Online security is becoming increasingly critical as more of our daily lives move onto the internet. If you believe one or more of your online accounts have been hacked or compromised, it’s essential to act swiftly. If you are locked out of an account, the situation becomes even more urgent. Below are detailed steps you can take to mitigate damage, regain control, and enhance the security of your other online accounts.
*Note: One takeaway from my own personal "getting hacked" experience is that the new "Verified" model that most social media platforms use now is being leveraged to push users into paying for the verification, just to receive any kind of personal support if they happen to have any problems or issues with their account. Going forward I recommend (and will personally practice) that you verify ANY and ALL online social media accounts that are important or critical to your life/work. You can use the services for free, but if you have an issue like an account hi-jack/take-over, it can be next to impossible to get ANY help if you are un-verified.
1. Report the Incident Immediately!
Reporting the compromise to relevant authorities and service providers is crucial. This not only helps you recover control of your account but also aids in preventing further damage.
- Local Police: If you suspect identity theft or fraudulent activity, file a report with your local police department. Keep copies of the report for further use.
- Websites or Software Providers: Contact the customer support teams of any websites or services involved in the breach. Most platforms like Google, Facebook, and financial services have processes in place to assist users in recovering hacked accounts.
- IC3/FBI: If the incident involves significant financial loss or cybercrime, file a report with the Internet Crime Complaint Center (IC3), which is a division of the FBI focused on internet-based crimes.
2. Recovering a Locked-Out Account:
If you are locked out of an account, follow these steps (and see further details at the end of the blog):
- Use Account Recovery Options: Most services offer account recovery options like email or phone verification, but this may not be safe if these are compromised. Prioritize recovery methods like trusted devices or backup codes (which many services provide when setting up 2FA).
- Contact Customer Support: If recovery options fail, reach out to the service provider’s customer support. Be prepared to verify your identity through personal information or past account details.
- Keep Documentation: If you’ve filed reports with the police or the IC3, share these reports with the service provider, as this may help speed up the account recovery process.
3. Secure Any Associated Payment Services
If you're completely locked out of an account, especially one that’s linked to financial services, take immediate action by logging into any associated payment services and removing access to the hacked site or account. For instance:
- PayPal
- Venmo
- eBay
- Banking apps or credit card accounts
This helps to stop any unauthorized transactions that could stem from the compromised account. Be sure to carefully review recent activity on these services to identify any fraudulent activity and report it to your payment service provider.
3. Change Passwords on Any/All Online Accounts You Have!
Once you've safeguarded your payment methods, it's essential to change your passwords across all your online accounts. Start with the most important and sensitive accounts first:
- Email Accounts: Your email is often the gateway to all your other accounts, so this is the highest priority.
- Financial Accounts: Banking, credit cards, PayPal, Venmo, CashApp, Zelle, etc.
- Shopping Platforms: Amazon, eBay, and any other sites where your payment information is stored.
Use strong, unique passwords for each account. Consider using a password manager to generate and securely store complex passwords, reducing the chances of reuse or weak password issues.
4. Monitor and Secure All Other Online Accounts
Even if only one account was compromised, hackers may have attempted to access other accounts through the use of the same password or linked email addresses. Take the following additional precautions:
- Review all recent account activity for suspicious logins or transactions.
- Revoke access to any suspicious devices or apps that are connected to your accounts.
- Update security questions and answers, ensuring they aren't easily guessable or derived from public information.
5. Setup, Use, and/or Check Any Credit or Data Monitoring Services
If you use any sort of data monitoring or ID monitoring service(s), this would be the time to check on them or even ask the provider to run an up-to-date check of your personal information.
- Guardio: We do use and recommend Guardia as an "Umbrella" service to not only monitor your personal information but also look for password leaks and even provide email/web filtering and monitoring. The service is not free, unfortunately. But their products and services have GREATLY helped us with similar issues in the past.
- Free Credit Monitoring such as Experian, Equifax, Credit Karma, the FTC, and other resources.
6. Enable Two-Factor Authentication (2FA)
Where available, always enable two-factor authentication (2FA) for your accounts. However, be cautious with the type of 2FA you use:
- Do not rely on 2FA through SMS or email, as these can be intercepted through SIM-swapping attacks or email compromises.
- Use an authenticator app such as Google Authenticator, Microsoft Authenticator, or Authy.
- Security Keys: For the highest level of protection, use your security key for 2FA on any accounts that support it.
Make sure to set up both security keys on all accounts that support them for redundancy in case one is lost or stolen.
7. Implement Security Keys for Two-Factor Authentication (2FA)
Using a security key (like a YubiKey) is one of the most effective ways to protect your accounts. Security keys provide an extra layer of security beyond traditional passwords by requiring physical confirmation for account access.
- Buy Two Security Keys: Setting up two keys ensures that if one is ever lost, stolen, or damaged, the backup key can be used to regain access to your account.
- Register Both Keys: Set up both keys on every account that supports their use (e.g., Google, Dropbox, Microsoft, social media, financial services, etc.).
8. Ongoing Protection and Monitoring
After recovering your accounts and enhancing their security, adopt good online security practices going forward:
- Use a Password Manager: This helps you create and store strong, unique passwords for all your accounts.
- Monitor Credit Reports: If financial information is compromised, regularly monitor your credit report for unusual activity. You can also consider placing a fraud alert or credit freeze.
- Watch for Phishing Attempts: Be especially cautious of phishing emails or texts that may follow a breach, as hackers may try to gain further information by impersonating legitimate companies or services.
