Recovering a Hacked Online Account Just Changed

Google began rolling out an optional selfie video for sign-in and account recovery on July 23, 2026, and since September 1, 2026, Microsoft's work and school accounts have made passkeys the default. For you, that means getting back into a hacked account now depends less on passwords and text-message codes and more on what you set up in advance: passkeys, trusted recovery contacts and, at Google, that selfie video. Several of these changes are live, some are still rolling out, and a few big ones apply only to work and school accounts. Apple has not announced comparable changes. The practical steps for the first hour have barely moved, and recovery scams are as common as ever.

Key takeaways

• Google added recovery contacts (up to 10 trusted people) on October 15, 2025, and an optional selfie video for sign-in and recovery on July 23, 2026. Recovery contacts aren't available for Workspace, child or Advanced Protection accounts, and Google says the selfie video isn't available for all regions, accounts or devices.
• Microsoft says it will phase out SMS codes for sign-in and recovery on personal accounts, replacing them with passkeys and a verified email. It has published no end date.
• The firm Microsoft deadlines (passkeys by default from September 1, 2026, and the end of Microsoft-provided SMS and voice codes on February 1, 2027, or July 1, 2027 for global administrators and external users) apply to Microsoft Entra ID work and school accounts, not personal Outlook or Xbox accounts.
• Google can keep sending codes to your old recovery phone or email for 7 days after recovery info changes. If a hacker swapped in their own number, that may give you a short window.
• Real recovery starts from a page you open yourself. Google and Apple say they never ask for your password or codes, Microsoft says it doesn't make unsolicited calls to request personal information, and Microsoft's support agents cannot send password reset links.

What it means for you

• Personal Google, Apple, Microsoft or Meta account. The new tools only help if you add them while you can still sign in. Add a passkey, check your recovery email and phone, and consider recovery contacts at Google or Apple. At Microsoft, add a verified backup email now: Microsoft says it will phase out SMS codes for personal accounts, with no date announced. The checklist is under "Set up recovery before you need it."
• Work or school Microsoft account. Since September 1, 2026, you may be prompted to create a passkey. From February 1, 2027 (July 1, 2027 for global administrators and external users), Microsoft-sent texts and calls end as a sign-in option unless your employer uses a third-party SMS provider. These dates don't apply to personal Outlook, Hotmail or Xbox accounts. See "Work accounts vs personal accounts."
• Locked out right now. Start recovery from a page you open yourself, on a device you normally use. A Google recovery contact you add today can't help for at least 7 days, but if a hacker swapped your Google recovery phone, codes may still go to your old number for 7 days, so act within that week. Expect waits: Apple's recovery can take several days or more. See "The first hour after a hack" and "Waiting periods you will hit."
• Contacted by someone offering to help. Provider recovery is free, and Google says unsolicited calls, texts or emails claiming to be Google Security about a hacked account are always a scam. See "Real recovery path or phishing?"

What changed, with dates

The table lists each change, who it covers and whether it is live, rolling out or only announced. Every item was checked against the company's own help page, blog or documentation as of October 2, 2026.

Apple has not announced comparable changes. Its recovery contacts (up to five people, who must be over 13, though the age varies by country or region, and must use iOS 15, iPadOS 15 or macOS Monterey or later) and its optional 28-character recovery key are still offered. Turning on the recovery key switches off Apple's standard account recovery, so losing the key can lock you out for good.

Meta has also been working on a video selfie check for locked-out users. It began testing the check for compromised Facebook and Instagram accounts in October 2024, and a March 4, 2025 update to its announcement said people in the UK, EU and South Korea would soon get it as an option. Meta says the check is optional and that facial data is deleted right after the comparison. The post does not say which US accounts get the option.

Work accounts vs personal accounts

Microsoft's changes are the easiest to misread. The firm dates in its documentation (September 1, 2026, then February 1, 2027 and July 1, 2027) apply to Microsoft Entra ID, the sign-in system employers and schools use. That means a work Microsoft 365 login may now prompt you to create a passkey. After February 1, 2027, anyone whose only second step is a Microsoft-sent text or call will have to register a passkey before signing in, unless the employer sets up a third-party SMS provider. Global administrators and external users get until July 1, 2027.

A personal Outlook.com, Hotmail, Xbox or OneDrive account follows a different, open-ended plan. Microsoft's support page says it "will start phasing out SMS" for personal accounts and will guide users to add a verified email and a passkey, but it gives no cutoff date. If you have both kinds of account, a work notice about SMS ending does not mean your personal account will stop receiving texts on the same day.

