Think you've been hacked? What's usually ordinary, and what to do now

If we sent you this link, something has made you wonder whether your email, your Facebook or your phone has been broken into. Take a breath: a lot of what looks like hacking has an ordinary explanation, and the rest has a clear set of steps from the company that runs the account. This page sorts one from the other, then gives each company’s own steps in order. If you’d rather not do it alone, we offer a home visit to check your phone, computer and accounts with you.

One rule before anything else: do the fixing from a phone or computer you trust, and type the company’s address in yourself. Never use a link in a message that says you’ve been hacked.

Is it hacking, or something ordinary?

Some signs usually have an everyday cause, and some mean someone else has been in your account. Tap what you’ve noticed to see which it is and the first thing to do.

Tap what you've noticed

Friends got odd messages from me I can't sign in A password change I didn't make My phone is slow or hot Pop-ups on the screen

Act now Usually an ordinary explanation

Friends got odd messages from me

Act now

Scamwatch says scammers hack social media accounts to message your contacts, pretending to be a friend in need.

First step

From a phone or computer you trust, go to the account yourself and change the password. Then tell your friends by phone or text that it wasn't you.

I can't sign in

Act now

Apple lists a password that stops working as a sign someone else may be in the account. Check first that you've typed it exactly, capitals and all, as Google suggests.

First step

Type the company's own address and use its reset or recovery page: iforgot.apple.com for Apple, Google's account recovery page, Forgot my password for Microsoft, or facebook.com/hacked.

A password change I didn't make

Act now

Apple lists an alert about a password change you didn't make as a sign your account has been compromised.

First step

Don't use the alert's link. Go to the account yourself, change or reset the password, and turn on two-step sign-in.

My phone is slow or hot

Usually an ordinary explanation

Apple says an iPhone gets warm while it sets up, updates, charges wirelessly, uses the camera or streams video, and cools down after.

First step

Update the phone, and check for apps you don't recognise. On Android, turn on Play Protect in the Play Store.

Pop-ups on the screen

Usually an ordinary explanation

Apple calls these misleading pop-ups that say your device has a security problem. Microsoft says its own warnings never include a phone number.

First step

Close the tab. Don't ring the number or tap the link.

What you've noticed, what it usually means, and the first step

What you've noticed	What it usually means	First step
Friends got odd messages or posts from you	Act now. Scamwatch says scammers hack accounts to message your contacts	Change that account's password from a device you trust
You can't sign in	Act now if you're sure the password is right. Apple lists a password that stops working as a sign	Use the account's own reset or recovery page, typed in yourself
An alert about a password change you didn't make	Act now. Apple lists it as a sign	Go to the account yourself, not through the alert, and change the password
The phone is slow or warm	Usually ordinary. Apple says a phone gets warm during updates, charging and video	Update the phone, and check for apps you don't recognise
Pop-ups saying you have a virus	Usually a web page trying to scare you, not a hacked phone	Close the tab. Don't ring the number or tap the link

Which signs usually have an ordinary explanation?

A warm or slow phone, a pop-up that says you have a virus, and a frightening email claiming someone hacked your webcam are usually not what they seem. Here is what the makers and Scamwatch, the government’s scam service, say about each.

The phone is slow, or warm

A phone that feels warm is usually just busy. Apple says an iPhone may feel warm while you set it up, restore it from a backup, install a software update, charge it wirelessly, use the camera or demanding apps, or stream high-quality video, and that it should cool down once the task ends.

It’s still worth a two-minute check, because Google lists a very slow phone among the signs of harmful software on Android, along with messages about a virus and storage space disappearing. The checks for each kind of phone are in the section on checking your phone below.

Pop-ups saying you have a virus

A pop-up warning on a web page is the web page, not your phone. Apple calls these “misleading pop-ups and ads that say your device has a security problem”, and its advice is not to call the number or follow the links. Microsoft says its own error and warning messages never include a phone number.

Don’t tap anything on it, because Apple warns that some have fake close buttons: close the Safari window or tab instead. If pop-ups keep coming back with the browser closed, Google lists that as a sign of unwanted software on Android, and the phone checks below deal with it. A pop-up that sends you to a phone number is the start of the same trick as the fake Telstra or NBN technician call, so never ring it.

An email saying they hacked your computer or webcam

These emails threaten to release videos unless you pay, usually in cryptocurrency. Scamwatch says there is no evidence that the criminals sending them really have access to anyone’s webcam or computer, and that the personal details in them most likely come from old data breaches. Don’t reply and don’t pay. Delete it, and report it to Scamwatch if you like.

An email saying there was an unusual sign-in

This one can be real or fake, so don’t use its link either way. Microsoft does send an email and a text when someone signs in from a new place or device, and its page names the one address its genuine alerts come from. Scammers copy these alerts too. Go to the account yourself, by typing the address, and check its recent activity there. Google says it never asks for your password or verification codes by email, phone call or message. How to check a message without clicking it shows the method.

Which signs mean act now?

Three signs mean someone else has probably been in an account: your friends got messages or posts you didn’t send, your password suddenly stopped working, or you got an alert about a change you didn’t make. Apple and Google both list these on their own pages.

