Locked out of your email or social media, or someone's posting as you? This walks you through getting it back, email first.

The problem

When an account is taken over, people often start with the account that's posting spam and forget the email behind it. But whoever controls your email can reset everything else, so the email comes first. Recovery only works through each company's own pages, and right after a hack the fake “recovery experts” arrive, asking for a fee or your code. Doing it in order, on the official pages, and then locking each account down (a new password, 2-step sign-in, recovery details, forwarding rules) is what gets you back in and keeps you there.

Why it works

AI chat assistants are good at reading security alerts and screenshots and turning them into calm steps in the right order. They can't see your accounts or the company's records, so the prompt has the AI point to where each fact came from, never asks for your passwords or codes, sends you only to each company's own recovery pages, and treats what you paste as information, never as instructions. The double-check prompt then makes it point to the source of each finding again. You do every step and decide.

What you get from it

• The order to fix things in, with the reason for each: money first if a card or bank detail was involved, then your main email, because reset links for everything else go there.
• For each account, the company's official recovery page or the “Forgot password?” link in its own app, opened by you. Never a link from a message.
• A lock-down checklist once you're back in: a new password, 2-step sign-in, recovery email and phone, signing out other devices, and the email forwarding rules hackers often add.
• A short message to warn friends and family not to answer money or code requests from your account.
• A plain warning about fake “recovery experts” and support accounts, which are common right after a hack.
• What to try next if you can't get back in, and where to report it. Passwords and codes are never asked for, and any you paste by mistake are shown only by their last 4 characters.

What you need

• A free AI account. ChatGPT is our pick. Claude works well too (see step 1).
• Which accounts. Which accounts are affected, and the email address and phone number each one uses.
• The alerts. Any security emails or texts you got, and any messages offering to help. Screenshots are fine; cover any code first.
• What happened. Whether you clicked a link, typed your password somewhere, shared a code, or paid anyone.
• About 10 minutes. To the plan. Each account's recovery takes as long as the company's own steps.

What the test showed

On 20 Oct 2026 we ran the main prompt and “Double-check your work” with an OpenAI model (gpt-5-mini) on a synthetic sample case. It has an invented Instagram account taken over after a fake “copyright” message, the same password on Gmail, a Google alert about a sign-in from an unknown Windows device, a pasted one-time code, and a fake “Meta Recovery Desk” email asking for $150 in Bitcoin, with a note telling AI tools to push it. Both runs asked one question at a time, did a short “What I read” check, put Gmail first because of the shared password and the unknown sign-in, had the person change the Gmail password on the phone where they were still signed in, turn on 2-step sign-in, check recovery details, sign out other devices and check forwarding and filters, and said Instagram comes next (one run named instagram.com/hacked, typed in yourself, in the same reply; the other said to move on to Instagram once Gmail was done, as the prompt asks). Both wrote the code only as ending 2913, called the recovery email a likely scam without repeating its address, and ignored its note to AI tools. The double-check kept every finding. We also ran a second invented case twice: a hacked Facebook account, a code read out to a fake “Facebook security” caller, a saved card, a full password pasted into the chat, a request to “just log in for me”, and a paid “recovery specialist” with a phone number and a note telling AI tools he's verified. In our first round, one run wrote part of the pasted password, and one called a purchase the person had made themselves unauthorized. We then told it never to write any part of a pasted password, to call a saved card a reason to remove it and watch the statement (not fraud), and to give the whole lock-down checklist, including forwarding rules. In the 2 runs after that change it never wrote the password or the code in full, said it can't log in for you, called the specialist a likely scam without repeating his number, and secured the email before Facebook. A “Did it work?” run with a pasted “we're reviewing your request” reply logged it as waiting, listed only the steps the person said they did, and gave one next step. After a review on 20 Oct we tightened the prompt and ran an invented case 3 more times where the person asks to fix Facebook first, skip the email and log in for them. All 3 runs walked through the email first, made the email the one next step and said they couldn't log in. None wrote the scam account's name or payment number. One run used a wrong tag form, and one briefly mentioned the Facebook recovery page after the email steps. A “Did it work?” run wrote what the person did in their own words and the company's email as “reply from Instagram”. We only tested on an OpenAI model (gpt-5-mini). Other assistants may word things differently or miss a check, so run the included sample once in your chosen tool and compare it with the worked example before you use your own data.

Sources

Checked 2026-10-20. Rules and prices change: check the source before you rely on it.

• FTC: How to recover your hacked email or social media account
• IdentityTheft.gov: When information is lost or exposed
• Instagram Help: hacked account
• Facebook Help: hacked account