What NIST 800-63-4 says

For context, NIST's digital identity guidelines are mandatory only for federal agency systems, but the July 2025 revision describes the same building blocks the companies above now use. SP 800-63B-4 recognizes four general ways to recover an account:

• Saved recovery codes handed out at sign-up and stored offline. Each is single-use and replaced after use.
• Issued recovery codes sent to an address on file. They expire after at most 10 minutes by text or voice, 24 hours by email and 21 days by mail within the contiguous US.
• Recovery contacts, trusted people who receive the code for you. Their codes may last 24 hours longer.
• Repeated identity proofing, such as checking an ID again, for accounts that were identity-verified in the first place.

A service may also use its own method, such as help from a support agent, if it documents a risk analysis. Security questions are not among the four. The document also says services "SHALL NOT" prompt people to use knowledge-based questions when choosing passwords. Recovery must always trigger a notification to the account holder, and services must let users keep at least two notification addresses. That is why a recovery email you did not request is worth reading carefully: it may be the only sign that someone else started a recovery.

The first hour after a hack

The order below combines the FTC's hacked-account checklist with the providers' own instructions. Microsoft's hacked-account guide says to scan for malware before changing the password, because malware on the device can capture the new password too.

1. Use a clean, familiar device. Run a security scan. Google and Microsoft both say recovery goes better from a device and location you normally use.
2. Start the provider's own recovery. Type the address yourself: Google's compromised-account page leads to accounts.google.com/signin/recovery. Facebook uses facebook.com/hacked, Instagram uses instagram.com/hacked, Microsoft uses its sign-in helper and recovery form, and Apple uses iforgot.apple.com.
3. Change the password and sign out everywhere. Then check the list of signed-in devices and remove any you don't recognize.
4. Fix your recovery info. Remove any phone number, email or recovery contact you didn't add. Attackers often change these first.
5. Check email rules. Delete forwarding rules and filters you didn't create. Then review sent and deleted messages and recent posts.
6. Turn on stronger sign-in. Add a passkey if the service supports one, or at least two-step verification.
7. Warn your contacts. Hacked accounts are often used to send scam links to friends.

Waiting periods you will hit

Recovery is slower than signing in by design, and NIST notes it may involve extended waiting times. Knowing the delays in advance helps you tell a normal process from one that has stalled.

Illustrative example. Say you invite a sibling as a Google recovery contact on October 2, 2026. If they accept on October 4, they can help from October 11 (4 + 7). If they wait until the invite's last day, October 9, the earliest date is October 16. A new contact becomes usable 7 to 14 days after the invite, depending on how quickly they accept. That is no help if you are already locked out.

The 7-day rule also works in your favor. If a hacker replaced your recovery phone on October 2, Google may keep sending codes to your old number until about October 9. Starting recovery within that week is when this fallback may still be available.

Apple's wait has a further condition. Its guide says to turn off every other device signed in to the account until recovery is finished, because using them can delay or interrupt the process.

Real recovery path or phishing?

Fake recovery pages and "account recovery services" target people at their most anxious. The companies' own statements give clear tests:

• Who started it. Google says any unsolicited call, text or email claiming to be Google Security about a hacked account is always a scam. Real recovery begins when you open the provider's site or app yourself.
• What they ask for. Apple says it will never ask for your password, device passcode or two-factor code, or ask you to tap Accept on a sign-in prompt. Google's recovery tips say it never asks for passwords or verification codes by email, phone or message.
• Reset links from a person. Microsoft says its support agents "are not allowed to send password reset links" or change account details. A "Microsoft agent" who sends one is not from Microsoft. Microsoft also says it doesn't make unsolicited calls to request personal or financial information.
• Payment. Provider recovery is free. The FTC says legitimate organizations never ask for money to help you get money back, and payment by gift card, crypto or wire transfer is a classic scam sign.
• The address bar. A passkey is tied to the real site, so it won't work on a lookalike domain. The FIDO Alliance explains this as the reason passkeys resist phishing. If your passkey isn't offered on a page where it normally appears, and you're not on a new device that lacks it, treat the page as suspect.

Official tools can also have flaws. Meta disclosed that a password-reset tool used by its Instagram support team, called High Touch Support, failed to check that the email requesting a reset matched the one on the account. According to SecurityWeek's report on Meta's filing, about 20,225 accounts may have been affected before Meta discovered the abuse on May 31, 2026. Meta then disabled the tool and reset the affected passwords. Any reset email or alert you didn't request deserves a look, even when it comes from the real company.

When it becomes identity theft

A hacked account becomes an identity theft case if the attacker uses your details to open accounts, take out credit or file anything in your name. The FTC's identity theft guidance says to report it at IdentityTheft.gov, which produces a free personal recovery plan and pre-filled letters for credit bureaus and businesses. It also suggests a free fraud alert, which lasts one year, and a free credit freeze with Equifax, Experian and TransUnion, which you can lift at any time.

