I followed a fake support link or ran a recovery tool. What should I do before signing in again?
The short answer
Use this guide after interacting with a suspicious page, file or extension. Opening a page, entering a password and running software are different exposures; a click alone does not establish a compromise. If harmful software may be present, stop entering passwords on that device. This guide covers checks before and alongside recovery; it does not replace the hacked-account process.
What this answer is based onWhat to do
Prepare a short timeline, account identifiers, device/browser details, suspicious file names, scan results and the exact recovery error. Keep screenshots private; exclude passwords, login codes and unrelated personal data.
- Stop and classify the exposure. Close the suspicious page and stop following its instructions. Record the time, account, page address and file or extension name without reopening or running it. Did you only open a page, enter a password or code, approve access, run software or grant remote control? For a page visit alone, check for unexpected downloads and account activity without assuming a takeover. If you shared credentials or approved an unexpected sign-in, treat that account as exposed. If you ran software or allowed remote access, stop sensitive sign-ins on that device; contact your IT/security team through a trusted route for a work-managed device.
- Address the device and recovery inbox. Follow the device maker’s official guidance and use trusted security software, not the advertised recovery tool. Update protections and scan where supported; Microsoft’s PC guidance calls for a full scan before changing passwords on that PC. Do not apply Windows instructions to a phone. Seek trusted technical help if cleanup fails or the installed software is unclear. For urgent account protection, use another trusted device. Through your email provider’s official site, replace exposed or reused passwords and review security activity, devices and recovery details. Gmail users should check unfamiliar filters and forwarding; Outlook.com users should check forwarding, connected accounts and automatic replies. If the inbox is locked, use its provider’s recovery process.
- Resume recovery and verify the result. Open Instagram or Facebook independently, change exposed passwords, review sessions and login alerts, and enable two-factor authentication. Review connected apps separately; business administrators should also check asset access. If access is lost, continue with the hacked-account guide. Record completed checks and unresolved errors. Repeated unauthorized activity calls for another review of the device and access routes, not just another password reset. If financial or identity information was exposed, contact the relevant provider through trusted details and use an appropriate local fraud-reporting route.
The situation
A creator installs a supposed recovery extension and sees another unauthorized login after changing their password. They stop using that computer for recovery and investigate both the device and the recovery inbox.
The situation and an improvement
Reset passwords repeatedly on a possibly infected device.
Identify the exposure, address the device and inbox, then verify account recovery.
More examples
You opened a page but entered nothing
A threatening message led to a login page; you closed it without signing in.
What to do
Check whether anything downloaded or was installed and review account activity independently. Do not treat the click alone as proof of a hack.
The recovery inbox forwards mail elsewhere
After sharing a password, you find an unfamiliar forwarding address in your email settings.
What to do
Use the email provider’s instructions to correct unauthorized settings from a trusted device. Protect that inbox alongside the social account; a social password reset does not change email forwarding.
What this answer is based on
FTC · Malware prevention, detection and removalconsumer.ftc.govMicrosoft · Compromised-account and PC checksGoogle · Compromised-account and Gmail checksMeta · Malware and repeated account compromiseFTC · Responding to phishingPrimary source readReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Checked 8 November 2026: the FTC malware article (April 2025), FTC phishing article (September 2022), Microsoft and Google help pages, and Meta’s 3 May 2023 report were read. Microsoft’s full-scan instructions concern PCs; inbox checks apply to the named email provider. Meta’s historical report supports repeat-compromise risks, not current availability of its announced tools. The exposure branches, preparation and examples are ClearRules guidance. No account, device or signed-in menu was tested.
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development