WhatsApp or Instagram account hacked? First aid
Locked out of WhatsApp, Instagram or Facebook? These steps get your account back and stop scammers working through your contacts.
- Take the account back: use “forgot password” or re-register with the verification text.
- Warn your contacts through another channel – a call, another app – that your account is hijacked.
- Change the password and everywhere else you used the same one.
- Sign out of every active session and turn on two-factor protection.
First, size it up: what happened?
Account takeovers almost always run the same way. A phishing message or a verification code you passed on gives scammers access, and they lock you out. What they are after is your contact list – they message your friends pretending to be you, and ask for money or for more codes.
Work through it quickly:
- Still signed in, but something feels off? Move fast – change the password, check the sessions.
- Completely locked out? Use the platform’s official recovery route.
- Either way: warn your contacts immediately.
Step by step
What to do now
- Recover the account: “forgot password”, or with WhatsApp, verify your number again.
- The code rule: never pass on a verification code you received by text.
- Change the password and stop reusing it anywhere else.
- Check the email address and phone number on the account – reset them if the attacker changed them.
- Sign out of active sessions (“log out of all devices”).
- Turn on two-factor protection (on WhatsApp: two-step verification).
- Warn your contacts before the scammers reach them.
What not to do
- Never pass on a verification code – not even to a “friend” who claims they entered your number by mistake.
- Do not click links in the suspicious message offering “account recovery.”
- Do not hesitate. The longer the attacker has access, the more contacts they reach.
- Do not reuse the same password on the recovered account.
Who to contact
- The platform’s support through its official recovery route (Instagram Help, Facebook account recovery, WhatsApp support).
- Your contacts, through another channel, so they do not fall for a request for money.
- Police and IC3.gov if money was lost or your account was used to defraud others.
Protecting yourself from now on
Once you have the account back, make it stick:
- Turn on two-factor authentication on every social network.
- Use a password manager : a separate strong password per account.
- Learn to spot phishing – most takeovers start with a faked message.
- If the email account behind it was hacked too: Account hacked .
Frequently asked questions
I was signed out of WhatsApp and got a code I never requested. What now?
Give that code to nobody. Anyone trying to take over your account needs exactly that verification text. Register WhatsApp again right away with your number and the code you received – that signs the attacker out. Then turn on two-step verification.
I cannot get into my Instagram account at all. Is it gone?
Not necessarily. Use “forgot password” and Instagram’s account recovery flow. If the attacker changed the email address and phone number, you can prove your identity through the help form and a selfie video. The sooner you start, the better.
Should I warn my contacts?
Yes, and immediately. Hijacked accounts are mostly used to ask friends and family for money or for codes. A short warning through another channel stops your contacts falling for it.