WHAT THE NCSC SAYS

Take your account
back, in order.

A hacked account is stressful, but the fix has an order.

A person seen from behind at a kitchen table at dusk, looking at a laptop with a mug and a phone beside it — AI-generated image, not a photograph of a real person or place.

Check the forwarding rules
Change reused passwords too
Turn on 2-step verification
Recover, then lock the door

The UK's National Cyber Security Centre sets out a step-by-step recovery guide. The order matters: check your email for hidden forwarding rules before you change passwords, or the new ones can be sent straight to the criminal.

Updated 16 October 2026

THE SHORT ANSWER

Email first,
then everything else.

Your email can reset every other password.
So the NCSC starts there.

STEP ONE

Go to the provider

Use the account provider's own help pages: the NCSC says the recovery process is likely to differ for each account.

Check the signs

THE TRAP

Hidden forwarding rules

Criminals often set up a rule that sends them a copy of every email, which lets them reset your passwords. Check filters and forwarding first.

The steps in order

THE LOCK

Turn on 2SV

With 2-step verification, a criminal who knows your password still cannot get in. The NCSC says it takes only a few minutes to set up.

See the numbers

A QUICK CHECK

What have
you noticed?

Pick what you have seen to read what the NCSC guidance says about it. The bar shows how strongly it points to a hacked account.

Based on the NCSC's guide to recovering a hacked account and its 2-step verification guidance. General information, not personal security advice.

Signs check

Choose what you noticedA code request on a new deviceA login from a strange place or timeMessages you did not sendLocked out, or settings changedPurchases or transfers you did not make

A code request on a new device2SV doing its job

Depending on setup, 2-step verification asks for a code when something looks unusual, such as a login from a different device.

A login from a strange place or timeLook closer

Logins or attempts from strange locations or at unusual times are one of the signs the NCSC lists. Check the account's recent activity.

Messages you did not sendAct now

Messages or notifications from your account that you don't recognise are a warning sign. Tell your contacts to treat recent messages with suspicion.

Locked out, or settings changedAct now

Being unable to log in or finding changed security settings are signs listed by the NCSC. Start with the provider's recovery process.

Purchases or transfers you did not makeBank and report

If you have lost money, the NCSC says to tell your bank and report it to Report Fraud (in Scotland, call the police on 101).

Source: NCSC, Recovering a hacked account (reviewed August 2022), and Top tips for staying secure online: Turn on 2-step verification.

TWO NUMBERS WORTH KNOWING

Guessed or tricked,
most hacks start small.

One figure on easily guessed passwords,
one on how often phishing is behind attacks.

23.2m

Breached accounts worldwide using 123456

NCSC analysis of passwords exposed in global breaches found 23.2 million victim accounts used 123456. It recommends three random words instead.

PASSWORDS · NCSC 2019

85%

UK businesses with a breach that saw phishing

In the Cyber Security Breaches Survey 2025, phishing was the most common type of attack, seen by 85% of businesses and 86% of charities that had a breach or attack.

PHISHING · DSIT 2025

The NCSC says the most common way passwords are stolen is a data breach at an organisation holding your details, after which criminals try the same password on other accounts.

A laptop on a desk beside a small open notebook and a pen, in calm natural light — AI-generated image, not a photograph of a real person or place.

THE NCSC'S STEPS

Nine steps,
one at a time.

These are the first four in the NCSC's order. The rest: update your devices, tell your contacts, check bank and shopping accounts, and report any money lost.

Contact the account provider
Follow the recovery process on its official help or support pages.
Check your email settings
Look for filters and forwarding rules you did not set up, and remove them.
Change the passwords
Change the hacked account's password and any other account that used the same one.
Log out every device and app
Then anyone else still signed in will be asked for the new password.

IF IT CANNOT BE SAVED

Start again,
and tell people.

Sometimes an account cannot be recovered. The NCSC says you will then have to create a new one if you want to keep using the service.

Give your contacts the new details and tell them the old account has been abandoned. Update any bank, utility or shopping websites that used the old details, and use official websites rather than links in messages.

Hands holding a phone over a desk, with a laptop open in the background, as if waiting for a sign-in code — AI-generated image, not a photograph of a real person or place.

Questions

Questions people ask

How do I know my account has been hacked?

The NCSC lists signs such as being unable to log in, changed security settings, messages you don't recognise, logins from strange places or times, and purchases or transfers you did not make.

Why check email forwarding before changing passwords?

A common tactic is a forwarding rule that sends criminals a copy of your emails, including password resets. Remove any such rule first, then change passwords.

Do I need to change other passwords too?

Yes, for any account that used the same password. Criminals know many people reuse passwords and try a stolen one on other accounts.

What is 2-step verification?

An extra check, such as a code by text or email, a fingerprint or an app, so that knowing your password is not enough to get in. It is also called 2FA or MFA.

Where do I report it if I lost money?

Tell your bank and report it as a crime to Report Fraud, the UK's reporting centre for cyber crime. In Scotland, contact the police on 101.

Take your account
back, in order.