Recover from a hacked social media account

Approaches to dealing with a hacked social media account

Follow these steps once you have secured access to the account:

• Remove any suspicious apps – Review the apps connected to your account and remove any that you do not recognise or no longer need.

• Check your security and privacy settings – Review connected devices, active sessions, recent logins and other security settings. Take screenshots of suspicious activity before removing it where this may be useful as evidence. Check that recovery details and other security settings have not been changed in a way that could allow the attacker to regain access.

• Scan your devices for malware – Malware can sometimes be used to steal passwords or other information. Scan the devices you use to access the account with an appropriate security or anti-malware solution and follow the provider's instructions if malware is detected.

• Check your recent activity – Review recent posts, comments, direct messages, advertisements and other activity. Look for anything suspicious or anything that may have been used to scam or mislead others.

• Delete unauthorised content – Once you have preserved any evidence you may need, remove posts, comments, direct messages, advertisements or other content created by the attacker.

• Set up recovery details – Make sure you have a recovery email address and/or phone number linked to the account. These can help you regain access if you are locked out in future.

• Think about what information was exposed – Consider what personal information was stored in the account. This may include identity documents, payslips, proof of address, banking information, one-time passwords or other private information that could be used to impersonate you. If banking information or financial accounts may have been exposed, contact your bank immediately using a trusted number, such as the number on the back of your bank card or in your banking app. Ask what additional security measures or fraud reporting steps are appropriate.

• Protect yourself against identity fraud – If identity documents, payslips, proof of address, bank statements or other personal documents were exposed, consider Protective Registration with the Southern African Fraud Prevention Service (SAFPS) and monitor your credit profile for accounts or credit applications you do not recognise. SAFPS provides Protective Registration for people whose identity has been compromised or who have experienced identity fraud. Protective Registration is a free service.

• Secure your mobile number and messaging accounts – If your mobile number was exposed or you suspect a SIM swap, contact your mobile network provider immediately. Ask them to secure your number and advise you on the appropriate fraud or SIM-swap reporting process. If you use WhatsApp, check Linked Devices, enable two-step verification, and never share your WhatsApp verification code or PIN with anyone.

• Warn others that your account was compromised – If the attacker contacted your friends, family, customers or followers, let them know that the messages or posts were not from you. Warn them not to click links, send money or share information in response to messages sent during the compromise.

• Beware recovery scams – Criminals may pretend they can recover hacked accounts for a fee. Do not pay people on Instagram, Facebook, WhatsApp, Telegram or other platforms who claim they can restore your account. Use only the platform's official app, website or help centre.

• If you are completely locked out – Follow the platform's official account recovery process. If you did not previously set up recovery options, the platform may require you to provide information to prove that you own the account.