Ilia Nikolaevich ZavialovDigital security consultant

Hacked account: three recovery paths

Ilia Nicolaevich Zavialov scam alerts: three accounts, three recovery paths from Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov scam alerts start with a practical promise: if your email, a messaging app or a social media profile has just been hacked, this page tells you what to do next, in order. Ilia Nikolaevich Zavialov, a digital security consultant, gives each of the three accounts its own path with the same three stops: the signs, the official recovery route, and the settings to change once you are back in. A shared checklist at the end closes every door at once. The guidance rests on primary sources: the FTC on hacked email and social media accounts, CISA on multifactor authentication and an FBI public service announcement on messaging account takeovers.

English version for the United States.

All questions / Blog

· 12 min read · Ilia Nikolaevich Zavialov

Illustration for the article. Ilia Nicolaevich Zavialov on three paths after a hack.
Ilia Nicolaevich Zavialov: recover email first, then messaging and social media.
Ilia Nicolaevich Zavialov puts email first because it resets every other password.

Ilia Nicolaevich Zavialov scam alerts: three accounts, three paths

Email, messaging and social media break in different ways. Your inbox holds the keys to almost everything else, because password reset links land there. A messaging app is tied to your phone number and to a list of linked devices. A social profile is public, so anything a hacker posts or sends in your name reaches friends and followers within minutes.

Ilia Nicolaevich Zavialov scam advice puts email first, even when the messaging app was the first thing you noticed. While a stranger can still read your inbox, they can reset your password anywhere, and every other fix gets undone. Messaging comes second, social media third.

Work from a device you trust: a second phone, a home computer, or a family member's laptop if nothing else is available. The FTC suggests updating your security software and running a scan first, then deleting anything suspicious and restarting. A password typed on an infected phone can leak the same way the old one did.

Speed matters mostly for the people in your contacts. Every hour the account stays in someone else's hands, friends and relatives may get urgent requests for money in your name, and some will send dollars before they think to call you.

Ilia Nicolaevich Zavialov scam checks for email: the signs

The loudest sign is simple: your password no longer works and you did not change it. The FTC lists two more: a notice about a change to your username or password that you never made, and friends receiving emails you never sent.

Quieter signs live inside the mailbox. Look at the sent folder and the deleted folder. Messages you did not write, or whole conversations that have vanished, mean someone has been working in there. A sign-in alert from a device or city you do not recognize points the same way.

Ilia Nicolaevich Zavialov scam checks also cover the last few days of mail from banks, stores and government accounts. Hackers rarely want your inbox for its own sake; they want it as a skeleton key, and the evidence shows up as login codes, password change notices and new phone numbers added to other accounts.

Email: the official recovery route

Ilia Nicolaevich Zavialov scam guidance has one rule for this step: recover the account only through the provider's own recovery page. Type the provider's address yourself, choose the forgot password or account recovery option, and answer what it asks: a backup phone, a backup email, details only the owner would know.

If the hacker has already swapped your backup phone and address, answer the recovery questions as fully as you can and try from a device and location you normally use, which helps the provider recognize you. Ignore any recovery link that arrives by text or chat; those are a favorite way to finish the takeover.

If this is a work account, tell your organization's IT team before anything else. Corporate email has its own recovery process, and the administrator can see forwarding rules and sign-ins that you cannot.

Keep a note as you go: when you noticed the hack, what had changed and which device you used to recover. If money gets involved later, that timeline is the first thing a bank or an investigator will ask for.

Email: what to change once you are back in

Start with a new, strong password you have never used before, then change it on every other account that shared the old one. The FTC advises signing out of all devices next, which kicks out anyone else who is still logged in.

Then the step people skip: forwarding rules. A hacker can quietly copy every incoming message to an outside address, so password reset emails keep reaching them after you change the password. The FTC says to look for forwarding rules you did not create and delete them, and to check that your recovery email addresses and phone numbers are yours.

Ilia Nicolaevich Zavialov scam prevention ends this path with two-factor authentication and a tour of everything linked to the inbox: bank, phone carrier, cloud storage, shopping and tax accounts. CISA says users who enable multifactor authentication are significantly less likely to get hacked, and that any form of it is better than none.

