Malware and Hacked Accounts: Restoring Control of Your Information

This guide presents selected U.S. government consumer education from Federal Trade Commission. References to “we” or “us” in the source material refer to the issuing agency. Source dates and links appear below.

Malware: How To Protect Against, Detect, and Remove It

Malware is one of the biggest threats to the security of your computer, tablet, phone, and other devices. Learn how to protect yourself, how to tell if your device has malware, and how to remove it.

What Is Malware?

Malware is harmful software that’s installed on your device without your knowledge. Viruses, spyware, and ransomware are common types of malware.

Criminals use malware to steal your personal information, like your usernames and passwords, bank account numbers, or Social Security number. If you think someone stole your information, visit IdentityTheft.gov to report it and get a personalized recovery plan with steps to take next.

Criminals may also install malware and use it to

• send you unwanted or inappropriate ads
• demand payment to unscramble data encrypted by ransomware
• make your device vulnerable to even more malware

Protect Against Malware

Use security software

To protect your computer from malware and other threats, use security software. Update it regularly, or set it to update automatically, for the most up to date protection. And set it to automatically scan new files on your device.

If you don’t have security software on your device, download it. Find recommendations from independent review sites by doing a search online. Also ask friends and family for recommendations.

Recognize common threats

Scammers send deceptive phishing emails that trick you into clicking on a link or opening an attachment that downloads malware. Don’t click on a link in an unexpected email. Instead, contact the company using a phone number or website you know is real.   

Scammers create fake security warnings that tell you to call a phone number for tech support. If you call, they ask for remote access to your computer, run a fake diagnostic test, then charge you to fix a problem that doesn’t exist. Never call a phone number that appears in a pop-up window.

Scammers place bogus ads for software on social media sites and on search engines. Don't click on ads to download software. If you see an ad for software that interests you, don’t click on it. Instead, go to the website by typing in the address.

Avoid risks

Avoid things that might expose you to malware.

• Don’t use unfamiliar websites to download free stuff like music, movies, shows, or games.
• Don’t download content through peer-to-peer (P2P) file-sharing sites.
• Use an antivirus or security program to scan USB thumb drives, external drives, and other external devices before using them.

Detect Malware

Even if you use security software, malware might go undetected, at least temporarily.  These symptoms could be a sign that your device is infected with malware.

1. Your computer slows down, freezes, or crashes.
2. Your browser’s home page changes or automatically redirects you to sites you didn’t intend to visit.
3. You notice new browser toolbars or add-on programs.
4. You get a lot of pop-up ads, including some inappropriate ads or ads on sites you wouldn’t expect, like on government websites.
5. You get repeated error messages from your operating system.
6. Your operating system tools, like Task Manager or Activity Monitor, are disabled.
7. You notice emails you didn’t write or social media messages you didn’t post.

Remove Malware

Here’s what do if you clicked a link or opened an attachment that you think may have downloaded malware onto your computer, or if you notice any of the signs above.

1. Immediately stop logging into online accounts with your usernames, passwords, or other sensitive information — like shopping or banking.
2. Update your security software to make sure you have the latest protections. If you don’t have security software, download it. Find recommendations from independent review sites and ask friends and family for recommendations.
3. Run a security scan to remove the malware.
4. Change your passwords and enable two-factor authentication in case the malware gave a hacker access to your accounts.

If you need help removing malware, you might

• contact the manufacturer of your device and find out if it’s covered by a warranty
• get tech support from a company you know and trust
• get help from a knowledgeable friend or family member

Report Scammers

If you see any ads, websites, or emails you think are trying to spread malware, or if someone installs ransomware and demands payment from you, report it to the FTC at ReportFraud.ftc.gov.

How To Recover Your Hacked Email or Social Media Account

There are lots of ways to protect your personal information and data from scammers. But what happens if your email or social media account gets hacked? Here are some quick steps to help you recover your email or social media account.

Signs That Someone Hacked Your Account

Hackers try to take over your accounts. Some might want to steal your personal information — like your usernames and passwords, bank account numbers, or Social Security number — to commit identity theft. Others might want to spread malware or scam others. So, what types of things might tip you off that someone hacked your account and changed your password?

• You can’t log in to your account.
• You get a notification about a change to your username or password— but you didn’t make that change.
• You get a notification that someone logged into your account from a device you don’t recognize or a location you’re not at.
• Your friends or family report getting emails or messages you didn’t send, sometimes with random links or fake pleas for help or money.

How To Get Back Into Your Hacked Account

First, make sure your computer security software is up to date, then run a scan. If the scan identifies suspicious software, delete it, and restart your computer. Then, follow the provider’s account recovery instructions. Here are links to some of them.

What To Do After You Take Back Control of Your Hacked Account

After you get back into your hacked account

• take steps to secure your account
• check for signs that someone had access to your account
• notify your contacts about the hack

Take steps to secure your account

1. Change your account password. Create a strong password that is hard to guess.
2. Sign out of all devices. That way anyone who’s logged in to your account on another device will get kicked out.
3. Turn on two-factor authentication (2FA), also known as two-step verification, if it’s available on your accounts. With 2FA, you’ll have to enter your password and something else to log in. That could be a PIN or a one-time verification code you get by text or email or from an authenticator app.
4. Check your account recovery information. Make sure the recovery email addresses and phone numbers listed are ones you entered and have access to.

Check for signs that someone had access to your account

• Check your email settings to see if there are rules set up to forward emails. Delete any rules you didn’t set up, so your messages aren’t forwarded to someone else’s address.
• Check your sent folder for emails the hacker sent from your account. Look in your deleted folder for emails the hacker may have read then deleted.
• Check your social media accounts for messages the hacker posted or sent from your account, or for new friends you don’t recognize.

Tell your contacts

Send your friends a quick email or text, or post something, to let them know about the hack. Tell them not to click on links in emails from you and to ignore pleas for help or money.

Why It’s So Important To Protect Your Email Account

Your email account is an important part of protecting your personal information online. Why? Say you forget your account password and use the password reset feature to get a new one. You get an email with a password reset link, click on it, and change your account password. All in a matter of minutes.

Now, imagine if someone hacked your email account. They could request a password reset link for any of your other accounts, get the password reset link from your inbox, change your password, and lock you out of the account.

That’s why it’s critical to protect your email account by using a strong password and turning on two-factor authentication.

Learn more about protecting yourself from hackers and other threats.

Sources and publication details

• Malware: How To Protect Against, Detect, and Remove It — Federal Trade Commission; source date: 2025-04-16T13:56:26Z.
• How To Recover Your Hacked Email or Social Media Account — Federal Trade Commission; source date: 2023-08-10T12:55:21Z.

The federal agency source text is U.S. government work in the public domain. Fynoptic selected, adapted, and formatted it for this guide. No agency endorsement is implied. Follow the linked sources for current program details and the rules applicable to your circumstances.