Grandma Got Phished: The No-Panic Playbook for Rescuing a Hacked Account

The call usually comes at dinnertime. Your mom's voice is a little too tight when she says, "Your aunt sent me something weird, and I think I clicked it." Or maybe your grandpa's Facebook is suddenly posting links to a crypto "giveaway," and half the family has already texted him about it.

Take a breath. This happens to millions of people every year, and most of the time it's completely fixable. What matters is the order you do things in — because a hacked email account is the master key to everything else, and it should be your first stop, not your last.

Here's the sequence we'd walk anyone through, whether it's a grandparent in Ohio or a roommate down the hall.

Step 1: Secure the Email Account First — Everything Else Hangs on It

If someone has control of an email inbox, they can hit "forgot password" on every other account and take those too. So before touching Facebook or the bank, lock down the email.

• Change the password from a device the scammer hasn't touched. If the family laptop might be infected, use a phone or a different computer.
• Check the recovery settings. Look at the recovery email and phone number on file. Scammers often add their own "backup" contact so they can stroll back in later. Delete anything you don't recognize.
• Sign out of all sessions. Gmail, Outlook, and Yahoo all have a "sign out of all devices" option buried in the security settings. It's one click, and it kicks the intruder out everywhere at once.

If the scammer already changed the password and you're locked out, use the provider's account recovery flow. It's tedious, but Google and Microsoft can usually verify ownership through a recovery phone, an old password, or the device you're calling from.

Step 2: Change Every Password That Shares a Login

Here's the uncomfortable truth: most people reuse passwords, which means the email password your aunt just reset is probably also her Target password. Go through the big ones — banking, Amazon, PayPal, Facebook, the health insurance portal — and set fresh, unique passwords for each.

Nobody memorizes a dozen random strings, and nobody should have to. Get them set up with a password manager (the free tiers of Bitwarden or 1Password are plenty) and let it do the remembering. This is the single best 20-minute investment you can make in a relative's digital safety.

Step 3: Turn On Real Two-Factor Authentication

Not the text-message codes — those can be intercepted through SIM-swapping tricks. Where it's offered, use an authenticator app like Google Authenticator or Authy, or a passkey if the site supports it.

Prioritize in this order:

1. Email
2. Banking and any money-transfer apps (Venmo, Zelle-linked accounts, PayPal)
3. Social media
4. Everything else as you get to it

Yes, it adds a step to logging in. It also means a stolen password alone gets a scammer nowhere.

Step 4: Warn the Contact List Before the Scammer Beats You to It

If the compromised account was used to send messages, some of your relative's friends already got a convincing "Is this you??" link from a trusted address. A quick post on their Facebook, a text to the people they message most, or a short email blast does the job: "My account was hacked this morning. If you got anything weird from me, don't click it — it's fake."

It's slightly embarrassing for about a day. Leaving the scam running costs someone else their savings.

Step 5: Check the Damage and Clean Up

Once the doors are locked, do a quick walkthrough:

• Email: Search the Sent folder and the trash for messages the scammer sent. Check the filter rules — hackers sometimes set emails to auto-forward or auto-delete so the victim never sees password-reset notices.
• Bank and cards: Review the last 30 days of transactions for anything unfamiliar, even small ones. Scammers often test with a $1 charge before going bigger. If anything looks off, call the number on the back of the card — not one from an email.
• Connected apps: In Facebook's settings, there's a list of apps and websites with account access. Revoke anything that looks stale or unfamiliar.
• Credit reports: If money was involved, pull free reports at AnnualCreditReport.com and consider a fraud alert with one of the three bureaus — placing it with one notifies the others.

Step 6: Have the Gentle Conversation

This is the part people skip, and it's the part that prevents the sequel. Your relative is probably mortified, and shame is exactly what scammers count on — victims who feel stupid don't report things quickly.

So skip the lecture. Instead, explain the pattern: urgency, unusual requests, links that don't quite match the sender's address. The IRS doesn't call about back taxes at 7 p.m. The grandchild stranded in jail doesn't need gift cards. A software pop-up demanding you "call Microsoft now" is never real.

Then do the practical setup together while you're there: password manager installed, authenticator app on their phone, recovery contacts updated. Fifteen minutes of hands-on help beats a year of worried phone calls.

The Version to Email Your Family Right Now

If you only take one thing from this article, make it this: the next time panic hits, nobody should be improvising. Send this to the relatives who need it — before the call, not after. A short note that says "if your account ever gets hacked, here's the exact order to fix things" might be the most useful email you write all year.

And if it happens anyway? You'll know exactly what to do, in what order, without the dinnertime dread.