My account was hacked: what to do now
A free, step-by-step path to recover WhatsApp, Instagram, Facebook, Google, Apple and gov.br accounts — and why you should never pay a «hacker» to do it.
Reviewed on
Move fast
The first hours matter. Whoever got in usually changes the password, the e-mail and the recovery phone number so you cannot get back. The sooner you act, the easier it is to recover.
Do not pay anyone to get it back
If you came here looking for someone to hack the account back: don’t hire them. An ad, a profile or a message promising to recover an account in exchange for payment is almost always a scam. They charge up front and disappear — or ask for your details and break in again.
No platform sells access to your account. Recovery is free, and the path is below.
Recover through the official channel
- Open WhatsApp on your phone and confirm your number with the code that arrives by SMS. Whoever got in is signed out the moment you enter that code.
- If the app asks for a PIN you never created, the other person turned on two-step verification. Even without the PIN they lose access; WhatsApp lets you back in after seven days.
- Once you are back, create your own PIN under Settings › Account › Two-step verification.
- Tell your contacts through another channel — a call, an SMS, another network. The most common scam with a hijacked WhatsApp account is asking for money in your name.
Go to instagram.com/hacked and follow the options. If the account’s e-mail and phone number were changed, Instagram may ask for a video selfie to confirm the account is yours.
Go to facebook.com/hacked.
Google and Gmail account
Go to g.co/recover. A Google account usually unlocks everything else — e-mail, photos, saved passwords, YouTube — so start there.
Apple and iCloud
Go to iforgot.apple.com.
gov.br account
In Brazil, this is the account that opens FGTS, INSS, the Digital Work Card and income tax. Recover it through the gov.br app or at acesso.gov.br, under the forgotten-password option.
Bank and Pix
Call your bank using the number printed on the back of your card and ask for a block. Never use a number that arrived in a message.
Once you are back in, close the door
- Change the password to a new one you do not use anywhere else.
- Turn on two-step verification.
- Check the list of linked devices and end any session you do not recognise.
- Check that the recovery e-mail and phone number are still yours. Whoever breaks in usually changes them.
- In your e-mail, check that there is no forwarding rule you did not create.
File a police report
In Brazil, breaking into someone else’s account or device is a crime (article 154-A of the Penal Code). If they asked for money in your name, that is also electronic fraud (article 171, § 2º-A).
Keep screenshots, dates and phone numbers, and file the report — at a police station or through your state’s online police station. The report helps you recover the account, dispute charges, and protects you if someone used your name.
If the person who broke in is close to you
If whoever entered your account is a partner, an ex or a family member, and they seem to know where you are or who you talk to, read Is someone monitoring my phone? as well — in those cases, the order of what to do changes.
Where to get help
- SaferNet Brasil Helpline
Free, anonymous and confidential guidance on online safety and violence, by chat or e-mail. In Brazil, in Portuguese.