This article is general information, not legal or financial advice. If money was taken from a bank or card account, contact the bank directly using the number on the card or statement.

Frequently asked questions

Why is my Google account recovery on a security hold?

If something about a request looks unusual, Google may put it on a security hold, a delay before it processes the recovery claim. Google uses that time to notify you through your recovery info, so the real owner can deny a request someone else made. The hold can last from a few hours to a number of days depending on risk factors, and it may be longer if the account uses 2-Step Verification. If you regain another way to verify it's you during the delay, such as a device you normally sign in on, Google suggests starting recovery again from there.

What if Google says it couldn't verify the account is mine?

Google's recovery tips say you can try again after a "Google couldn't verify this account belongs to you" message, and that wrong guesses on its questions won't kick you out of the process, so answer as many as you can. If you still can't get in, Google suggests creating a replacement account. Usernames aren't recycled, so your old address won't be available, and Google says a lost account can't be closed unless the owner signs in.

Can I get back an account the hacker deleted?

Possibly, if you move quickly. Google says a recently deleted account may still be recoverable through its usual recovery steps, but one deleted a while ago may not be, and it gives no fixed cutoff. Microsoft says a closed account comes with a 30-day or 60-day grace period, during which you can reopen it by signing in at account.microsoft.com and entering a security code. After the grace period, the account is permanently deleted.

The hacker changed my Facebook email. Can I undo it?

Meta says that when the email on a Facebook or Instagram account is changed, it sends a message to the previous address with a special link. Clicking that link reverses the change and lets you secure the account. If you can't find the message, Meta points hacked users to facebook.com/hacked or instagram.com/hacked.

I got an Apple recovery email I didn't request. What now?

Apple's account recovery guide says to cancel a request you didn't make by following the instructions in the confirmation email. If you are the one waiting and you remember your details, signing in successfully cancels the wait automatically and you can use the account right away. You can check a request's status at iforgot.apple.com with the same email address or phone number that started it.

Set up recovery before you need it

Most of the new tools only work if they are added while you can still sign in. Google's help pages say recovery info can't be added while you are locked out. A short checklist for each account you care about:

• Add a passkey to your main email account, Apple or Google account, and Facebook.
• Check that your recovery email and phone are current, and don't use a Google Voice number as your Google recovery phone (Google warns this can lock you out).
• Add one or two recovery contacts at Google or Apple. The contacts can't see your data.
• At Microsoft, add and verify a backup email now, before SMS stops being offered for your personal account.
• If you use Apple's recovery key, store a printed copy somewhere safe, because Apple cannot reissue it.
• If you're comfortable with face matching, consider Google's optional selfie video while you can still sign in. Google lets you delete it at any time.

Sources

• NIST CSRC: SP 800-63B-4 publication record
• NIST SP 800-63B-4: Authentication and Authenticator Management (account recovery and notifications)
• Google: Recovery contacts announcement
• Google: Sign in with mobile number announcement
• Google: Selfie video for sign-in announcement
• Google Account Help: Recovery contacts
• Google Account Help: Set up recovery options
• Google Account Help: Secure a hacked or compromised account
• Google Help: Account security scam via phone call
• Google Account Help: Tips to complete account recovery steps
• Google Account Help: Why your account recovery request is delayed
• Google Account Help: Create a replacement Google Account
• Google Account Help: Recover a recently deleted Google Account
• Microsoft Security Blog: Pushing passkeys forward (May 2025)
• Microsoft Security Blog: World Passkey Day 2026
• Microsoft Support: Microsoft to stop sending SMS codes for personal accounts
• Microsoft Learn: Passkeys by default and SMS and voice retirement in Entra ID
• Microsoft Support: Recover a hacked or compromised Microsoft account
• Microsoft Support: Help with the account recovery form
• Microsoft Support: Protect yourself from tech support scams
• Microsoft Support: Reopen your Microsoft account
• Meta: Introducing passkeys on Facebook (updated September 2025)
• Meta: Testing facial recognition for account recovery (with 2025 updates)
• Meta Help Center: If your account was hacked or someone is using it without your permission
• SecurityWeek: Meta says 20,000 Instagram accounts hacked via AI tool abuse
• Apple Support: Set up a recovery contact
• Apple Support: Set up a recovery key
• Apple Support: How to use account recovery
• Apple Support: Recognize and avoid phishing
• FTC: How to recover your hacked email or social media account
• FTC: What to know about identity theft
• FTC: Refund and recovery scams
• FIDO Alliance: Passkeys