How to know if you have been hacked – 12 signs

You've probably been hacked if you're suddenly locked out of an account, get password reset emails or 2FA codes you never asked for, see payments you don't recognize, or your device starts acting strange. Catch it early and you can lock the attacker out before they get any further. Here are the 12 signs we see most often, and what to do if one of them matches.

What are the first signs of being hacked?

The first signs nearly always show up in one of four places:

Table: Where the first signs of a hack tend to show up

Sometimes the way in is your own device: someone tricks you into installing malicious software on your computer, iPhone or another device. Other times you did nothing at all. A company you have an account with gets breached, and your details leave with everyone else's. Our guide on how to protect your data from hackers covers both routes.

How to know if you have been hacked: 12 common signs

Attackers get in through phishing emails and texts, fake tech support calls, unsecured public Wi-Fi, and automated tools that try stolen passwords on thousands of sites. If you're unsure about a message in your inbox, here's how to spot a phishing email.

Public Wi-Fi has a quieter risk too: someone sitting between you and the site you're using. That's how a man-in-the-middle attack works.

What you'll notice depends on the attack, what the attacker wants and how well protected you were to begin with. These are the warning signs that come up most.

1. You can't get into your accounts, or something looks off

Losing access, or finding settings you didn't change, is the clearest signal there is. Watch for:

• Being logged out of social media, email or banking for no reason
• A password that worked yesterday and doesn't today
• Emails or texts about login attempts, password resets or 2FA codes you didn't trigger
• A new backup email, phone number or security question you never set

2. Odd activity in your email or messaging apps

Once an attacker is in your account, they use it to reach the people you know. Your name makes their scam or malware link look trustworthy. Look for:

• Messages in your sent folder you didn't write
• A sudden jump in spam, especially threats or extortion emails
• Friends or colleagues asking about a strange message "you" sent

Check your email filters as well. Attackers often add inbox rules that quietly hide or forward certain emails, so you don't see the security alerts meant for you.

3. You get told your data was in a breach

A breach alert doesn't prove you've been hacked. It does mean your password, email or other details are now in someone else's hands, so your risk is higher. You can check your email address for free on Have I Been Pwned. Change any exposed passwords right away and keep a closer eye on those accounts for a few weeks. A good password manager will also flag passwords that have shown up in known leaks.

4. Your device starts behaving differently

Malware slows things down in ways that are easy to shrug off. Pay attention if:

• Your device is slower, crashes more, runs hot or drains its battery faster than it used to
• Browser extensions or toolbars appear that you didn't add
• Apps open by themselves

5. Someone else seems to be in control

Some malware gives an attacker remote access to your device. From there they can open your files, read your email and move money.

If your cursor moves while your hand is off the mouse, or your webcam light turns on when you aren't using it, treat it as serious.

6. Money is missing or moving

Bank accounts and crypto wallets are what many attackers are after. Look for:

• Charges you don't recognize on your bank statement or credit card
• Funds missing from a cryptocurrency wallet
• Credit checks or new accounts on your credit report that you didn't open

7. Someone is pretending to be you

With enough stolen details, an attacker can message your work contacts as you, or go further and apply for jobs, loans or insurance in your name. If someone mentions talking to "you" on a platform you don't even use, look into it the same day.

8. A ransomware message appears

Ransomware locks your device and encrypts your files, then demands payment to unlock them. It isn't only aimed at big companies anymore. Individuals and phone users get hit too.

Be wary of any app that asks for access to Accessibility Services. And if a pop-up demands money to give your files back, the device is most likely already infected. Our guide to signs your phone is hacked goes deeper on mobile.

9. Your security software got switched off

Careful attackers try to disable your defenses before they do anything else. If your antivirus is off and you didn't turn it off, assume something is wrong. Turn it back on and keep it updated.

10. Pop-ups and redirects you didn't ask for

Adware takes over your browser. You get pop-ups, get sent to sites you didn't click on, or find your default search engine has changed. A sudden wave of ads or tabs opening on their own points to a compromised browser.

