One minute you are scrolling; the next, your profile photo is gone, your bio is advertising a crypto giveaway, and an email says your password was changed at 3:14 a.m. A hacked account rarely announces itself politely. Often it is a friend texting, "Is this link actually from you?"

What you do in the next ten minutes decides whether this becomes an irritating afternoon or a month of cleanup. Move in this order: email first, account second, people third. A profile is close to unrecoverable while the intruder still controls the inbox behind it.

Minutes 0–2: Lock down the email address behind the account

Email is the master key. Every password reset for the stolen account lands in that inbox, so if the attacker holds it, they can undo your recovery as fast as you attempt it. Work from a device you trust, not a shared or public computer.

Sign in to your email, change the password to a long passphrase you have never used elsewhere, then sign out of every other session. Open the settings for forwarding and filters. Attackers often add a quiet rule that forwards password-reset messages to an address they control, or one that sends your mail to the trash. Delete anything you did not create. Then check the recovery phone number and backup address on the account and remove any you do not recognise. If you are locked out of the email too, start the provider's own recovery process immediately, and contact their support if it stalls.

Minutes 2–5: Take the social account back

Use the platform's own app, or type the web address yourself. Never click a "restore your account" link from a message — those are a favourite way back in for the same attacker. Choose "Forgot password" and send the reset to the email you just secured.

A new password alone is not enough; the intruder's session usually survives a reset. Once you are inside, do all of this before you relax:

1. Change the password again, to something long and unique to this account.
2. Turn on two-factor authentication, preferably with an authenticator app or hardware key rather than text messages.
3. Open the security settings, review active sessions or "where you're logged in," and sign out of every device you do not recognise.
4. Check the recovery email and phone number, plus the list of connected apps and third-party logins. Remove anything unfamiliar and revoke old app passwords.
5. Read your recent posts and messages so you know exactly what will need explaining.

Setting names differ by platform — Security, Login and security, Password and security — but those five items exist almost everywhere.

Minutes 5–7: Report the hack properly

Reporting does two things: it puts your case into the platform's system, and it flags the account so a future lockout is handled differently. Use the official help centre and the "hacked account" or "account compromised" option. Have this ready:

• Your username or handle, plus the email and phone number on the account.
• The rough time you lost access, including your time zone.
• Screenshots of posts, messages or profile changes you did not make.
• Any notification emails that arrived before the takeover.
• Whether two-factor authentication was switched on at the time.

Ignore anyone who offers to recover your account for a fee, or asks for your password, a login code, or remote access to your phone. No legitimate recovery service needs those things.

Minutes 7–9: Warn the people in your contact list

Your followers are the second target. If the intruder is messaging them with investment pitches or urgent requests for money, every hour of silence costs someone.

If you can still access the account, post a short, plain update: what happened, roughly when, and that any link or payment request from your profile in the last few hours is not from you. If you are locked out, use another channel — a different app, a group chat, a text — and ask two or three trusted friends to pass it on. Ask them to report the phishing posts as well; enough reports can hide a post far faster than a support ticket moves.

The account is not the asset. The inbox behind it is. Secure the email and the profile usually follows.

Minutes 9–10: Check what else they touched

Most takeovers begin with a password that was reused somewhere else, so treat this as a warning about your whole digital footprint. Check, in this order:

• Every account that shared the old password, starting with banking, cloud storage and your main email.
• Saved payment cards inside the social account, along with ad accounts and subscriptions.
• Forwarding rules and filters in the email, once more — attackers sometimes add them on the way out.
• Devices you had forgotten were signed in, including old phones and shared laptops.

If money moved or identity documents were misused, contact your bank and consider filing a police report. For anything with real financial or legal exposure, take professional advice rather than guessing your way through it.

If you cannot get back in

Recovery forms are judged on consistency, not on how many times you fill them out. Use a device and connection you have used before with that account. Give precise dates, the original email and phone number, and any usernames you have used in the past. If the platform offers identity verification, complete it instead of jumping to a different form. Submit once, save the reference number, and wait — repeat submissions can look automated and push you to the back of the queue.

Make the next lockout boring

Once you are back in, spend fifteen minutes on the things that make a repeat attempt fail:

• Give your email and social accounts their own strong passwords, kept in a password manager rather than your memory.
• Keep two-factor authentication switched on, and store the backup codes offline — printed or in a secure note, never in the inbox they protect.
• Confirm the recovery phone and email are ones you still use.
• Review "logged in devices" every few months, and after any trip or new phone.
• Turn on your email provider's security alerts so you hear about an unfamiliar sign-in early.

If you are walking a parent, a teenager or a friend through this, do the email step together. That is the part people skip, and it is the part that decides the outcome.

Ten focused minutes now, a little tidying later, and a hacked account becomes an account again.

Photo: ThorstenF / Pixabay