Do these in order, from a phone or computer you trust:

1. 1

   Go to the account yourself

   Type the company's address into the browser, or open its own app. Never use a link in an email or text about the problem.

2. 2

   Change the password, or reset it

   If you can still sign in, change the password straight away. If you can't, use the company's own recovery page, below.

3. 3

   Turn on two-step sign-in

   A code sent to your phone, or a tap on your phone, as well as the password. Scamwatch's advice is to use multi-factor authentication wherever you can.

4. 4

   Check what they changed

   Your recovery phone number and email, any forwarding, and the list of devices signed in. Remove anything you don't recognise.

5. 5

   Change the same password everywhere else

   Google says to change it on any other site that used the same password. One strong, different password for each account stops one break-in becoming five.

The Australian Cyber Security Centre’s emergency guide for a compromised email account gives the same checklist, and adds signing out of every other session. Keeping a different password for every account is much easier with the password manager already on your phone.

If a friend has had a strange message from you, tell them by phone or text that it wasn’t you. IDCARE, the national identity and cyber support service, suggests letting friends and family know through a different channel from the hacked account.

What to do if your email has been hacked

Sign in and change the password, or use the provider’s recovery page if you can’t get in, then check the email settings for anything you didn’t set up. Here are Google’s and Microsoft’s own steps.

Gmail (a Google Account)

Google’s page to secure a hacked or compromised Google Account (opens in a new tab) lists the signs, including emails in your Sent folder that you didn’t write and email you’ve stopped receiving.

1. 1

   Sign in, or recover the account

   If you can't sign in, Google's account recovery page asks questions to check it's you. Google's tips: answer as many as you can without skipping, and use a device and place where you usually sign in.

2. 2

   Review security events

   In your Google Account, open Security & sign-in, then Review security events. For anything you didn't do, select No, it wasn't me and follow the steps.

3. 3

   Remove devices you don't know

   Under Your devices, select Manage devices, and remove any device you don't recognise.

4. 4

   Change your password

   Google says to change it immediately, and on any other site that uses the same password.

5. 5

   Check the Gmail settings

   Google says to remove any labels, filters or forwarding rules you didn't set up, and to correct any change to automatic forwarding, mail delegation, automatic replies or blocked addresses.

6. 6

   Turn on 2-Step Verification

   Google says it helps keep hackers out of your account.

Forwarding is the setting people miss. IDCARE suggests checking Gmail’s forwarding rules regularly, to make sure nobody is tampering with the email you see.

Outlook or Hotmail (a Microsoft account)

Microsoft’s page on recovering a hacked or compromised Microsoft account (opens in a new tab) starts with the computer: run a full scan with your antivirus, such as Windows Security, before you change the password.

1. 1

   Scan the computer first

   Open Windows Security, then Virus & threat protection, and run a full scan. Microsoft says to do this before you change the password.

2. 2

   Check the recent activity

   Go to account.microsoft.com/security and select Review activity. For a sign-in you don't recognise, select This wasn't me, or Secure your account.

3. 3

   Change the password

   On the same Security page, select Change password. If someone has changed it and you can't sign in, select Forgot my password, then I think someone else is using my Microsoft account.

4. 4

   Check forwarding and automatic replies

   Microsoft says it resets some settings after a break-in, and asks you to check your connected accounts, forwarding and automatic replies.

Microsoft says that if you didn’t ask it to, it won’t call you to offer support. So treat a call out of the blue from “Microsoft” about your account as a scam, and hang up.

If a reset code goes to an old phone number, or the account says it’s locked, getting back into a locked Apple Account or Microsoft account walks through each company’s recovery steps.

What to do if your Facebook has been hacked

Go to facebook.com/hacked, typed in yourself. Meta, the company that owns Facebook, says this is the page to report a compromised account, and that you can always visit it to recover your account. IDCARE’s advice is the same: contact Facebook straight away through that page.

Open Facebook’s hacked account page (opens in a new tab) to start.

If you can still log in, Meta’s Safety Center gives these steps to lock it back down:

• Change the password to one you don’t use anywhere else.
• Run Security Checkup. Meta calls it a starting point for reviewing and adding security to your account.
• Check Where You’re Logged In. It’s in the Security and Login settings, and lists the devices signed in to your account. Look for any you don’t recognise.
• Turn on two-factor authentication, so a new device needs a code as well as the password.
• Turn on login alerts, which tell you when someone logs in from a device Facebook doesn’t recognise.

If you can’t log in, facebook.com/hacked leads you through recovery. Meta says it asks the account holder to verify their identity before giving back a compromised account, for example with an official ID. It may also offer an optional selfie video to confirm it’s you.

Sometimes friends say you’ve sent a friend request when you haven’t, and your account is fine. Scamwatch says scammers use other people’s photos and identities to make fake profiles. That is a copy of your profile, not a break-in. Tell your friends not to accept it.

