

You are dealing with more than one outage at once

Sometimes a hacked account coincides with travel, weather disruption, power issues, or device loss. In those cases, official alerts matter. If you are trying to recover access during broader disruptions, resources like weather emergency alerts near me, power outage updates, or the emergency alert test schedule can help you separate a platform problem from a local service interruption.

Fake recovery offers appear after the hack

This is one of the most common secondary scams. Be cautious if someone comments that a “specialist” can restore your account, asks for payment in advance, wants your one-time codes, or tells you to contact an unrelated messaging account for help. Official support may be imperfect, but handing your codes to a stranger usually makes things worse.

When to revisit

Return to this topic on a schedule, not just during a crisis. Social account recovery is one of those subjects that feels static until the day you need it. By then, menus may have moved, team access may be outdated, and your backup email may no longer be current.

Revisit your recovery plan:

• Every 3 to 6 months for personal creator accounts
• Monthly for brand, media, or revenue-critical accounts
• After hiring or offboarding anyone with access
• After connecting new third-party publishing tools
• After suspicious emails, fake verification prompts, or phishing attempts
• After device theft, travel-related login issues, or password reuse concerns

Here is a practical five-minute refresh routine:

1. Open each platform's security settings.
2. Confirm your recovery email and phone number.
3. Review active sessions and remove old devices.
4. Check two-factor authentication and backup methods.
5. Audit connected apps and business permissions.
6. Save the official recovery links in a trusted note or password manager.

If you manage multiple public channels, create one short incident template now:

• Who owns the master email
• Who has admin access on each platform
• Where official recovery links are stored
• How to alert staff, collaborators, and followers if an account is abused
• What evidence to capture before changes are reversed

The most useful mindset is simple: treat account security as maintenance, not drama. A hacked profile is disruptive, but a documented process, current recovery details, and regular permission reviews make it much easier to contain. And if search intent shifts or support flows move, this is the kind of guide worth revisiting and refreshing on a regular cycle.