Hacked or taken-over account: the response playbook

1 Phase 1 of 6 · Prepare

Prepare

Cheap steps that make recovery easy.

• Use a password manager and a unique password for every account.
• Turn on two-step verification, ideally an authenticator app rather than text message.
• Keep recovery email and phone numbers current and under a parent’s control.
• Write down each child’s important accounts, so you know what to secure.

2 Phase 2 of 6 · Spot it

Spot it

Check the signs before assuming the worst.

• Unknown logins, locations or devices in the account’s security page.
• Posts or messages your child did not send.
• Password reset emails your child did not request.
• Friends say they got strange links from the account.

3 Phase 3 of 6 · Contain

Contain

Cut off the intruder.

1. From a device you trust, change the password. If you are locked out, use the platform’s account recovery.
2. Sign out of all other sessions and devices.
3. Turn on two-step verification right away.
4. Change the password on the email linked to the account, since that is the key to every other account.

4 Phase 4 of 6 · Clean up

Clean up

Find out what was touched and remove what the intruder left behind.

• Review connected apps and revoke any you do not recognize.
• Check forwarding rules and recovery details on email.
• Remove unknown devices.
• Run a security scan on the device used to log in.
• Tell friends not to click strange links from the account.
• Report to the platform, and to the FTC (reportfraud.ftc.gov) or police if money or identity is involved.

5 Phase 5 of 6 · Recover

Recover

Regain trust, not just access.

6 Phase 6 of 6 · Learn

Learn

Find the root cause.

1. Ask how it likely happened: reused password, a phishing link, a shared device.
2. Fix that cause.
3. Update your family plan and password manager.