My account or device has been hacked

Step 1: Work out what’s affected

Warning signs include: password reset emails you didn’t request, friends getting messages “from you”, logins from strange locations, missing money, or a device behaving oddly. Make a quick list of which accounts or devices seem compromised.

Step 2: Secure your email first

Your email resets every other password — so it’s the first thing to lock down. From a device you trust (not the hacked one), change your email password, turn on two-factor authentication, and check for forwarding rules or recovery addresses the attacker added.

Step 3: Reset and lock down your other accounts

• Change passwords on banking, government (myGov), social media and shopping accounts. Use a different, strong password for each — a password manager makes this easy.
• Turn on two-factor authentication everywhere it’s offered. An authenticator app is stronger than SMS.
• Sign out all other sessions — most services have a “log out of all devices” option.

Step 4: Check for damage

• Bank and card statements for transactions you don’t recognise — call your bank immediately about any.
• Sent folders and DMs for messages the attacker sent — warn anyone who received them.
• myGov, ATO and Centrelink accounts for changed details or fake claims.
• Your credit file (free from Equifax, Experian or illion) for credit applications you didn’t make.

Step 5: Clean up your device

• Update your operating system and apps — many hacks exploit old software.
• Run a reputable security scan. Remove anything it flags.
• If the device had remote-access malware or you can’t be sure it’s clean, back up important files and consider a full factory reset — or get a trusted professional to help.

Step 6: Report and get support

• Report the compromise to ReportCyber — it builds the national picture and can route your matter to police.
• Call IDCARE on 1800 595 160 if identity documents or personal details were exposed. Their recovery plans are free.
• If money was stolen, report to your bank and Scamwatch as well.