Account taken over

In the first hour

If it’s a colleague’s account, do these with them, in order. The first two can’t wait.

1. Get back in the official way. First check the inbox and texts: a “your password was changed” alert often has a link that undoes the change. If not, use the service’s own recovery page from the owner’s usual phone or laptop, at home or at work, so the service recognises them. If anyone calls or messages asking for a code, end the conversation. Google, WhatsApp and the other services never ask for one.

2. Warn people before the attacker gets to them. Hijacked accounts get used to ask friends for money or to spread bad links. Use a channel you already share that wasn’t affected, like an existing Signal group, and ask people not to reply, click or pay. You could send this, changing the account name:

   Someone has taken over my WhatsApp account. Please ignore anything it sends asking for money, codes or clicks, and don’t reply. I’ll tell you when it’s mine again.

3. Take screenshots before you fix anything. Capture the alerts, anything sent or posted that the owner didn’t write, and any setting they don’t recognise, with the time showing. Once you remove something, the proof goes with it.
4. Change the password, then sign everyone else out. Pick one the owner has never used anywhere else; a password manager will make it and remember it. Then find the list of devices signed in to the account and sign them all out. A new password doesn’t always throw out someone who’s already in.
5. Remove what the attacker added. Attackers leave themselves ways back in that a new password won’t close: their own recovery email or phone number, a setting that forwards the email to them, an app given access to the account, an extra admin. Delete anything the owner doesn’t recognise. Then turn on two-factor authentication, so a password alone can’t get anyone in.

If you can’t get back in

Win back the email account first. If the attacker has that too, start there. The owner’s other accounts send their password resets to it, so whoever holds it can get into those as well.

Use the service’s own recovery page, from the list below, rather than a link someone sends you (SIIRF). Don’t pay anyone who offers to get the account back for you.

• Google, including Gmail and YouTube
• Microsoft, including Outlook and Hotmail
• Apple
• Facebook and Instagram
• WhatsApp and Telegram
• X and TikTok
• Proton: a reset can lock the old messages unless you saved the recovery phrase Proton gave you
• Yahoo

Waiting is the hardest part. A reply to a recovery form can take days, sometimes longer, so keep going. Answer every question, even when you have to guess. On Google’s form, a wrong guess won’t throw you out of the process (Google). Some services ask for ID or a short video of your face. If they turn you down, try again.

If the platform is slow, ask for help. Access Now’s Digital Security Helpline is free for civil society groups, journalists and human rights defenders. It works around the clock in 10 languages and says it replies within two hours. Getting hijacked accounts back was the most common emergency in its first 10,000 cases (Access Now). It checks first that it can support you, and the Digital First Aid Kit lists other helplines too.

On WhatsApp, register the number again on the owner’s own phone. That signs the other person out. If WhatsApp then asks for a PIN the owner never set, the attacker set it, and you may have to wait seven days to get in without it.

On Telegram, log in with the number, then go to Settings, then Devices, and sign out every device you don’t recognise. As Telegram’s own help pages put it, “whoever has the number, has the account” (Telegram).

If the owner’s phone suddenly shows “No service” while phones around them have signal, someone may have moved the number to their own SIM card. Every code sent by text now goes to them. Call the mobile operator from another phone, and warn the bank (SIIRF).

For a work account your organisation pays for, like Google Workspace or Microsoft 365, whoever runs your organisation’s accounts can reset the password and sign it out everywhere at once. Hand over the new password in person or by phone, not by email: the attacker may still be reading that inbox (Microsoft). On a Facebook Page with other admins, another admin can add you back.

If the account can’t be saved, open a new one, tell your contacts the old one isn’t yours any more, and update the details your bank and other services hold.

If you’re coordinating the response, SIIRF’s Account Takeover playbook helps you judge how serious it is and lists the evidence to keep.

Tell people

Assume the attacker has already written to people as the owner. Reach them another way:

• the owner’s contacts and any groups the account is in
• partners or communities the account has been used to contact
• anyone whose details were in the account, such as names on a shared list or a source’s messages. They may need to protect themselves, and Details posted online covers what to do if their details spread.
• the platform, through its own report or recovery page

When someone’s trying to compromise a human rights defender or activist or journalist, it’s usually because they want that person’s information. They want that person’s contacts.

Kim Burton, Access Now Digital Security Helpline, in NY City Lens, 2016

Write it down

As you go, or before the day is out, note:

• when the owner noticed, when they lost access and when they got it back
• what the attacker read, changed, sent or deleted, and who received it
• what you did, when you did it and who did it

Keep it with your team’s notes on past incidents. Your incident response plan says where those are kept, and SIIRF’s Incident Log has a format you can copy.

Look after the person

Tendai is the communications officer at a land and housing rights group in Bulawayo, and she runs its WhatsApp channel. When a caller who said he was from WhatsApp support asked for the code that had just reached her phone, she read it out. By the next morning her contacts were getting messages from her number asking for money. Getting the account back took two days, and Tendai spent most of them apologising to colleagues.

Losing an account is unsettling, and people often blame themselves, especially if they read a code out to a caller who sounded official. Takeovers happen all the time, to careful people too.

The first thing you should remember is that blaming oneself or anyone else within a team does not help react to emergencies.

Peter Steudtner and Flo Pagano, Digital First Aid Kit

Tell them plainly that nobody is in trouble. Then share the work: sit with them while they go through the steps, or take on the screenshots and calls yourself. Check in again a few days later; Well-being and care has more on what helps.

Close the way in

When things are calm, work out how they got in. Each way in has its own fix:

• A reused password from a site that was hacked: give every account its own, kept in a password manager.
• A code read out to a caller or someone posing as support: see Social engineering.
• A fake sign-in page or “security” app someone was asked to approve: see Phishing and Clicked a bad link. In 2019 Amnesty International found staff at Egyptian civil society groups being sent a fake Google security warning that asked them to allow an app called “Secure Email”, which could then read their mail (Amnesty International). Amnesty also documented human rights defenders in Uzbekistan being sent fake Gmail sign-in pages that asked for their password and their two-factor code (NDI).
• A moved phone number (a SIM swap): ask the mobile operator to put a PIN or lock on the SIM, and move two-factor authentication off text messages.
• Harmful software that stole saved passwords: see Clicked a bad link, and Spyware and surveillance if accounts keep getting taken over.
• Someone who left but kept access: see Shared accounts and Who has access.
• A lost or seized phone that was still signed in: see Device lost or seized.

Last, check that every account’s recovery email and phone number are current, and keep the backup codes (the spare sign-in codes) somewhere safe. In many of the cases where the Access Now Helpline helped people get an account back, the recovery details were missing or out of date, and that made it much harder (Access Now). Email security and Social media accounts cover the accounts your organisation can least afford to lose.

Teach it to your team

Try this at your next team meeting. It takes about 20 minutes, and everyone needs their phone.

• Prepare: have the scenario below ready to read out, and know where the two-step verification setting is in WhatsApp.
• Exercise: read out this scenario: a colleague gets a call from “WhatsApp support”. The caller says a six-digit code was sent to them by mistake and asks them to read it back. What should they do? Let the room answer before you do. Then agree which channel you’ll use to warn each other if an account is taken over, like a Signal group you already have, and check together that everyone has WhatsApp’s two-step verification PIN switched on and up-to-date recovery details on their main accounts.
• Three questions: What are the first two things to do when an account is taken over? Why isn’t a new password always enough? Which account do you win back first, and why?
• Afterwards: offer one-to-one help to anyone who couldn’t finish, and answer questions in the team chat. For a longer session, play level 1 of SIIRF’s Chips Down. It opens with this scenario.