When Things Go Wrong: Recovering a Hacked Account or Device

Unit VI is where Dr. Al-Doori's book closes: with evidence and investigation. Before we meet professional investigators in Lessons 6.3 to 6.5, we start with the moment most people actually face — the morning you realise someone else has been inside your account or on your device.

What you'll be able to do

You will be able to follow a step-by-step recovery playbook after an account or device compromise, keeping the evidence you may need later.

• Recognise the common signs that an account or device has been taken over.
• Work through the recovery steps in an order that limits the damage.
• Keep simple personal evidence — screenshots, messages and emails — without slowing your recovery down.

Signs that something has gone wrong

A compromise means someone has gained access to an account or device without your permission. It rarely announces itself clearly. Typical signs include:

• Your password suddenly stops working.
• You receive a "new sign-in" or "password changed" alert that you did not trigger.
• Friends tell you they received strange messages from you, often asking for money, gift cards or a "quick favour".
• Your sent folder contains emails you never wrote.
• You get sign-in approval prompts you did not start (Lesson 4.5).
• Settings have changed: a new recovery phone number, a new recovery email, or a rule that forwards your mail somewhere else.
• A list of "devices where you're signed in" shows a device or location you don't recognise.
• Money has moved, or a purchase appears that you did not make.

None of these signs proves exactly what happened. Together, they tell you it is time to act calmly, quickly and in the right order.

The recovery playbook

The steps below follow current guidance from the UK National Cyber Security Centre (NCSC) and the US Federal Trade Commission (FTC). If you think the device itself may be infected, do the account steps from a different device you trust, where you can.

• 1. Get back in through the official route. Open the service's app or type its address yourself, then use its own account-recovery process. Do not use a link from an email or text that "helps" you recover — attackers send those too (Lesson 3.2).
• 2. Change the password to a new, unique one. Let your password manager generate it (Lesson 4.4). Then change the same password anywhere else you reused it, starting with your email and your financial accounts, because one stolen password is tried on many sites (Lesson 4.2).
• 3. Sign out of all other sessions. Most major services offer "sign out of all devices" or a list of active sessions. This matters because an attacker may still be signed in even after you change the password.
• 4. Check what the attacker may have changed. Look at your recovery email and phone number, any email forwarding rules or filters, connected apps, and any extra sign-in devices or security keys that were added. Remove anything you did not set up. If the account uses security questions, change those answers too — the book gives the same advice in Chapter 12.
• 5. Turn on multi-factor authentication (MFA) or a passkey. Use the strongest option the account offers (Lessons 4.5 and 4.6), so a stolen password alone is no longer enough.
• 6. Scan and update your devices. Install pending updates and run your device's built-in security scan (Lesson 5.4). If malware is found or the device keeps behaving strangely, get help before trusting it with passwords again.
• 7. Warn your contacts. Tell friends and family, through another channel, to ignore messages sent from your account during the takeover.
• 8. Check your money and report. Review bank and card statements. If money or payment details are involved, contact your bank straight away using the number on your card. Lesson 6.2 covers what to collect when you report.

Why this order? Steps 1 to 4 lock the attacker out and close the doors they may have left open for themselves. A forwarding rule, for example, keeps sending copies of your mail to an attacker even after you have changed your password. Steps 5 to 8 make the account harder to take again and limit the harm to other people.

Keep your own evidence while you recover

Recovering and keeping evidence are not competing jobs. A few minutes of careful record-keeping can help later when you talk to your bank, the platform's support team or the police. This is personal evidence keeping — what an ordinary person saves. Professional preservation (forensic copies, write blockers, hashes) is a different job, covered in Lesson 6.4.

Before you delete or undo anything, keep:

• Screenshots of alerts, the unfamiliar sign-in or device list, any forwarding rule the attacker created, and messages sent in your name. Make sure the date and time are visible.
• Messages and emails — the original alert emails and any suspicious messages. Don't delete them; move them to a folder.
• A short written log: what you noticed, when, and each step you took. For example: "Tuesday 07:10 — password-changed alert I did not request. 07:25 — recovered account, removed unknown forwarding rule."
• Payment details of any loss: dates, amounts and where the money went.

Store copies somewhere the attacker cannot reach — for example, on your own device or printed — not only inside the hacked account. Keep this material private. It is for you, your bank, the service provider or the police, not for posting online.

A simple rule keeps the two jobs in balance: capture first, then clean up — but take seconds, not hours. If an attacker is actively changing your settings, regaining control comes first.

Real-World Example

Imagine a student, Sami (a fictional person), who wakes to a "your password was changed" email from his email provider. He opens the provider's app himself rather than tapping the link in the email, uses its recovery process, and gets back in. Before removing anything, he screenshots the sign-in alert and a new rule that forwards every message containing the word "invoice" to an unknown address. Then he deletes the rule, changes his password using his password manager, signs out of all sessions, removes an unfamiliar recovery phone number and turns on a passkey.

His log later helps his bank: two days earlier, a fake "invoice" email had been sent from his account to his flatmate, asking for rent to be paid into a new account. Because Sami saved the evidence, his flatmate's bank could see when the account was taken over and which message was fraudulent.

Why This Matters in 2026

Recovering from an attack is now treated as part of security itself, not an afterthought. The NIST Cybersecurity Framework 2.0 organises security into six functions — Govern, Identify, Protect, Detect, Respond and Recover. NIST's incident-response guidance (SP 800-61 Revision 3, April 2025) maps response activity onto Detect, Respond and Recover. That guidance is written for organisations, but the logic is the same for you: notice, contain, recover, learn.

Dr. Al-Doori's Chapter 12 gives the core instinct — change the password and security answers the moment you suspect a compromise. Current guidance from the NCSC and the FTC builds that instinct into a full sequence: sign out of every session, check forwarding rules and recovery details, turn on MFA, scan your devices and warn your contacts.

Turning on MFA during recovery matters. A 2023 Microsoft Research study found MFA reduced the risk of account compromise by about 99.2% across the accounts it measured. Your email deserves the most attention: the NCSC describes it as the gateway to resetting your other accounts.

What Would You Do?

It is late evening. Your phone shows two things within a minute: an email saying your email password was changed, and a text from your cousin asking why you just messaged her for gift-card codes. Your laptop is closed on the desk and you have a password manager on your phone.

Before reading on, write down — privately, for yourself — the first five things you would do, in order. Then check your plan against the answer note below.

Knowledge Check

Key Takeaways

• Act calmly, quickly and in order: recover through the official route, change the password, sign out everywhere, then check what the attacker changed.
• A new password is not enough on its own — attacker sessions, forwarding rules and recovery details must be cleared too.
• Turn on MFA or a passkey during recovery, and change any reused passwords, starting with email and money.
• Capture first, then clean up: dated screenshots, original emails and a short log, stored outside the hacked account and kept private.
• Personal evidence keeping is not forensic imaging; professional preservation comes in Lesson 6.4.

Sources

• UK NCSC — Recovering a hacked account
• US FTC — How To Recover Your Hacked Email or Social Media Account
• NIST — NIST Revises SP 800-61: Incident Response Recommendations and Considerations
• NIST — The NIST Cybersecurity Framework (CSF) 2.0
• UK NCSC — Top tips for staying secure online
• Microsoft Research — How effective is multifactor authentication at deterring cyberattacks? (2023)
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapters 12 and 21