PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your social media account is hacked or posting content you did not create

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Treat it as a possible account takeover. Secure the linked email first, then use the platform’s official recovery route, change the password, and sign out other sessions.

Do not do these things

  • Don’t make lots of rapid repeated login attempts to test passwords; this can trigger security blocks and slow recovery.
  • Don’t post arguments or threats to the attacker from the compromised account; it can confuse followers and may make scams spread further.
  • Don’t click security-alert links from DMs, texts, or emails unless you have separately opened the platform’s official app or typed its website address yourself.
  • Don’t pay anyone who claims they can recover your account; use the platform’s official recovery process.
  • Don’t assume it is only the social media account; the linked email may be how the attacker is keeping access.

What to do now

  1. Use a device you trust. Open the platform app or type the platform website address yourself. Do not follow recovery links sent in unexpected messages.

  2. Secure the email account linked to the social profile.

    • Change the email password.
    • Turn on two-step verification for the email if it is offered.
    • Check recent activity, forwarding rules, filters, recovery email addresses, and recovery phone numbers.
    • Sign out other email sessions if that option is offered.

  3. Start the platform’s official hacked-account or recovery process.

    • Use the platform’s Help, Support, hacked account, compromised account, or regain access flow.
    • If you can still log in, change the social media password now.
    • Use log out of all devices, log out of all sessions, or similar wording if the platform offers it.

  4. Remove ways the attacker may keep control.

    • Check the account email address and phone number and change back anything you do not recognise.
    • Remove third-party apps, connected apps, integrations, or account access you do not recognise.
    • Turn on two-step verification or two-factor authentication for the social account.

  5. Reduce harm to followers.

    • Once you believe you have control again, remove obvious scam posts or stories.
    • Post one brief warning, such as: “My account was compromised. Ignore recent posts or DMs and do not click links.”
    • Do not message every follower individually unless a specific person has already been harmed or is at risk.

  6. Check for money risk if the account is linked to payments, adverts, shops, or a business page.

    • Look for adverts, promotions, purchases, payment methods, shop changes, or admin changes you did not make.
    • If you see charges or attempted charges, contact your bank or card provider using the number on the back of your card or through its official app.

  7. Keep a small record.

    • Take screenshots of unauthorised posts, strange messages, account detail changes, payment activity, and login notices.
    • Save any emails from the platform about password, email, phone, or login changes.

  8. Use the right UK reporting route if there is fraud, threats, money loss, or ongoing crime.

    • If you are in England, Wales, or Northern Ireland, report cyber crime or fraud to Report Fraud.
    • If you are in Scotland, or the crime happened there, report to Police Scotland.
    • If the crime is happening now, call 999 for emergencies or 101 for non-emergencies.

What can wait

  • You do not need to work out exactly how the attacker got in right now.
  • You do not need to decide today whether to delete the account.
  • You do not need to do a full investigation of every app, device, or old password before stopping the unauthorised posting.
  • You do not need to contact every follower individually in the first phase.

Important reassurance

This can feel public and urgent because posts and DMs move fast. The immediate job is smaller: protect the linked email, regain control through the official route, remove unauthorised access, and warn people not to click recent links.

Scope note

These are first steps to stabilise the account and limit harm. Later decisions, such as deeper device checks, business-account recovery, reputational concerns, or disputed payments, may need specialist help.

Important note

This is general information, not legal, financial, technical, or professional advice. If you feel unsafe, are being blackmailed, or there are credible threats, prioritise immediate safety and contact police using the appropriate route.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us