Cyber Security
Have I Been Hacked? Signs Your Accounts or Devices May Be Compromised
Suspecting that you have been hacked can be unsettling, particularly when you are not sure what has actually happened.
The important first step is to work out whether the problem involves an online account, a computer or phone, your financial information, or personal information exposed in a data breach.
These are different types of incidents and they may require different responses.
There are, however, some common warning signs that should never be ignored.
What does being hacked actually mean?
The word "hacked" is commonly used to describe several different security problems.
Account compromise
Someone has gained unauthorised access to your email, social media, cloud storage, banking or another online account.
Device compromise
Malware or another unauthorised program may be running on your computer, phone or other device.
Data breach
Information about you has been exposed because an organisation holding your data has suffered a security breach.
A data breach does not necessarily mean someone has accessed your computer, and a compromised account does not automatically mean your entire device has been hacked.
Understanding the difference helps you respond appropriately.
Signs one of your online accounts may be compromised
The Australian Cyber Security Centre identifies several common indicators of account compromise.
- You cannot log in even though you know your password is correct
- You receive an unexpected password reset notification
- You see logins from unfamiliar locations or devices
- Your account provider warns you about suspicious activity
- Messages have been sent from your account that you did not send
- Friends or customers receive unusual messages from you
- Account settings have changed without your knowledge
- You see purchases or transactions you do not recognise
- You are unexpectedly logged out of all your devices
Any one of these may have an innocent explanation, but multiple warning signs should be investigated immediately.
Check your email account carefully
Look at recent login activity. Check for devices, locations or login times you do not recognise.
Check sent and deleted mail. Attackers sometimes use a compromised account to send phishing messages and then delete the evidence.
Check forwarding rules. A criminal may create an email rule that silently forwards copies of your messages to another address.
Check recovery details. Make sure the recovery email address and phone number still belong to you.
Check multi-factor authentication methods. Remove any phone numbers, authentication methods or devices that you do not recognise.
Your email account is especially important
Your primary email account is often the key to many of your other online accounts.
Password reset links for banking, shopping, social media, cloud storage and other services are frequently sent by email.
Someone with control of your email may therefore be able to take control of additional accounts even if they do not initially know those passwords.
If you suspect your email has been compromised, treat it as a priority.
Signs your computer or phone may be compromised
Device problems do not automatically mean malware is present, but some behaviour deserves investigation.
- Security software repeatedly reports malware
- Programs or apps appear that you did not install
- Your browser homepage or search engine changes unexpectedly
- Unexpected browser extensions appear
- Security settings have been disabled without your knowledge
- Files become inaccessible or suddenly encrypted
- You receive a ransom message
- Remote access software appears that you did not install
- Your device performs unusual actions without your input
A slow computer or rapidly draining phone battery by itself is not proof that a device has been hacked. Many ordinary software and hardware issues can cause similar symptoms.
Look for unexpected remote access software
Scammers sometimes convince victims to install legitimate remote support applications and then use them to control the device.
If someone claiming to represent a bank, telecommunications company, government agency or technology company asks you to install remote access software unexpectedly, treat the request with extreme caution.
If you discover remote access software that you do not recognise, disconnect the device from the internet and investigate before continuing to use it for banking or other sensitive activities.
Check your money immediately
Review recent transactions. Look for purchases, transfers or new payees you do not recognise.
Check credit and debit cards. Small unfamiliar transactions can sometimes precede larger fraudulent charges.
Contact your bank quickly. If you identify suspicious financial activity, contact your financial institution using its official contact details.
Do not rely on incoming calls. If someone calls claiming to be your bank, end the call and contact the bank yourself using a trusted number.
Suddenly lost mobile service?
Unexpected loss of mobile service can occasionally indicate that your mobile number has been transferred to another SIM or account without your permission.
This is commonly known as SIM swapping.
If your phone unexpectedly loses service while other nearby phones remain connected normally, contact your mobile provider.
This is particularly important if the loss of service occurs at the same time as password reset notifications, banking alerts or other unusual account activity.
What if your information was exposed in a data breach?
Being included in a data breach does not necessarily mean someone has accessed your computer or logged into your accounts.
It does mean information about you may have been exposed.
The level of risk depends on what information was involved.
A leaked email address may mainly increase your exposure to phishing and spam. A leaked password, identity document, financial information or other sensitive information requires a more urgent response.
If a password was exposed and you have used that password anywhere else, change it on every affected account.
