Skip to content

Someone has taken over my account

Emergency steps when your official email, social media, WhatsApp, or application account has been taken over and used by someone else.

TLP:CLEAR ·  3 views

Your official email, social media, WhatsApp, or app account is being used by someone else, or you can no longer log in because the password has been changed. The sooner you take the account back, the fewer of your contacts will be deceived.

Signs

  • Your password is suddenly rejected, or you receive an email saying the account's password, recovery email, or phone number has been changed.
  • Messages, posts, or emails you did not write have been sent, for example requests to borrow money from your contacts.
  • Login notifications from a device or city you do not recognize.
  • Your official email has new forwarding rules or filters that move emails to other folders.
  • WhatsApp on your phone logs out by itself, or there is an unknown device under Linked Devices.

Do this now

  1. If you can still log in, change the password immediately from a device you trust is clean.
  2. Log out of all devices through the account security menu, then remove any connected devices and apps you do not recognize.
  3. Restore the recovery email and phone number to your own, then enable two-step verification (2FA).
  4. If you can no longer log in, use the official account recovery option in the app or service website. For Google accounts, use the Google account recovery page.
  5. For official @kutaitimurkab.go.id email, report it to KUTIM-CSIRT and ask for the password to be reset and login sessions to be terminated on the server side.
  6. In your email, delete forwarding rules and filters you did not create.
  7. In WhatsApp, log out all devices under Linked Devices and enable Two-Step Verification (PIN).
  8. Let your contacts know through another channel that your account has been taken over, and ask them to ignore money requests or links from that account.
  9. Change the passwords of other accounts that use the same password.

Don't

  • Do not pay people who offer to recover your account for a fee.
  • Do not give OTP codes or verification codes to anyone, including people claiming to be officials.
  • Do not delete security notification emails. They are evidence and often contain a link to undo the changes.
  • Do not reuse the old password or variations of it.

Report

Report it through /lapor under the category Penyalahgunaan Akun (account misuse). Choose Tinggi (High) for official email, OPD application admin accounts, or official agency social media accounts, and Sedang (Medium) for personal accounts. Attach screenshots of security notification emails, login history, and messages sent by the attacker, then state when you were last able to log in. Keep the ticket number and token shown to you so you can follow up at /lacak-tiket.

If the attacker used your account to ask for money and someone has already transferred it, that person can report it to their bank and to the Indonesia Anti-Scam Centre (IASC) OJK.

To prevent a recurrence

  • Enable 2FA on all accounts, preferring an authenticator app over SMS.
  • Use a unique password for each account and store them in a password manager.
  • Check the list of connected devices and third-party apps every few months.
  • Official agency accounts are managed by at least two administrators, each with their own personal account, without sharing passwords.
  • Do not log in to official accounts from public computers.

Report to KUTIM-CSIRT All emergency steps

Other emergency steps: