PanicStation.org
UK USA
us Technology & digital loss

What to do if…
your social media account is hacked or posting content you did not create

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Treat this like a possible account takeover. Secure the email tied to the account first, then use the platform’s official recovery flow, change the password, sign out other sessions, and turn on multi-factor authentication.

Do not do these things

  • Don’t click “recovery” links sent by DM, text, or comments from people claiming to be support.
  • Don’t give anyone a one-time code, reset link, password, or recovery code.
  • Don’t pay an account recovery service or a stranger who says they can get the account back.
  • Don’t keep posting from the compromised account to argue with the attacker.
  • Don’t ignore the email account tied to the profile; that email may be how the attacker keeps control.
  • Don’t make repeated rapid login attempts if the platform starts blocking you; use the official recovery route instead.

What to do now

  1. Use a trusted device and go directly to the email provider or social media platform yourself. Do not use links sent in messages, ads, search-result ads, or comments.

  2. Secure the email address tied to the social media account.

    • Change the email password.
    • Turn on multi-factor authentication.
    • Check recent activity, signed-in devices, recovery email, recovery phone, forwarding rules, and filters.
    • Remove anything you do not recognize.

  3. Use the platform’s official hacked or compromised account recovery route.

    • If you can still log in, change the social media password immediately.
    • Sign out of all other devices or sessions if the platform offers that option.
    • If you cannot log in, follow the platform’s recovery steps from its official help center.

  4. Once you are back in, remove ways the attacker could return.

    • Check that the account email and phone number are yours.
    • Remove unknown connected apps, third-party tools, or account integrations.
    • Turn on multi-factor authentication, preferably an authenticator app or security key if offered.
    • Save any backup codes somewhere private and not inside the compromised account.

  5. Reduce harm to other people.

    • Delete or hide scam posts, links, stories, ads, or messages that you can remove.
    • Post one short warning where your contacts will see it, such as: “My account was compromised. Please ignore recent links or messages from me.”
    • Do not repeat the scam link in the warning.

  6. Check for financial exposure if the account can run ads, sell items, or store payment details.

    • Look for ad campaigns, billing changes, connected payment methods, shop settings, or purchases you did not authorize.
    • If you see charges or attempted charges, contact your bank or card issuer using the number on your card, statement, or banking app.

  7. Save only what you may need later.

    • Take screenshots of unauthorized posts, messages, changed account details, suspicious logins, ad charges, and recovery notices.
    • Keep the screenshots somewhere outside the compromised account.

  8. Report the situation if money loss, identity theft, threats, or wider fraud is involved.

    • For internet crime, use the FBI Internet Crime Complaint Center.
    • For identity theft, use IdentityTheft.gov.
    • For scams or fraud reports, use the FTC fraud reporting site.
    • Use official .gov sites directly, not links sent by someone claiming to help.

What can wait

  • You do not need to work out exactly how the attacker got in right now.
  • You do not need to message every follower individually during the first pass.
  • You do not need to decide today whether to delete the account.
  • You do not need to rebuild all your privacy settings until you have control of the account and email.

Important reassurance

This is upsetting and can feel personal, but social media takeovers are often opportunistic. The useful first goal is narrow: secure the email, regain or protect access, remove the attacker’s routes back in, and warn people not to click anything.

Scope note

These are first steps to stabilize access and reduce immediate harm. Later decisions, such as deeper device checks, business account cleanup, ad billing disputes, or identity theft recovery, may need specialist help.

Important note

This is general information, not legal, financial, cybersecurity, or other professional advice. If there is an immediate danger, call 911; for non-immediate threats, stalking, extortion, or suspected crimes, contact local law enforcement as appropriate.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us