One stolen password can affect several accounts
Criminals commonly test stolen email addresses and passwords against other online services.
This is why password reuse is dangerous.
If one account is compromised, identify any other accounts using the same password and change them immediately.
Each important account should use a unique password or passphrase. A reputable password manager can make this much easier.
What should you do if you think you have been hacked?
1. Protect your money. Contact your bank immediately if financial information or accounts may have been affected.
2. Use a trusted device. If you suspect malware on a computer, use another device you believe is secure to change important passwords.
3. Change compromised passwords. Go directly to the genuine website or application rather than using a password reset link from an unexpected message.
4. Log out other sessions. Many services provide an option to sign out all other devices.
5. Check recovery settings. Remove unfamiliar email addresses, phone numbers and authentication methods.
6. Enable multi-factor authentication. This makes it significantly harder for the attacker to regain access using only your password.
7. Check connected accounts. Prioritise email, banking, cloud storage and any accounts using the same password.
If you suspect malware, secure the device first
Changing passwords on a compromised computer can allow malware to capture the new passwords as well.
If you believe malware may be present, disconnect the device from the internet and perform security checks before using it for sensitive activities.
Use reputable security software and make sure the operating system and security tools are fully updated.
If you cannot confidently determine that the device is clean, professional assistance may be appropriate before reconnecting important accounts.
Think about how the compromise may have happened
Identifying the likely cause can help prevent the same problem occurring again.
Consider whether you recently:
- Entered a password after following a link in an email or text message
- Downloaded an unexpected attachment
- Installed unfamiliar software
- Allowed someone remote access to your device
- Reused a password involved in another breach
- Approved an unexpected multi-factor authentication request
If the incident started with an email, SMS or fake login page, our guide to recognising phishing scams explains the common warning signs.
If the problem involves your phone
Check installed applications, device permissions, account login history and any unfamiliar authentication methods.
Also check whether your Apple or Google account shows devices you do not recognise.
Our mobile phone security guide covers phone locking, app permissions, lost devices, mobile banking and other practical security measures in more detail.
Do you need to replace your home network?
Usually, no.
An online account being compromised does not automatically mean someone has gained control of your router or every device in your home.
However, if you are reviewing your overall security, it is worth checking that your router is supported, updated and using strong Wi-Fi and administrator passwords.
See our home cyber security guide for practical advice on routers, Wi-Fi, smart devices and home networks.
What if this involves a business account?
A compromised business email account can affect customers, suppliers and other staff, not just the individual account holder.
Check for unusual sent messages, changed payment details, forwarding rules, new administrator accounts and suspicious cloud logins.
If the account could have been used to send fraudulent invoices or payment instructions, notify affected parties quickly.
Our small business cyber security guide covers account security, backups, payment verification and incident preparation.
What not to do
Do not keep using the same compromised password.
Do not change passwords on a device you strongly suspect contains malware.
Do not approve unexpected authentication requests.
Do not install remote access software because an unexpected caller tells you to.
Do not use links in suspicious security or password reset emails.
Do not assume that regaining access to an account means the attacker has been completely removed.
Quick hacked account recovery checklist
- Check your bank and financial accounts
- Change the affected password from a trusted device
- Change reused passwords on other accounts
- Sign out all other sessions
- Check recovery email addresses and phone numbers
- Check MFA methods and trusted devices
- Review recent login activity
- Check email forwarding and filtering rules
- Enable multi-factor authentication
- Scan potentially affected devices for malware
- Notify contacts if messages were sent from your account
- Continue monitoring accounts for unusual activity
Where Australians can get help
If you have experienced a cyber security incident, the Australian Signals Directorate's Australian Cyber Security Centre provides recovery guidance and operates the Australian Cyber Security Hotline.
The hotline is available on 1300 CYBER1 (1300 292 371).
Cybercrime and cyber security incidents can also be reported through ReportCyber.
If money is at risk, contact your financial institution immediately.
If your identity information has been exposed, IDCARE provides identity and cyber support services in Australia.
Do not panic, but do act quickly
A strange login notification or unexpected email does not necessarily mean that everything you own has been compromised.
Start by identifying what is actually affected.
Protect your money, secure your email and other important accounts, remove unauthorised access and investigate potentially compromised devices.
Acting early can turn a relatively minor account compromise into a manageable incident instead of a much larger problem.
Further information
For official Australian guidance on recovering from a compromised account or cyber attack, visit the Australian Cyber Security Centre.