Hacked account: what to do, step by step, with NCSC advice

If you have lost access to an account or noticed unusual activity, it is stressful, but the National Cyber Security Centre (NCSC) sets out a clear order of steps. This article follows that order and adds the Information Commissioner's Office (ICO) advice for when a personal data breach is behind it.

Step 1: contact your account provider

If you cannot access your account or have noticed other unusual activity, start with the provider. Go to its website and search the help or support pages. The NCSC says they should explain the account recovery process in detail.

Step 2: check your email account

The NCSC explains why this matters. Check your email filters and forwarding rules. Cyber criminals are known to set up a forwarding rule to automatically receive a copy of all emails sent to your account, which could allow them to reset your passwords. Your email provider's website should explain how to look for these rules.

Step 3: change your passwords

Change the password on the hacked account immediately. Also change the password on any account where you use the same one. The NCSC says criminals know people often use the same password for different accounts, so they will try the "hacked" password across multiple accounts.

Use a strong and unique password, such as three random words.

Step 4: log out of all devices and apps

Once you have changed your passwords, log out of the account on any devices and apps. You can usually do this in the settings menus of the app or website, or in the privacy or account options. The NCSC says this means a criminal will not be able to use your old password to get in.

Step 5: set up 2-step verification

Many online accounts and services let you set up two-step verification (2SV). It adds an extra layer of security, and the NCSC says that even if a criminal knows your password, they will not be able to access your account. It usually works by sending you a PIN or code, usually by SMS or email, which you enter to prove it is you.

Step 6: update your apps and devices

Update your apps and devices as soon as updates are available. The NCSC calls installing updates one of the most important things you can do to prevent your account from being hacked. It suggests turning on automatic updates in your device settings, so you do not have to remember.

Step 7: tell your contacts

Get in touch with contacts, friends or followers linked to the hacked account. Tell them you were hacked and warn them to be suspicious of any recent messages sent from your account. The NCSC says this helps them avoid being hacked themselves.

Step 8: check your bank statements and online store accounts

A hacked email account can lead to hacks elsewhere. Look out for unauthorised purchases and check your bank accounts for unusual transactions. The NCSC also advises contacting your bank directly for further support, using the contact details from its official website or social media channels to be sure they are genuine.

Step 9: report it if you lost money

If you have lost money, tell your bank straight away and report it to Report Fraud. In Scotland, contact Police Scotland.

If you cannot recover the account

Sometimes the online service cannot restore your account. In that case, you will have to create a new account if you want to continue using the service. The NCSC says it is then important to give contacts your new details, tell them you no longer use the old account, and update any bank, supplier or store websites with your new details.

If a data breach was behind it

An account can be affected because an organisation did not keep your information safe. If an organisation has told you about a personal data breach, or you have found one yourself, the ICO says you can complain to the organisation and ask it to explain:

• what has happened;
• what information has been affected; and
• what steps it plans to take to protect your information.

The organisation has 30 days to acknowledge your complaint. It also needs to investigate, keep you informed and provide an outcome without unjustified delay. The ICO suggests keeping a record of any contact: if you speak by phone, note who you spoke to and when, and follow up in writing where possible. It also says you should not be afraid to chase politely if you hear nothing within 30 days.

The ICO lists further steps to protect yourself after a breach:

• Report lost or stolen documents, such as passports, driving licences, credit cards and cheque books, to the organisation that issued them.
• Check your bank statements and get a copy of your credit report, looking for anything you do not recognise.
• Watch out for suspicious calls, emails, text messages and websites. Criminals can use information from breaches to impersonate trusted organisations such as your bank or HMRC.
• If you are unsure whether a call from your bank is genuine, hang up and call the number on the back of your card, use your bank's app or website, or, if your bank supports it, call 159.
• Use strong passwords and multifactor authentication where available.
• Consider protective registration with Cifas, the UK's Fraud Prevention Service. The ICO says it places a warning flag against your name on their National Fraud Database, and that there is a fee.

If you remain unhappy with how an organisation handled things, you can make a complaint to the ICO. It recommends giving the organisation the chance to investigate and respond first. If you are concerned for your safety, the ICO says to contact the police.

Checking what is publicly known about you

Remove Me offers a free scan with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (via Have I Been Pwned) and a register of data brokers, then shows a report. A 6-digit code sent by e-mail unlocks the report. The scan only looks at known public breaches and visible results, so it cannot tell you what happened to a specific account. Remove Me does not yet send erasure requests on your behalf.

The Remove Me team