How to Tell If You've Been Hacked — And What to Do in the Next 30 Minutes

Something feels wrong. Maybe you got a password reset email you didn't ask for. Maybe a friend texted asking "did you really send me this?" Maybe your bank just sent a notification for a purchase you didn't make. Your gut is probably right. Here's how to know for sure, and exactly what to do about it.

The Warning Signs You've Been Hacked

You don't need to be a tech expert to spot a hack. Most compromises leave obvious traces if you know what to look for:

If even one of these applies to you, don't wait. Don't "keep an eye on it." Act now. Hackers work fast — they know they're on a clock once you notice something is off.

The Critical First 30 Minutes: What to Do Right Now

This is your emergency action plan. Do these in order. Don't skip steps. Don't get distracted looking up who did this or how — that comes later. Right now, you're locking down.

1. Change your email password first — it's the master key. Your email is connected to everything: banking, social media, shopping, government services. If a hacker controls your email, they can reset the password on every other account you own. Go to your email provider (Gmail, Outlook, iCloud) right now and change your password. Make it long — at least 16 characters. Don't reuse an old one.
2. Enable two-factor authentication (2FA) on your email immediately. Once your password is changed, turn on 2FA. This means even if someone gets your new password, they can't get in without your phone. Use an authenticator app (Google Authenticator, Microsoft Authenticator) rather than SMS if possible — SMS can be intercepted via SIM swapping.
3. Check your email forwarding rules. This is the step most people miss, and it's critical. Hackers often set up a forwarding rule that silently sends a copy of every incoming email to their own address. You won't notice because the emails still arrive in your inbox — but they're getting a copy of everything. In Gmail: Settings > Forwarding. In Outlook: Settings > Mail > Forwarding. Delete any forwarding address you don't recognise.
4. Change your banking passwords and call your bank. Don't just change the password online — actually call your bank. Tell them you believe your accounts may be compromised. They can flag your account, freeze cards, reverse unauthorised transactions, and issue new card numbers. Do this even if you haven't seen suspicious charges yet. The charges might be coming.
5. Check what apps have access to your accounts. Over time, you've probably granted dozens of third-party apps access to your Google, Apple, Facebook, or Microsoft accounts. A compromised app is an open door. Go to your account security settings and revoke access for anything you don't recognise or no longer use.
6. Check for unknown devices logged into your accounts. Every major platform shows you which devices are currently signed in. In Google: myaccount.google.com/device-activity. In Apple: Settings > [Your Name] > scroll down to see devices. Sign out anything you don't recognise. Sign out everything if you're unsure — you can sign back in on your own devices.

After the First 30 Minutes

Once you've locked down email, banking, and active sessions, work through these:

• Change passwords on all important accounts — social media, shopping (Amazon, eBay), government services (myGov), cloud storage, and any account that stores payment details
• Check for unauthorised purchases — review your bank and credit card statements for the past 30 days, look for small test transactions (hackers often charge $1-2 first)
• Update your phone and computer — install all pending operating system and app updates, as these patch known security holes
• Run a malware scan — use Malwarebytes (free) on your computer, and check your phone's app list for anything unfamiliar
• Change your phone's lock screen PIN — if someone had physical access to your device or has been watching you via spyware

How Hackers Actually Get In

Understanding how this happened helps you prevent it from happening again. Most hacks aren't sophisticated — they exploit human behaviour, not technical flaws.

Phishing emails and texts

The most common method by far. You get an email or SMS that looks like it's from your bank, Australia Post, myGov, or Netflix. It asks you to "verify your account" or "update your payment details." The link goes to a fake website that captures your login. These are getting extremely convincing — some are nearly indistinguishable from the real thing.

Data breaches

A company you have an account with gets hacked, and your email and password are stolen along with millions of others. If you use the same password on multiple sites (most people do), the attackers try that email/password combination everywhere. This is called credential stuffing, and it's automated — they can try thousands of sites in minutes.

SIM swapping

The attacker convinces your phone provider to transfer your number to their SIM card. They now receive your calls and texts — including those two-factor authentication codes your bank sends. This is why app-based 2FA is safer than SMS-based 2FA.

Public WiFi

Connecting to free WiFi at cafes, airports, or hotels without a VPN can expose your traffic. Attackers can set up fake hotspots with names like "Westfield_Free_WiFi" that look legitimate. Anything you send over that connection — logins, emails, banking — can be intercepted.

Malware and spyware

Malicious software installed through dodgy downloads, email attachments, or compromised websites. On phones, this often comes from installing apps outside the official app store, or from clicking links in suspicious texts. Spyware can log your keystrokes, read your messages, access your camera, and send everything back to the attacker.

Tools to Check If You're Compromised

Use these free tools to assess the damage and find out what's been exposed:

Australian Resources for Reporting and Recovery

You're not on your own. These are the official Australian organisations that handle cybercrime, scams, and identity theft:

When to Get Professional Help

Some situations are beyond what you can fix with a password change. You should bring your device to a professional if:

• You can't remove the malware yourself — some spyware and remote access tools are designed to survive factory resets and hide from antivirus software
• You've been the victim of a scam — if you've given remote access to someone claiming to be "Microsoft support" or "your bank," your device needs to be forensically cleaned
• Your identity has been stolen — if someone has opened accounts, taken out loans, or filed tax returns in your name, you need professional help navigating the recovery process
• You suspect someone is monitoring your device — stalkerware and spyware designed for surveillance require careful removal to avoid alerting the person who installed it
• A business account has been compromised — if you run a business and customer data may have been exposed, you have legal notification obligations under the Notifiable Data Breaches scheme

There's no shame in asking for help. Hackers do this for a living. You don't have to fix it alone, and the sooner you get expert help, the less damage they can do.