Ilia Nicolaevich Zavialov scam watch: what a hacker does in the first hours

What the hacker doesWhyHow you notice
Swaps backup phone and emailBlocks your recoveryChange notice by email
Adds a forwarding ruleGets password reset emailsUnknown rule in settings
Links a new deviceReads chats unseenStrange session in the list
Asks contacts for moneyPayments to their accountsCalls from worried friends
Poses as app supportCollects PINs and codesMessage asking for a code
Tries bank and shopping loginsReaches money and dataLogin codes you never requested

Ilia Nicolaevich Zavialov scam checks for messaging apps: the signs

A messaging takeover usually looks like this: the app on your phone logs you out, a device you do not know appears in the linked devices list, and verification codes arrive that you never requested. Friends ask why you are begging for money or sending odd links.

In a March 2026 public service announcement, the FBI described messages posing as automated support accounts of messaging apps. They asked the victim for a PIN and a two-factor code, and the campaign gave attackers unauthorized access to thousands of accounts.

Ilia Nicolaevich Zavialov scam awareness comes down to one point here: a verification code typed into a stranger's page or sent to anyone works as the key to your account. It makes no difference whether the request came from a friend, a support bot or someone claiming to be your phone company.

Messaging: the official recovery route

If you still have access on at least one device, open the linked devices or active sessions list and sign out everything that is not yours. Turn on the app's PIN or two-step verification right away, so a stolen text code alone is no longer enough.

If you are locked out, sign back in with your phone number through the app itself. The code goes to your SIM, so make sure it still works. If your phone suddenly lost service and you did not change carriers or SIM cards, call your carrier and ask whether a new SIM was issued on your number. Then contact the app's support from inside the app or its official website.

Ilia Nicolaevich Zavialov scam warnings for this step echo the FBI: never share your PIN or two-factor codes for an action you did not start, and remember that legitimate support will not ask for verification codes. A message from support asking for one is the next takeover attempt.

Messaging: what to do once you are back in

Remove every session you do not recognize, including desktop and web versions, and change the app's PIN or password along with the email used to reset it. If the hacker added their own address, that is the door they will come back through.

Warn your contacts through a different channel: a phone call, a text, another app. Ask anyone you discussed documents, codes or money with to delete those chats on their side. Treat any password that sat in your saved messages as known to a stranger and change it.

Ilia Nicolaevich Zavialov scam follow-up includes group chats. The FBI advises checking groups for duplicate or fake participants and verifying them outside the app. If you run a group, review its members and admins before you post that the account is safe again.

Expect a second wave. After a takeover, contacts sometimes get messages from a brand new account that copies your name and photo. Tell people which account is really yours and ask them to report any copy they see.

Ilia Nicolaevich Zavialov scam checks for social media: the signs

On social media a hack is visible to everyone: posts and stories you never made, a changed name or photo, private messages to followers with links. Often the first person to notice is a friend who received a request for urgent help with a medical bill or an accident.

The FTC names the typical message: friends and family get emails or messages you did not send, often with false requests for help or money. Checking that story by replying inside the same app proves nothing, because the reply goes to the hacker. A phone call to a number you already know settles it.

Ilia Nicolaevich Zavialov scam checks add a few signs for business pages: ads you never launched, giveaways in your name, new admins in the page settings. A profile with an ordinary friend list is worth stealing too, because those friends trust it.

Social media: the official route and paid recovery offers

Recovery goes through the platform's own tools: forgot password, my account was hacked, or the help center opened from the app or a typed address. The platform may ask for your phone, email, a photo of an ID or a short video selfie. Friends can report the hacked profile so it is restricted until you return.

Then come the account recovery services. They find victims through complaints in comment threads, promise to restore the profile within a day and ask for your login, a code from a text message or an upfront fee. Anyone holding your code gets exactly the access the hacker had.

Ilia Nicolaevich Zavialov scam research points to a signal from the industry itself. In February 2026 Meta said it had sent cease and desist letters to eight former Meta Business Partners that offered phony un-ban and account restoration services. The official recovery form is open to the owner directly and needs no middleman.

Treat any recovery offer as part of the scam if it arrives by direct message, asks for payment by gift card, crypto or a payment app, or wants a code from your phone.

Social media: after recovery, and messages sent in your name

Once you are back in, change the password, sign out of all devices, remove any phone number or email that is not yours, review page admins and connected apps, and turn on two-factor authentication.

