Identify which profile is involved
Fictional example: friends tell Malik about a request for money. He asks for the profile name and an existing screenshot without private conversation details. The account uses his photographs but has a slightly different username. He reports impersonation and separately checks his real account.
If the messages actually came from your account, record that briefly. Do not open suspicious links within them. Unfamiliar posts or changed contact details are further concrete signs. A matching display name or copied photograph alone does not establish that somebody obtained your login.
Reach the platform independently
Open the familiar app or enter the official address yourself. Find its security, account-access or recovery help. Meta provides relevant routes in its Safety Center; Instagram also has the official entry point instagram.com/hacked. Other platforms operate their own procedures.
Do not adopt support contacts from comments beneath your report. A professionally named profile can still belong to a stranger. Never send passwords, one-time codes or recovery codes to somebody offering fast account restoration through direct messages.
Review access and permissions together
If you remain signed in, replace the password using a trusted device and review active sessions. Check phone numbers, recovery email and additional sign-in methods. Enable suitable extra protection and preserve your own recovery options before removing other access routes.
Inspect connected applications and granted permissions. A scheduling service or unfamiliar app may have separate publishing rights. Remove unknown or unnecessary connections. For jointly managed pages, review roles and administrators with the people legitimately responsible for the page.
Check messages, spending and team access
Preserve available evidence of unwanted posts, then remove them through the platform’s controls where you still have access. For business use, also inspect advertising accounts and unusual spending. Inform the payment provider promptly if unauthorised transactions may be involved.
Warn affected contacts through another reliable channel. Explain which content was not yours and that they should not pay or share codes. Do not publicly circulate complete private conversations. The warning should protect others without spreading additional personal information.
Treat recovery as an ongoing case
If locked out, follow the official identity and recovery checks. Record the case reference, completed steps and expected next contact. Avoid contradictory information across many parallel requests. No universal response time or successful restoration can be promised.
Malik records impersonation reporting separately from checks on his genuine account, preserving the distinction between confirmed facts. After actual account misuse, also inspect the associated email address and reused passwords. Recovering one profile does not automatically secure every other exposed login.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Should I pay an outside recovery expert?
Promises of guaranteed restoration are not reliable. Use the official provider process and never give a stranger your login details or codes.
Does a copied profile mean my password is known?
No. Public names and photographs can be copied. Report impersonation and examine the genuine account for actual unauthorised activity.
Why might posting continue after changing the password?
Existing sessions, connected applications or other administrative roles may be involved. Review the provider’s available access controls rather than repeatedly changing only the password.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Meta Safety Center: Secure your accountSource review date:
- BACS: Konto gehackt oder Daten abgeflossen – Was nun?Source review date:
- Meta: Designing Account Security Across Our AppsSource review date:
