How to recover a hacked Instagram, WhatsApp or Gmail account

You try to log in and your password no longer works. Or a friend tells you that you have just sent them a strange message asking for a code or for money. Your account has been taken over. What matters now is acting quickly and in the right order: first get it back, then secure it, and finally clean up whatever was done in your name.

Before anything else

• Warn your contacts through another channel (a different app, a text message, a phone call) to ignore anything that comes from that account.
• Change your email password if it is the same one you used on the stolen account. Whoever controls your email can recover everything else.
• Take screenshots of what you can see: messages sent, posts, changes to the profile. You will need them.

Instagram

1. On the login screen, tap the option to get help logging in and follow the recovery process. Instagram also has a dedicated page for hacked accounts.
2. Check your inbox: if the email address on the account has been changed, Instagram usually sends a notice to the previous address with a link to undo the change. Use it as soon as possible.
3. If you no longer have access to the email or the phone number, Instagram may ask you to verify your identity, for example with a video selfie that can be matched to the photos on the account.
4. Once you are back in, change the password, turn on two-factor authentication and review the login activity to end any sessions you do not recognise.

WhatsApp

WhatsApp is tied to your phone number, so recovery goes through it:

1. Install or open WhatsApp on your phone and register again with your number. You will receive a code by text message or call.
2. When you verify the number on your own device, the session of whoever took it is closed.
3. If it asks for a two-step verification PIN that you never set, the attacker turned it on. You will have to wait for the period the app shows before you can get in without it.
4. Once you are in, set up two-step verification with your own PIN and check the linked devices to remove any that are not yours.

Gmail

1. Go to Google's account recovery page and enter your address.
2. Answer the questions as best you can: previous passwords, recovery phone number or email. Do it from a device and a location you normally use.
3. When you regain access, change the password and turn on two-step verification.
4. Review the account's security: connected devices, apps with access, recovery addresses and, very importantly, Gmail's forwarding rules and filters. Attackers often leave a rule that quietly forwards your mail to another address.

What to do about what was posted

Getting the account back is only half the problem. The other half is what was done in your name:

• If you have recovered the account, delete the posts, stories or messages you did not write, after taking screenshots of them.
• If you cannot recover it, report the account to the platform as hacked or as impersonation, and ask your contacts to do the same.
• If messages asking for money were sent, warn the people who received them and, if anyone has paid, tell them to contact their bank straight away.
• If private photos or personal data were shared, that may be a criminal offence in Spain. Sharing intimate images without consent is punished under Article 197.7 of the Spanish Criminal Code, and accessing someone else's account without authorisation is an offence too.
• If the content has been copied outside the platform, onto other websites or profiles, each one will need its own removal request.

Reporting it and keeping evidence

Report it to the police, especially if third parties have been defrauded or private content has been shared. In Spain that means the Policía Nacional (in cities) or the Guardia Civil (in many towns and rural areas), and in Catalonia and the Basque Country the regional police. You can report in person at a station and ask for an interpreter if you need one. Take your screenshots and, if the case is serious, a forensic report certifying what happened: it carries far more weight than a simple screenshot if the matter ends up in court.

If you need guidance, INCIBE, Spain's national cybersecurity institute, runs a free helpline on 017.

So it does not happen again

• Use a different password for each service and a password manager.
• Turn on two-step verification on every important account.
• Be wary of any message asking for a code, even if it comes from someone you know.
• Check from time to time which devices and apps have access.

If you cannot recover the account, or what was posted is already circulating, we can help through our hacked account service. And if you need evidence that will stand up in court, see IT forensics. We work in English, remotely, wherever you are in Spain.