What to do if your account has been compromised
What “compromised” means
If your account (for example, your bank, email, social media or messaging account) has been compromised, it means someone has gained unauthorised access to it.
Examples include:
An unknown person using your email account to send messages to your contacts.
Your online banking account being used to transfer money without your permission.
Your WhatsApp account being taken over and used to message your contacts.
Accounts can be compromised in many ways, including:
Phishing and social engineering: Criminals trick you into revealing your login details through fake emails, SMSs, WhatsApp messages, phone calls or fake websites.
Data breaches: Your login details are exposed after another organisation suffers a data breach.
Brute force attacks: Criminals repeatedly guess passwords until they gain access.
Malware or information stealers: Malicious software on your device steals your usernames, passwords or other sensitive information.
WhatsApp verification-code scams: Criminals trick you into sharing the SMS or voice verification code needed to register your WhatsApp account on another device.
Unauthorised linked devices: A criminal may gain access to your WhatsApp account by linking another device to it.
We want to better understand the impact of you experiencing this issue, can you share your experience by filling in this online form? This will help us better protect future victims.
How to identify if an account is compromised
You might notice one or more of these signs:
You receive emails or SMSs about logins you don't recognise. Always verify these notifications are genuinely from the service provider.
Password reset emails arrive that you did not request.
Friends or family tell you they received strange messages or links from your account.
You see posts, messages or activity that you did not create.
You can no longer log in using your usual password.
Your recovery email address or cellphone number has been changed without your permission.
You notice any other unusual account activity.
For example, for your WhatsApp account you may notice
You are unexpectedly logged out of WhatsApp.
WhatsApp tells you that your account is being registered on another device.
You receive a WhatsApp verification code that you did not request.
A person claiming to be a friend, family member or WhatsApp representative asks you to send them a verification code.
You see unfamiliar devices under Linked Devices.
Messages have been sent from your WhatsApp account that you did not send.
Your contacts tell you they received unusual requests for money, information or links from your WhatsApp number.
Your WhatsApp profile, privacy or security settings have changed without your permission.
The first 30 minutes: what to do first
If you think your account has been hacked, take these steps immediately:
Do not panic and do not pay anyone who claims they can recover your account.
Go directly to the official website or app. Do not use links from suspicious SMSs, WhatsApps or emails.
Change your password if you can still log in.
Sign out of all other devices or active sessions.
Turn on Two-Factor Authentication (2FA) if available.
Check that your recovery email address and cellphone number are still correct.
If money may be involved, contact your bank immediately.
If your cellphone suddenly loses service or you suspect a SIM swap, contact your mobile network provider and your bank immediately.
Take screenshots of anything suspicious before deleting anything.
Warn your contacts if strange messages were sent from your account.
Quick emergency steps - do these right away for email, social media and other accounts
Try to regain access
Go to the service's sign-in page and use "Forgot password" or "Can't access my account".
If you can still log in:
Change your password immediately.
Use a new, strong and unique password with at least 12 characters.
Consider using a password manager to generate and store passwords securely.
Disconnect devices
Sign out of all devices or active sessions from your account settings. If you cannot do this, changing your password will often force other devices to sign in again.
Turn on Two-Factor Verification (2FA)
Enable Two-Factor Authentication (2FA) or passkeys where available. If 2FA is used, an authenticator app is generally more secure than SMS.
Check your recovery details
Ensure your recovery email address and cellphone number are still yours. If they have been changed, update them immediately.
If your cellphone unexpectedly loses signal or you suspect your SIM card has been swapped, contact your mobile network provider immediately. Criminals sometimes use SIM-swap fraud to intercept banking one-time passwords (OTPs) and account recovery messages.
Scan your devices
Run a full antivirus or anti-malware scan on every device you use to access the account.
If malware is found, remove it before signing back into your accounts to reduce the risk of the account being compromised again.
Tell your contacts
If the attacker may have sent messages from your account, warn your contacts.
For example:
"My account was hacked. If you received any strange messages or links from me recently, please don't click them and delete them. I've secured my account now."
Report to the service
Use the service’s “Report hacked account” or support process (banks, email, social media have clear reporting paths). Some include:
Microsoft Applications (Outlook, Office, etc)
Instagram: Use 'Get help signing in' → 'My account was hacked'
Be cautious of anyone claiming they can recover your account for a fee. Many recovery services advertised on social media are scams.
Quick emergency steps - do these right away for bank accounts and other financial accounts
Act immediately. The sooner you report it, the better the chance of preventing further losses.
Contact your bank using the official number in your banking app, on the back of your bank card or on the bank's official website.
Do not use phone numbers sent by SMS, WhatsApp, email or social media.
Ask the bank to:
block affected cards;
freeze or secure online banking if necessary;
review recent transactions;
stop further payments where possible;
explain whether a dispute, reversal or chargeback may be available;
provide a fraud reference number.
If your cellphone, SIM card or banking app may have been compromised, contact your mobile network provider and ask them to secure or block your SIM.
Report the incident to the South African Police Service (SAPS) and ask for a CAS number.
Keep both the bank fraud reference number and SAPS CAS number safely.
Time matters. Report suspected fraud to your bank as soon as possible. The sooner you report it, the greater the chance your bank has to block further transactions, secure your account and investigate possible recovery options.
Step-by-step recovery (if you can still log in)
If the compromised account is a financial account, contact your bank immediately before making other changes.
Then:
Change your password to a strong, unique password that you do not use elsewhere.
Sign out of all other active sessions.
Turn on passkeys or Two-Factor Authentication (2FA) where available.
Review your account settings:
recovery email address and cellphone number;
email forwarding rules;
linked devices;
connected third-party applications.
Remove anything you do not recognise.
For banking apps, review:
trusted devices;
registered beneficiaries;
transaction limits;
notification settings.
Change passwords on any other accounts where you reused the same password.
If you can’t log in
Use the provider's official account recovery process.
Contact customer support using official channels.
Gather evidence that shows you are the rightful account owner, such as previous passwords, recovery emails and screenshots.
If money has been stolen, contact your bank immediately.
Report the matter to SAPS if appropriate.
How to prevent account compromise
Use a different password for every account.
Use a password manager to create and store strong passwords.
Turn on passkeys or Two-Factor Authentication (2FA) wherever available.
If using 2FA, an authenticator app is generally more secure than SMS.
Never reuse passwords.
Avoid passwords based on personal information such as names or birthdays.
Be cautious of password reset emails and links. Instead, visit the official website or app directly.
Never approve unexpected banking app login or payment requests, even if someone claiming to be from your bank asks you to. If unsure, decline the request and contact your bank using its official contact details.
Never share WhatsApp verification codes or Two-Step Verification PINs.
Regularly review your Linked Devices.
Be cautious if a friend or family member suddenly asks for money or sensitive information through WhatsApp. Verify the request through another communication method.
Regularly review your recovery information, connected devices and linked applications.
Keep your devices updated and scan them regularly for malware.
Back up important information and store recovery codes securely.
Donate
Your generosity makes our free support possible. Please consider giving today.
Without donations, we cannot keep our service free or provide help to the most vulnerable victims of cybercrime when they need it most. As a not-for-profit organisation, every donation goes directly towards keeping The Cyber Helpline up and running. Donate now and help us support victims of cybercrime.