How do you recover a hacked Instagram, WhatsApp or Gmail account?
The order to follow, the exact menu names to tap, and why every hour of delay makes recovery harder.
Short answer
Start with email: run the "Forgot password?" flow at g.co/recover, then sign out unknown sessions under Security > Your devices. For WhatsApp, open the app, enter your number and type the 6-digit SMS code; the attacker's session drops the moment you confirm it. For Instagram, go to instagram.com/hacked and choose "My account was hacked". Finish by turning on two-step verification on all three.
What you need
Step by step
Recover the email account first
Open g.co/recover in a browser, enter the address and start the "Forgot password?" flow. If no code arrives, tap "Try another way"; Google will ask in turn for your recovery email, backup phone, and the last password you remember. Email is the master key to every other account, so it goes first.
Clear unknown devices and forwarding rules in Google
Go to myaccount.google.com > Security > "Your devices" and hit "Sign out" on every device you do not recognise. Then open Gmail > Settings > See all settings and check the "Filters and Blocked Addresses" and "Forwarding and POP/IMAP" tabs. Attackers usually leave behind a rule that quietly forwards incoming verification mail to themselves.
Take WhatsApp back with the SMS code
Open the app, enter your number with the country code and type the 6-digit code sent by SMS. The moment it verifies, the account moves to your phone and the other session is logged out automatically. If it asks for a two-step verification PIN you do not know, use "Forgot PIN" to reset it by email; with no email on file a 7-day waiting period starts.
Block the line if the SIM is gone
If the phone or SIM was stolen, the code will never reach you, so suspend the line first. Call your mobile carrier's support line, give your ID number and ask for a line block plus a replacement SIM. Visit a store with photo ID; the new SIM is usually active the same day within 15 to 30 minutes.
Ask WhatsApp support to deactivate the account
If the SMS code cannot reach you at all, email support@support.whatsapp.com. Put "Lost/Stolen: Please deactivate my account" in the subject line and your number with country code in the body. The account is frozen so the attacker cannot use it, but it is deleted for good if you do not log in within 30 days.
Prove your identity to Instagram
On the login screen, try "Forgot password?" first. If the email or phone number has been changed, go to instagram.com/hacked, select "My account was hacked" and leave an address you can actually reach. If your account has photos of your face, you will be asked for a video selfie turning your head side to side; replies usually take 1 to 3 days, sometimes up to two weeks.
Turn on two-step verification everywhere
In Google, open Security > "2-Step Verification" > "Authenticator app" and print the backup codes on paper. In Instagram, follow Settings and privacy > Accounts Center > Password and security > Two-factor authentication. In WhatsApp, set a 6-digit PIN under Settings > Account > Two-step verification and always add an email address.
File an official report
If someone asked your contacts for money in your name, report it through your country's cybercrime reporting portal and file a complaint at the nearest police station or prosecutor's office. Bring screenshots, dates and times, and the fake messages that were sent. That record is what an investigation and any bank dispute will be built on.
Tips
Watch out
Never send money, ID photos or verification codes to anyone on social media promising to "get your account back in an hour"; most of these are a second scam. Meta and Google never charge a fee and never DM you. And once you send a WhatsApp deactivation request, the account is permanently deleted along with its chat history if you do not log in within 30 days.
Frequently asked questions
+Did the attacker read my WhatsApp conversations?
If they registered your number on their own phone, they cannot see your old chats, but they do read messages that arrive afterwards and can post in your groups as you. If you have a Google Drive or iCloud backup, you can restore the chats when you sign back in.
+What happens if Instagram does not ask me for a video selfie?
If your account has no photos of your face, Instagram asks instead for the email and phone you signed up with and the date the account was created. Fill in the form at instagram.com/hacked and do not resubmit the same request several times a day, or you go to the back of the queue.
+How do I get into my Google account if I no longer have my phone number?
In the g.co/recover flow, use "Try another way" and answer the questions about your recovery email, the last password you remember, and the month and year you created the account. If it fails, retry the same flow after 3 to 5 days from a familiar device on your home network.
+Do I need a lawyer to file a complaint?
No. You can file a free complaint in person at a police station or prosecutor's office with your ID, and an online report through the official cybercrime portal is enough to open a record.
Sources and verification
Last verified: September 15, 2026. tell us. Adapted from a Turkey-specific guide: carrier hotline numbers and the ihbarweb.org.tr reporting portal were generalised to their local equivalents.
This content is for information only; for official procedures the relevant institution’s current announcements take precedence. Details: disclaimer.