11. Identity theft that goes beyond your devices

Stolen data often gets sold on the dark web. The result can be accounts or loans opened in your name, and debt collectors calling you about money you never borrowed. Unexplained credit checks or unfamiliar accounts on your credit report need action now, not next month. In the US, you can report identity theft and get a recovery plan at IdentityTheft.gov.

If you think someone is already using your details, here's how to check whether someone is using your identity and what to look at first.

12. Social media activity you didn't create

Your social accounts are useful to attackers for personal details and for running scams on your friends. Posts, messages or friend requests you don't recognize are all warning signs. Check the list of logged-in devices in your account settings too. Anything you can't place should be treated as a breach.

Not every exposure looks like a hack, and some matter more than others. We explain the difference in understand the different types of exposure.

What to do if you get hacked: 10 steps

Move fast. These steps limit the damage, roughly in the order you should take them.

1. Disconnect from the internet. A hacked device can infect others on the same network. Cut the connection and turn off Wi-Fi on the device so it doesn't reconnect on its own.
2. Freeze your credit. If your financial details might be exposed, place a credit freeze with all three major US credit bureaus: Experian, Equifax and TransUnion. It's free, and it stops anyone from opening new accounts or taking out loans in your name.
3. Scan for malware and remove apps you don't recognize. Malware can keep a back door open even after you change your passwords. Run a full antivirus scan and delete any app you didn't mean to install.
4. Recover the accounts you lost. Most platforms have their own recovery process. Search "how to recover a hacked [service name] account" and follow the steps on the platform's own help pages, not a third-party site.
5. Change your passwords. Start with the affected accounts, then any other account that used the same password. Make each one long and unique, with a mix of uppercase and lowercase letters, numbers and symbols, and store them in a password manager.
6. Turn on two-factor authentication. If a password leaks, 2FA is the step that still stands in the way. Turn it on for every important account, email and banking first. An authenticator app is safer than SMS codes.
7. Warn your contacts. Attackers use hacked accounts to send scams and malware to the people you know. Tell your contacts what happened and ask them not to open unexpected links or attachments from you for a while.
8. Check your other accounts. A breach rarely stops at one account. Look at the activity logs for unfamiliar logins or devices, starting with your bank and your email, and lock down anything that looks wrong.
9. Update your operating system and apps. Old software has known holes. Install the latest versions on every device you use.
10. Factory reset if nothing else works. If malware survives a scan, wiping the device and reinstalling the operating system is the most reliable fix. It removes even threats that have dug deep into the system. Back up your photos and documents first.

How to protect yourself from being hacked

You can get hacked through no fault of your own. Still, a few habits make you a much harder target, and the simplest rule is this: the less of your personal information sits online, the less an attacker has to work with.

Five ways to make yourself harder to hack:

1. Use an email alias. Sign up for shops, surveys and apps with a secondary address that forwards to your main inbox. Your primary address, and every account tied to it, stays out of the leaks.
2. Give less real information to services that don't need it. Never give false details for anything official, like taxes or a police report. A retail site, survey or newsletter is different. If one of those gets breached, a wrong birth date or an old phone number gives the attacker less to use.
3. Tighten your social media privacy settings. Ideally only friends and family can see your profile. Without your location, photos and posts on show, a scammer has much less to build a convincing phishing message from.
4. Remove your personal data from Google and data broker sites. Data brokers (companies that collect and sell personal information) put your address, phone number and relatives in one place, where hackers can use it too. For search results, see how to remove search results about you from Google. For brokers, you can opt out of data broker sites one by one or use a data removal service.
5. Watch out for shoulder surfing. When you unlock your phone or log in to your bank in public, check who's nearby. Someone close enough can read your PIN, your password or your card number. Use Face ID or a fingerprint where you can.

Preventing this is a lot less work than cleaning up afterwards, and the broker part is the most tedious to do by hand. This is the part Serus automates: it finds where your personal data is exposed, including data brokers and people-search sites, removes it, and monitors the dark web and breach databases so you get an alert when your data shows up.

For more everyday habits, read how to protect your digital footprint: 10 easy ways.