Your email or social media account has been hacked
Two different things get called “hacked”, and they need opposite responses. If someone is inside your account, you are recovering it. If someone has copied your name and photographs into a new account, yours is untouched and there is nothing to recover — you are reporting an impersonation. Work out which one you have before you do anything else.
What this page is
The recovery and reporting routes published by An Garda Síochána, the National Cyber Security Centre and the platforms themselves, with a link to each. We do not investigate an individual reader’s incident, and we cannot contact a platform, a bank or the Gardaí on your behalf.
First, work out which one this is: taken over, or copied
The two look similar from the outside — your contacts are getting strange messages either way — and the advice for one is useless for the other. Changing your password does nothing about a cloned profile. Reporting a fake account does nothing about an intruder reading your mail.
Taken over — someone is inside your account
- •Your password no longer works, or you were signed out and cannot get back in.
- •The email address or phone number on the account has been changed to one you do not recognise.
- •Posts, messages or sent items appear that you did not write.
- •You are getting security alerts for sign-ins from devices or places that are not yours.
This page is for you. Go to the section that matches you: still able to sign in, or locked out.
Copied — someone built a fake account using your name
- •You can still sign in normally, and nothing on your account has changed.
- •A second profile exists carrying your name and your photographs.
- •Contacts tell you they got a friend request or a message from “you” — from an account that is not yours.
Your account is fine and there is nothing to recover. Report the fake profile to the platform, tell your contacts not to engage with it, and read what the fake account is being used for: the “hi Mum” message and fake Facebook shops.
Both can be true at once. An account that has genuinely been taken over is then used to impersonate you to your own contacts — that is usually the whole point of taking it. If you cannot sign in, treat it as a takeover.
If you can still log in: the five minutes that matter
Order matters here, and almost everyone gets it wrong by starting with the account that was hit.
1. Change your email password first
Your email account is the reset route into everything else you own — your bank, your social accounts, your shopping accounts all send their password-reset link there. Securing a Facebook account while the attacker still reads the inbox that can reset it achieves nothing.
2. Then the account that was hit, and anything sharing that password
If the password was used anywhere else, those accounts are already open. Change them too, and give each one something different.
3. Turn on two-factor authentication
An Garda Síochána names it directly in its advice on hacked accounts: “use two-factor authentication to secure your accounts”. An authenticator app or a hardware security key is harder to intercept than a code sent by SMS.
4. Find what has been left behind
A password change does not remove the ways back in. Whoever was in there will have set up at least one, and these are where they live.
5. Read your sent items and your message requests
Whatever went out from your account went to people who trust it. You need to know what was sent and to whom before you warn them.
Mail forwarding rules and filters
A rule that quietly copies your incoming post to someone else survives a password change. On an email account, check this before anything else.
The recovery email address and recovery phone number
If these have been switched, the account can be taken back off you at will. Set them to addresses and numbers you control.
Connected and authorised apps
Third-party apps you once granted access keep that access after a password change. Remove anything you do not recognise or no longer use.
Active sessions and logged-in devices
Most platforms list where the account is currently signed in and let you sign out of every other session at once. Do that, then change the password again.
If card details, bank logins or payment information were exposed, ring your bank now on the number printed on the back of your card — not a number from an email or a message. Our reporting guide sets out that route.
If you are locked out: the platform’s own recovery route
There is one way back into an account and it belongs to the platform. The Garda advice says the same, pointing at the backup address: use it “to try and regain access to your account with the help of your service provider”.
Start recovery yourself, from the links below. Do not hand the job to anyone who contacts you offering to get the account back, whether for a fee or as a favour.
Recover a Hacked Account — Facebook Help Centre
https://www.facebook.com/help/1216349518398524Google — Gmail, YouTube, Google Photos
Secure a hacked or compromised Google Account. If you cannot sign in at all, Google sends you to its account recovery page.
https://support.google.com/accounts/answer/6294825Microsoft — Outlook.com, Hotmail, Live
How to recover a hacked or compromised Microsoft account
https://support.microsoft.com/en-us/account-billing/my-outlook-com-account-has-been-hacked-35993ac5-ac2f-494e-aacb-5232dda453d8How to recover a compromised account — WhatsApp Help Centre
https://faq.whatsapp.com/1131652977717250We link these routes rather than walking you through them, deliberately. Platforms redesign recovery flows regularly, and a screen-by-screen description written today would be wrong within months — it would have you looking for a button that is no longer there while you are already panicking.
Not every platform is listed above. For anything else, find the recovery route in that platform’s own help centre and start it from there — never from a link in an email or a message telling you your account has a problem.
What to keep before you do anything else
An Garda Síochána puts evidence before reporting, and the order is not arbitrary. Its advice is to report it to your local Garda station and “keep a copy of the suspicious activity, including last login records, or a screenshot of the login page showing you were locked out”. That screenshot only exists while you are still locked out.
A screenshot of the login or lockout screen showing that you cannot get in. Once you are back into the account, this is gone.
Last login records — where and when the account was signed into — wherever the platform shows them.
Screenshots of anything sent from your account, including messages a contact received rather than ones you can still see.
The date and time you first noticed, and what happened immediately before it: a link you opened, a code you passed on, a login page that asked twice.
