How to Find Out Who Hacked Your Account

Account takeover is what investigators call it when someone other than you gains control of an account you own: your email, a social profile, a bank or brokerage login, a gaming account, a cloud drive. It is different from a generic “scam,” because the attacker is not just tricking you into sending money, they are sitting inside something that belongs to you, reading what you read and sending messages as if they were you. That distinction matters, because it means the account itself becomes a crime scene, and crime scenes hold evidence if you preserve them before they are overwritten.

Most takeovers happen one of a few ways. The largest share is credential stuffing, where a password you reused somewhere was exposed in a data breach and criminals replay that email-and-password pair across hundreds of sites until one works. Others come from phishing, where a fake login page captures your real password, or from a malicious sign-in cookie or token stolen by malware, which can sail straight past two-factor. A smaller but painful category is the known person: an ex-partner, a roommate, a relative, or a coworker who knew your password, guessed your security answers, or had physical access to an unlocked phone. Each of these leaves a different signature in the login history, which is exactly why the activity log is the first thing to read, and the first thing to save.

The urge to play detective is natural, but the first job is to take back control, because while the attacker is still inside they can lock you out further, drain accounts, and erase the very logs you will need. Work from a device you trust, not the one you suspect is infected. The official walkthrough from the FTC on recovering a hacked email or social media account is a solid checklist to keep open while you do this. Do not delete anything yet, even spam the intruder sent, because deleting evidence helps no one but them.

The login trail. Every sign-in carries an IP address, and an IP resolves to an internet provider and a general geographic area, sometimes a neighborhood, sometimes only a region or a data center. On its own an IP rarely names a person, but it tells you a great deal: whether the access came from near you or from another country, whether it bounced through a known VPN or hosting provider, and whether several “different” sign-ins actually trace to one source. Patterns matter more than any single line. A login from your own town at an hour you were asleep points in a very different direction than a string of logins from overseas, and that distinction often decides whether this is a stranger or someone close to you.

The recovery-detail trail. To keep control, intruders almost always add their own recovery email or phone number so they can take the account back even after you reset it. That added contact detail is one of the most valuable leads in the whole case, because it is something the attacker chose and can be researched. A recovery phone number can be checked against public records and carrier data the way our guide to identifying a scammer by phone number describes, and an added recovery address can be run the way our walkthrough on finding someone by an email address lays out.

The reuse trail. People, including attackers, reuse things. A username, handle, or display name the intruder set, or that appears in the recovery details, may match accounts elsewhere, profiles, forum posts, marketplace listings, that point back to a real identity. And if your password was taken in a breach, knowing which breach and which other accounts shared that password helps reconstruct how the takeover happened. The money trail. If funds, gift cards, or purchases moved, follow them: the destination account, the payee name, the shipping address, the transaction IDs. Money is the trail attackers are worst at hiding, and it is frequently what turns an anonymous login into a named person, the same logic that drives finding someone who scammed you after a financial loss. All of this is done through lawful public-records research and open-source techniques. It never involves breaking into the attacker’s accounts, “hacking back,” or any unauthorized access, which is itself a crime and would destroy any case you are building.

A large share of personal account takeovers are not faceless foreign hackers at all. They are an ex-partner who never lost the password, a current or former spouse during a separation, a roommate with access to an unlocked laptop, a family member, or a coworker. These cases look different in the evidence, and they are usually the most identifiable. The sign-ins come from local IP addresses, sometimes the same home or office network you use. The timing lines up with a real person’s schedule. The intruder knew the answer to your security questions or your pet’s name because they know you. And there is often no impossible travel, no overseas hop, just quiet access from nearby.

If the pattern fits a known person, two things matter. First, document carefully and resist the urge to confront before you have preserved everything, because a confrontation can prompt them to wipe their tracks or escalate. Second, if you feel unsafe, especially in a domestic or stalking situation, prioritize your safety and involve law enforcement and a local victim advocate rather than handling it alone. On the investigative side, this is precisely where lawful skip tracing is strongest: confirming an identity, locating the person, and assembling the timeline and records that support a protective order, a police report, or a civil claim. It overlaps heavily with broader fraud investigation work, where naming and locating the responsible party is the whole point.

Send us what the account left behind, even if it feels thin: the login IPs and locations, the recovery email or phone the intruder added, a username or handle, message headers, or the account where money landed. Our investigation team researches those identifiers through lawful, permissible-purpose public records and skip-tracing sources, and reports back honestly on what they do and do not support. We do not break into anything, we never hack back, and we will tell you plainly when a trail is out of reach. This is the same lawful research that powers our full-spectrum skip tracing and our work helping people find a person who scammed them. For a legitimate matter, an initial locate typically comes back within 24 hours.