8. If you are hacked: how to recover

How Do You Know You Have Been Hacked?

Sometimes hacking is obvious — you cannot log in to your own account. Other times the signs are subtle. Here are the most common warning signals:

You cannot log in

You enter the correct password but the account says it is wrong. This usually means a hacker changed your password after gaining access.

You receive unexpected security alerts

Your email or phone gets messages such as 'A new device signed in to your account' or 'Your password was changed' — but you did not do it.

Friends and family report strange messages from you

Contacts tell you they received unusual links, requests for money, or strange messages from your Facebook, Telegram, or email — messages you never sent.

Money disappears from your TeleBirr or bank account

You receive an SMS alert showing a transaction you did not authorise, or you notice a missing balance when you check your app.

Your phone behaves strangely

Apps open by themselves, your phone runs very hot, data usage spikes with no explanation, or you notice new apps you did not install. These can all indicate malware on your device.

You stop receiving calls or SMS messages

This may mean your SIM card was swapped — a criminal has transferred your phone number to a SIM card they control.

The First 10 Minutes: Contain the Damage

Think of the first ten minutes like putting out a fire — your job is to stop it spreading before you assess the full damage.

Step 1: Change your password immediately — on a safe device

If you can still log in, change your password right away. Use a different device from the one you think was compromised — a family member's phone, a computer at a library, or your workplace computer. If your email was hacked, change that first because most accounts send password-reset links to email.

Step 2: Log out all other sessions

Most services have a 'Log out of all devices' option in their security settings. Use it. This will kick the hacker out of any active session they have open on your account.

On Facebook: Settings → Security and Login → Where You're Logged In → Log Out of All Sessions.

On Gmail: scroll to the bottom of your inbox → 'Last account activity' → 'Sign out all other web sessions'.

Step 3: Freeze your financial accounts if money was involved

If TeleBirr or your bank account is affected, call immediately:

• TeleBirr emergency line: 127

• Commercial Bank of Ethiopia (CBE): 8397 or visit a branch

• Awash Bank: +251 116 616 388

Say your account has been compromised and request an immediate freeze. Do not wait.

Step 4: Enable two-factor authentication (2FA) right now

Once you regain access to an account, turn on 2FA before anything else. This means that even if the hacker tries your new password, they cannot get in without the one-time code sent to your phone.

The Next Steps: Assess, Report, and Rebuild

Once you have contained the immediate damage, work through these steps carefully:

Check what the hacker did

Review the account's activity log or history. On Facebook, go to Settings → Activity Log. On Gmail, check Sent, Trash, and the 'Last account activity' link at the bottom of the inbox. Look for:

• Emails or messages sent on your behalf

• Personal details that were changed (phone number, recovery email)

• Files, photos, or contacts that may have been copied

• Any payments or subscriptions that were made

Update your recovery information

A hacker may have changed your recovery email address or phone number so that they can get back in even after you reset your password. Check and restore your correct recovery details immediately.

Scan your phone for malware

If you believe your phone was infected, install a reputable security app (such as Avast Mobile Security or Bitdefender Mobile Security) and run a full scan. If the infection is serious, you may need to do a factory reset — but back up your photos and contacts first.

Report to the platform

Facebook, Google, Telegram, and most major services have a 'Report a hacked account' link. Use it. The platform may be able to help you recover additional data or warn other users.

Report to the police (for financial crimes)

If money was stolen, file a police report at your nearest police station in Addis Ababa or your local woreda. Ask for a case number — your bank will need it to investigate the fraud and may use it to initiate a transaction reversal.

Warn Your Contacts and Stop the Spread

After a hack, your contacts are at risk. The hacker may use your account to send them malicious links or beg for money while pretending to be you. Here is what to do:

Send a warning immediately

As soon as you regain control, post a public message (or send a personal message) telling all your contacts: 'My account was hacked. Please ignore any messages from me that ask for money or contain unusual links. I am working to fix the problem.'

Use a different channel to warn people

If your Facebook was hacked, use WhatsApp, Telegram, or phone calls to warn people. If your Telegram was hacked, use Facebook or phone calls. Do not rely on the hacked platform itself to spread the warning.

Tell your family in person if needed

Older family members — your grandmother, your uncle — may not check social media quickly. Call them directly or visit them. Explain simply: 'Someone stole my account. If you got a message from me asking for money, do not send it — call me first.'

Check if any of your linked accounts were also affected

If the hacker had access to your email, they may have used 'Forgot password' to break into other accounts linked to that email — your social media, online shopping, or other services. Check all your important accounts and change their passwords too.