Lost control of your WhatsApp, Facebook, Instagram or email? The first-hour checklist to recover the account through official channels and stop the damage.
Account takeovers in Kenya usually start the same way: a message from a "friend" asking you to forward a code, a fake login page, or a reused password from an old leak. Once in, attackers message your contacts asking for M-Pesa or sell your page. Speed matters. Here is what to do in the first hour.
1. Stay calm and never share codes
Do not send any code you receive to anyone, even someone claiming to be support or a friend. Legitimate platforms never ask you to forward a verification code.
2. WhatsApp
- Open WhatsApp on your phone and register your number again. You will receive an SMS code; entering it logs the attacker out.
- If the attacker set a two-step verification PIN, you may have to wait before you can fully restore. Keep trying from your own SIM.
- Once back in, go to Settings > Account > Two-step verification and set your own PIN.
- Warn your contacts by SMS or another app that anyone asking for money "from you" is not you.
3. Facebook and Instagram
- Use the official recovery pages: facebook.com/hacked and instagram.com/hacked.
- Check the email inbox linked to the account for "email changed" or "password changed" messages; they often include a link to reverse the change.
- After recovery, review logged-in devices, remove unknown ones and turn on two-factor authentication with an authenticator app.
4. Email (Gmail, Outlook, business email)
Email is the master key: whoever controls it can reset every other account.
- Use the provider's official account recovery page from a device you normally use.
- Once back in, change the password, check forwarding rules and recovery phone/email (attackers add their own), and sign out of all other sessions.
5. If it is your website
Signs include strange redirects, spam pages in Google results or a hosting suspension notice. Change hosting, admin and database passwords, take a backup for evidence, then clean and patch the site. Do not just restore an old backup: the hole the attacker used is still open.
6. Lock everything down
- Use a unique password for every important account, kept in a password manager.
- Turn on two-factor authentication everywhere, preferably with an authenticator app.
- Update your phone and computer, and remove apps you do not recognise.
When to call us
Bepents Tech Services helps individuals and businesses recover accounts they own through the official processes, cleans hacked websites and secures every account afterwards. The sooner you reach us, the better the chances. WhatsApp us now.