A hack of a social media page creates two problems at the same time, and the second one usually turns out to be more serious than the first. You lose access to your own profile, while your friends and followers start receiving fraudulent messages from it, which look credible precisely because they come from a familiar person. The speed of the response is decisive here, so let's examine the sequence of actions that makes sense to follow in exactly this order.

How to Understand That an Account Has Been Hacked

The Cyber Police names several characteristic signs, and the first of them is a change in the profile settings or data without your participation. The second sign is the appearance of unfamiliar devices in the list of active sessions, which is available in the security settings of every major platform. The third is the disappearance, change, or appearance of unfamiliar content or messages in your account, including subscriptions to unknown pages and comments that you did not leave. To this, it is worth adding several more signals that often precede a complete loss of access. These include emails from the platform about a login from a new device or about a change to the linked email, messages from friends asking whether you really sent a strange request, and the sudden failure of a password that you definitely remember correctly.

The First Step, and It Is the One That Determines the Result

If you still have access to the account, the first action should not be changing the password on the social network, but checking the mailbox to which this account is linked. The reason is that email provides access to password recovery for any service, and if an attacker controls it, you can change the password on Instagram as many times as you want, and they will reset it again every time. Therefore, the sequence looks like this. First, log into your email, change the password there to a new and unique one, check the email forwarding settings and the list of rules, since a typical action of attackers is to set up automatic forwarding of your correspondence to their own address. Next, check the additional recovery addresses, delete those that you did not add, and enable two-factor authentication if it was not enabled. Only after this should you move on to the social network itself.

If You Still Have Access to the Account

Change the password to a new one that is not used anywhere else. End all active sessions on all devices, and this point is critically important, since changing the password itself does not always remove the attacker from an already open session. Check the security section for changes that you did not make, paying attention to the linked email, phone number, two-factor authentication settings, and backup codes. Review the list of connected third-party applications and services, deleting everything you do not recognize, since granting access to third-party applications is one of the most common ways of losing control over an account. Enable two-factor authentication if it was not enabled, and do this through an authenticator application rather than SMS, since the interception of messages is a separate risk that I wrote about in the material on account security.

If Access Has Already Been Lost

Every major platform has a separate official procedure specifically for cases of hacking, and you should start with it rather than searching for third-party solutions. For Facebook, there is a special hacked-account recovery page available at facebook.com/hacked, while for Instagram the analogous form is located at instagram.com/hacked. The procedure usually consists of several stages. First, the system offers to confirm your identity through the linked email or phone number, and if access to them has been preserved, recovery goes quickly. If the attacker has changed both the email and the number, the platform offers an alternative path through identity verification, which may include recording a short video of your face for comparison with the photos in the account or sending a copy of a document. This procedure is slower, and you have to wait from several days to several weeks for a response. An important detail that helps in such a situation. Instagram and Facebook send an email to the old address when the linked email is changed, and this email contains a link to cancel the change, so checking the mailbox, including the spam folder, is absolutely necessary. Another way is to contact support from another account of your own or from a friend's account through the help section, where there is an option for reporting the hacked profile of someone you know.

About Paid Recovery Services

A separate warning is needed here, because this is exactly where people lose money for the second time. In search results for queries about recovering a hacked account, there are many websites and private individuals who promise to return the page for money, and the vast majority of such offers are either ordinary scams or the sale of a service for submitting the same free official request that you can submit yourself. No third party has the technical ability to restore your access to Instagram or Facebook, since only the platform itself has this ability. A person in a state of panic after losing an account is an ideal target for a second wave of fraud, and this is exactly why these offers are promoted so actively.

Warn Your Contacts Immediately

This step should be taken in parallel with the recovery, without waiting for the result. Messages are almost always sent from a hacked account on your behalf, and the most common schemes consist of a request to urgently lend money, a link to supposedly vote for the child of an acquaintance, and an offer to make money. These messages work effectively precisely because they come from a person whom people trust, so a warning in another messenger, in stories on another platform, or simply by calling the people closest to you saves other people's money. If there were work-related or business chats in the hacked account, warn colleagues and clients separately.

When to Contact the Police

If money was obtained from you or your acquaintances through deception from a hacked account, this is already a criminal offense, and a report should be filed. To promptly report a case of fraud that has already occurred, you should contact the National Police at 102, and a report can also be submitted through the official Cyber Police website. It is worth understanding the actual division of roles that representatives of the agency themselves talk about. The Cyber Police Department focuses on major cases, that is, attacks on state registries, large networks, and companies, while individual cases of hacking personal pages mostly go to ordinary police units. This does not mean that you should not file a report, since without reports from victims, the scheme continues to operate for years, while the totality of reports makes it possible to establish a connection between individual incidents. Save all evidence before filing the report, that is, screenshots of correspondence, the details of the cards to which money was transferred, the time of the events, and emails from the platform about changes to the account.

After Regaining Access

Check exactly what the attacker managed to change, and pay attention to linked addresses, numbers, privacy settings, and the list of administrators if it is a business page.

Review the published materials and delete what appeared without you. Check whether sessions on unknown devices have remained active, and end them. Change the passwords on other services where the same or a similar password was used, since the main method of taking over accounts remains the use of username and password pairs from someone else's data breaches. Check your email address in a service that shows whether it appears in known data breaches, in order to understand where the problem could have originated.

How Not to Repeat It

A unique password for every service remains the main protection, and a password manager solves the problem of remembering them. Two-factor authentication on email is the most important single action, since email opens access to everything else. Backup codes provided by the platform when enabling two-factor authentication should be stored outside the phone, because it is the phone that you can lose together with access. Do not follow links from messages about alleged violations of the rules, complaints about your account, or blocking, since this type of mailing is the most common way of obtaining login credentials through deception. I wrote in detail about the mechanics of this pressure in the material about recognizing fraud. Regularly review the list of connected third-party applications and delete those that you no longer use.