What to do if your Apple Account has been hacked

Change the password, check the account’s details and devices, and use Apple’s account recovery if you can’t get in. These are the steps on Apple’s page, if you think your Apple Account has been compromised (opens in a new tab):

1. 1

   Change or reset the password

   Change your Apple Account password to a strong one you don't use elsewhere. If someone has already changed it, reset it instead.

2. 2

   Check your details

   At account.apple.com, correct any personal or security information you don't recognise.

3. 3

   Remove unknown devices

   In the Devices section at account.apple.com, remove any device you don't recognise.

4. 4

   Check your email and mobile

   Apple says to confirm with your email and mobile providers that you control every email address and phone number on the account, and that no text forwarding has been set up.

5. 5

   If you can't get in

   Start account recovery at iforgot.apple.com. Apple says you get back in after an account recovery waiting period.

Apple says that if you get an unsolicited call from someone claiming to be Apple, just hang up, and that Apple never asks for your password or verification codes to provide support.

Is my phone hacked? Checking an iPhone or Android

Almost certainly not in the way the news describes. Apple says the vast majority of people will never be targeted by the rare, expensive spyware attacks aimed at journalists, activists and politicians. The everyday trouble worth checking is an account someone got into, an app you don’t recognise, or a phone that’s behind on updates, and you can check each of those yourself.

On an iPhone

• Update it. Go to Settings, General, Software Update, and tap Download and Install if an update is listed. Under Automatic Updates, turn on Automatically Install so it updates overnight while charging on WiFi.
• Stop the pop-ups. Go to Settings, Apps, Safari, and turn on Block Pop-ups and Fraudulent Website Warning.
• Check the Apple Account, using the steps in the section above. Apple’s advice for everyone is to keep the phone updated, use a passcode, Face ID or Touch ID, and use two-factor authentication with a strong password.
• If someone you know may have had your phone, Safety Check lets you review and stop sharing your information with people and apps. It’s in Settings, Privacy & Security, Safety Check. Apple’s guide says to plan for your safety before you change anything.

On an Android phone

These are Google’s steps to remove harmful software from an Android phone:

1. 1

   Turn on Play Protect

   Open the Play Store app, tap your profile icon, then Play Protect, then Settings. Turn on Scan apps with Play Protect.

2. 2

   Update the phone

   In Settings, go to System, then Software updates. If no update shows, restart the phone.

3. 3

   Remove apps you don't trust

   In Settings, go to Apps & notifications, then See all apps. Uninstall any app you don't need, don't trust, or didn't get from the Play Store.

4. 4

   Run the Security Checkup

   Go to myaccount.google.com/security-checkup and fix anything it shows.

If notifications from a website keep popping up, open Chrome, go to that site, tap Page info, then Permissions, then Notifications, and turn off Show notifications. If the signs are still there after all this, Google says you may need to reset the phone or ask its maker for help. Back up your photos before any reset.

If you’re worried the modem or the home WiFi has been broken into as well, a home network case where the owner feared exactly that shows which signs have ordinary explanations and which are worth acting on.

If money or your ID is involved: your bank, then IDCARE

If a hacker could have seen your bank details, card numbers or ID, ring your bank before anything else. Scamwatch’s advice is to contact your bank or card provider straight away and ask them to stop any transactions. Use the number on your card, not one from a message.

Who to contact if money or ID is involved

Who	When	How
Your bank or card provider	First, if they could have seen bank or card details, or you paid anyone	The number on your card or the bank's own website
IDCARE	For a free plan, if your email held ID documents or a hacker had your details	1800 595 160, Monday to Friday, 7am to 7pm AEST
Scamwatch	To report a scam and warn others, even if you lost nothing	The report form at scamwatch.gov.au
Police	If you are the victim of a cybercrime; call 000 if anyone is in immediate danger	Scamwatch points to a police report on cyber.gov.au

IDCARE describes its service as free, independent and practical advice for victims of scams, identity theft and compromised online accounts. Its Gmail fact sheet makes a point worth taking for any email: think about what was in the inbox and any linked accounts, and contact whoever issued anything affected, such as a government agency, your bank, your super fund or an insurer. Google says the same about telling your bank if banking or ID details were saved in the account.

When to call us, and when you don’t need to

If it was a slow phone, a pop-up or a webcam email, you don’t need anyone: close it, delete it, update the phone. If you can sign in and the steps above went through, the account is yours again, and you’ve done the job yourself.

Call us when:

• You can’t get back in, and the recovery page keeps sending a code to an old phone number.
• You installed something because a pop-up, an email or a caller told you to, and want the phone or computer checked.
• You’d like someone beside you while you change the passwords and switch on two-step sign-in.

A home tech support visit to check the phone or computer with you is made for this: the device checked and cleaned up, the updates switched on, and the recovery details brought up to date. You type your own passwords and we never sign in as you, so the accounts stay yours. We can’t get into an account for you, or recover it past what the company’s own recovery allows, and we don’t do data recovery or remote support. If the bank or IDCARE is needed, ring them first; they come before any technician.

Not sure which you need? Send us a message, or ring us on 02 9188 1577. Booking for a parent? Home tech support works well with you on the phone for the passwords.