// Guides

Account hacked — the first steps

A hacked account means someone else has access to your logins. The first minutes matter most — in the right order and without deleting things too quickly.

Updated: 2026-06-19

Immediate steps

1. 1Stay calm. Act fast but deliberately — hasty deletion destroys evidence.
2. 2Secure the e-mail account first: change the password from a clean device. E-mail is used to reset every other password.
3. 3If you are locked out: reset via the provider’s “forgot password” function.
4. 4Enable two-factor authentication (2FA) — preferably via an authenticator app, not SMS.
5. 5Sign out of active sessions everywhere and check recovery e-mail/phone.
6. 6Warn your contacts (family, friends, colleagues) — changed data can be used for fraud in your name.
7. 7Preserve evidence: screenshots of suspicious logins, messages and timestamps.
8. 8Consider filing a police report — unauthorised access is a criminal offence in Germany (§ 202a StGB).

What not to do

• Do not delete the account immediately — it may hold important traces of the incident.
• Do not reset the device prematurely while evidence is not yet secured.
• Do not reuse passwords — every account gets its own strong password.

Common questions

How do I know my account was hacked?

Typical signs: unknown logins, changed recovery data, messages sent that are not from you, or login alerts from unfamiliar countries.

Which account do I secure first?

Always the e-mail account first — it can reset the passwords of all other services.

Will I be reimbursed for losses?

For online-banking fraud reimbursement is possible; preserving evidence is decisive. There is no blanket guarantee.

Sources

• BSI — Help for those affected (identity theft)
• Verbraucherzentrale — First aid for hacked online accounts