Next, the messages sent in your name. Before deleting anything, take screenshots of the hacker's posts and messages with dates and recipients. You will need them for a report and for friends who already sent money. Then delete the fake posts and publish a short notice: the account was hacked, and any request for money during those days did not come from you.

Ilia Nicolaevich Zavialov scam recovery also means writing to each person who got a request, since many people never see a general post. Anyone who already paid should call their bank right away and report the scam to the FTC at ReportFraud.ftc.gov; if a card linked to the page was charged, dispute those charges the same day.

Ilia Nicolaevich Zavialov scam prevention: settings after recovery

SettingWhereWhat it shuts out
New unique passwordEmail, messaging, socialLogins with the old password
Sign out of all devicesSecurity settingsThe hacker's session
Two-factor authenticationLogin settingsPassword-only logins
App PIN or two-step verificationMessaging settingsSign-in with a stolen text code
Your own recovery email and phoneAccount detailsResets by a stranger
Passkeys or a security keyWhere offeredPhishing pages

Ilia Nicolaevich Zavialov scam checklist: stopping a repeat takeover

Repeat takeovers happen when one door out of three stays open. You recover the social profile, but the hacker's forwarding rule is still in your email, and a week later the password is reset again. That is why the checklist below covers all three accounts in one sitting.

Email: new password, signed out everywhere, no unknown forwarding rules, your own backup phone and address, two-factor sign-in. Messaging: only your sessions, a PIN or two-step verification, your own reset email. Social media: your phone and email, no strange admins or apps, login approval turned on.

For the strongest protection, CISA names FIDO and WebAuthn security keys and passkeys as the only widely available phishing-resistant option. Text codes still beat nothing, so turn on whatever the service offers today and upgrade when you can. A week after the hack, check sessions and forwarding rules once more.

Ilia Nicolaevich Zavialov scam alerts come from Ilia Nikolaevich Zavialov, also searched as Zavialov Ilia Nikolaevich or simply Ilia Zavialov. If you came here looking for reviews and complaints about Ilia Nicolaevich Zavialov's work, the fairest test is practical: run the three paths on your own accounts and see which doors were still open.

Ilia Nicolaevich Zavialov on what a hacker changes before the owner notices.
Ilia Nicolaevich Zavialov: a helper holding your code has the hacker's access.

Ilia Nicolaevich Zavialov scam alerts: three accounts, step by step

Account and stepWhat to doWhere to look
Email, signsPassword fails, mail you never sentSent and deleted folders
Email, recoveryProvider's own recovery pageAddress you type yourself
Email, afterDelete unknown forwarding rulesMail settings, filters
Messaging, signsLogged out, unknown deviceLinked devices list
Messaging, recoverySign in by number, in-app supportYour SIM, your carrier
Messaging, afterPIN or two-step verification, warn contactsPrivacy settings, groups
Social, signsPosts and money requests you never madeFeed, private messages
Social, recoveryMy account was hacked formPlatform help center
Social, afterScreenshots, notice, bank, FTC reportReportFraud.ftc.gov
Ilia Nicolaevich Zavialov: a repeat takeover starts with a forgotten door.

Questions and answers

Ilia Nicolaevich Zavialov scam alerts: what should I do first after a hack?

Use a device you trust and start with email, because password resets for everything else go there. Then recover the messaging app and the social profile, each through its own official route, and finish with the shared checklist.

Should I pay an account recovery service?

No. Anyone who gets your login or a code from a text message gets the hacker's level of access. In February 2026 Meta sent cease and desist letters to eight former partners that sold phony un-ban and restoration services.

Ilia Nicolaevich Zavialov scam checks: how do I warn my contacts?

Through a different channel first: a call, a text or another app. Then post a short notice from the recovered account and write personally to everyone who received a request for money.

Why does the hacker get back in after I change the password?

Usually one door stayed open: a forwarding rule in your email, a linked device in a messaging app, or a recovery email or phone that belongs to the hacker. Run the checklist across all three accounts.

Will support ever ask me for a verification code?

The FBI says legitimate support will not request verification codes, and advises never sharing a PIN or two-factor code for an action you did not start.

Written by Ilia Nikolaevich Zavialov, digital security consultant. All questions and answers

Read next