Any message demanding money to hand the account back.
The email address or phone number your recovery details were changed to, if the platform will show it to you.
Save it somewhere that is not the account in question — a folder on your own device, not the cloud drive attached to the mailbox you are trying to get back.
Reporting it in Ireland — where it goes, and where it does not
An Garda Síochána — your local Garda station
The Garda advice on hacked accounts is to “report it to your local Garda station”. There is no online portal for this and no national email address: you go to a station, in person, with the evidence you kept. The Garda cyber crime section routes online crime the same way.
Find your station in the Garda station directoryThe directory carries its own reminder, and it applies here too: in an emergency, always phone 999 or 112. A hacked account is not usually an emergency — a threat to someone’s safety is.
The platform — always, and first if you want the account back
A Garda report records the crime. It does not restore your access or take down what was posted in your name; only the platform can do that. The NCSC is explicit on where this belongs: a social media account problem “should be reported directly to the Social Media platform and not to the NCSC”.
Not the NCSC, and not the Cyber Crime Bureau directly
Both names come up when people search for somewhere official to report to, and neither takes a report from a member of the public about a personal account.
- The National Cyber Security Centre. Its incident response team, CSIRT-IE, “has a strictly defined list of constituents it serves in regard to incident response” — Irish Government bodies and critical national infrastructure providers. Its own contact page says “Cyber Crime and Online Scams should be reported to An Garda Siochana”.
- The Garda National Cyber Crime Bureau. The Bureau forensically examines devices seized in criminal investigations, investigates cyber-dependent attacks on computer systems, corporate networks and critical national infrastructure, and gives prevention advice. It is not a public report desk: its own page tells anyone who has been a victim of online crime or abuse to report it to their local Garda station.
If money moved, your bank first
A bank can attempt to stop or recall a payment, and the window for that is short. Ring them before you do anything else, then report to the Gardaí. Our reporting guide sets out who to contact in what order.
What we cannot do
We do not take on an individual reader’s case. We cannot contact a platform, your bank or the Gardaí for you, recover an account, or tell you what will happen in your particular incident. What we can do is make sure the route you are about to take is the real one.
What your contacts are about to be sent
Your account is rarely the target. It is the tool. What is worth stealing is the trust your family, friends and customers place in a message that genuinely comes from you — and that trust gets spent within hours.
We already document what comes next, because it arrives on our ScamWatch pages from the other end: the contact who got the message.
A message from “you” on a new number
A family member is told you have lost your phone and need a payment made urgently.
Goods for sale from your profile
Your account, with its real history and real friends, becomes a shopfront selling things that do not exist.
Warn them on a different channel
If your Facebook account is gone, do not announce it on Facebook. Use a phone call, a text, a different app, or ask one contact to pass it on to a group.
Keep the warning short and specific: anything sent from this account since the day it went is not from me; do not send money; do not open the links. Vague warnings get scrolled past.
Stopping the next one
Defend the email account above all others
It is the reset route into everything else you own. Bank, social, shopping — they all send the link there. Give it your strongest, least reused password.
Two-factor authentication, starting with email and social
An Garda Síochána names it directly in its advice on hacked accounts. An authenticator app or a hardware key is harder to intercept than an SMS code.
A different password on every account
A password reused across sites turns one company’s breach into every account you own. This is the single change that does the most.
Keep a recovery email and phone number current
The Garda advice points at the backup email as the way back in. An old address you no longer read is not a route back.
Never pass on a verification code
A code sent to your phone is the second factor. Anyone asking you to read one out — by call, text or WhatsApp — is asking for the key.
Next
Sources
Every route on this page was loaded and read on these pages on 13 September 2026.
- An Garda Síochána — “My email or social media account has been hacked and I can’t get access anymore. What should I do?”
The source of every Garda quotation on this page: preserve evidence, report to your local Garda station, use two-factor authentication and the backup email account.
- An Garda Síochána — Cyber Crime
The Garda cyber crime section. It answers online-crime questions individually and routes members of the public to their local Garda station; it publishes no online reporting form for a hacked account.
- An Garda Síochána — Station Directory
Find your local station by division or by station name. The directory itself carries the reminder that in an emergency you always phone 999 or 112.
- Garda National Cyber Crime Bureau
The Bureau’s own page, and the source for what it does: forensic examination of seized devices, investigation of cyber-dependent attacks on systems and infrastructure, and prevention advice. It directs victims of online crime to their local Garda station.
- National Cyber Security Centre — Contact
The source of the boundary on this page. It states CSIRT-IE’s constituency, that cyber crime and online scams go to An Garda Síochána, and that a social media account problem goes to the platform and not to the NCSC. The quotation above reproduces the NCSC’s own spelling, which omits the fadas.
- Facebook Help Centre — Recover a Hacked Account
Facebook’s own recovery article.
- Instagram Support — My Instagram was Hacked
Instagram’s own recovery route.
- Google — Secure a hacked or compromised Google Account
Google’s own recovery article. It is the page that points a locked-out user at Google’s account recovery form.
- Microsoft — How to recover a hacked or compromised Microsoft account
Microsoft’s own recovery article, covering Outlook.com, Hotmail and Live addresses.
- WhatsApp Help Centre — How to recover a compromised account
WhatsApp’s own recovery route.