Get Started
Parent Help Playbooks

What to Do If Your Child’s Online Account Is Hacked

A step-by-step parent recovery Playbook for a hacked child account, covering account recovery, device security, evidence, contact warnings, platform support, and prevention.

July 30, 2026 Reviewed July 29, 2026 TheOneSpy Digital Safety Lab Editorial Team, Digital parenting and online-safety editorial review
What to Do If Your Child's Online Account Is Hacked parent safety illustration
Parent action summary

Secure the email and device first, use the platform's official recovery route, remove unknown sessions, enable stronger sign-in protection, and warn contacts about messages the attacker may have sent.

Printable parent resources

Download and use these tools offline

Use the action sheet during the incident and the family worksheet for the follow-up conversation. Nothing you write is uploaded to TheOneSpy.

Printable parent action sheetOpen or save the printable file Family safety worksheetOpen or save the printable file

Is anyone in immediate danger?

If the account is being used for threats, fraud, sexual exploitation, stalking, or exposure of the child's home or school, preserve the evidence and contact the appropriate authority urgently.

Step 1

Assess the situation

Look for changed passwords, recovery details, usernames, posts, friends, messages, purchases, or login alerts. A compromised email account may also expose password resets for other services.

Is the attacker using the account to threaten someone, expose location, or distribute sexual material?
Emergency — immediate action required

Preserve the relevant evidence and contact local emergency services or the appropriate authority. Do not continue interacting as the child.

Has the recovery email, phone number, password, or two-factor method been changed?
Urgent — respond now

Secure the child’s email account first, then use the platform’s official recovery process immediately.

Were purchases, subscriptions, virtual-item transfers, or payment changes made?
Urgent — respond now

Record the charges and payment descriptors, contact the platform or payment provider, and secure payment methods.

Were messages, posts, friend requests, or links sent from the account?
Concerning — take prompt action

Warn contacts not to click, pay, share codes, or respond to unusual requests from the compromised account.

Was there only an unrecognized login attempt that the platform blocked?
Lower concern — monitor and guide

Change the password, remove unknown devices, enable a passkey or two-factor authentication, and review recovery information.

Step 2

What to do in the first 15 minutes

1

Keep the child calm and involved

Explain that hacked accounts often result from stolen credentials, phishing, reused passwords, malicious extensions, or device compromise; the priority is recovery, not blame.

2

Secure the email account first

Change the email password from a trusted device, sign out other sessions, review forwarding rules and recovery details, and enable two-factor authentication.

3

Use only official recovery pages

Open the platform directly or use its verified support site. Do not pay people claiming they can recover the account.

4

Remove unknown access

Review active sessions, trusted devices, connected apps, browser extensions, passkeys, and two-factor methods.

5

Record account changes

Save login alerts, changed profile details, unauthorized posts, messages, purchases, and support reference numbers.

6

Warn contacts

Tell friends and family not to click links, send money, share codes, or trust unusual messages from the account.

7

Check connected accounts and payment methods

Change reused passwords, secure gaming or social accounts linked to the same email, and review stored cards and subscriptions.

Do not do this

  • Do not click recovery links sent by unknown people or alleged support agents.
  • Do not share passwords, one-time codes, recovery codes, or My Eyes Only passcodes.
  • Do not pay an unofficial account-recovery service.
  • Do not wipe the device before preserving useful alerts and account details unless a qualified professional directs you.
  • Do not reuse the replacement password on another account.
  • Do not post sensitive recovery information publicly.
  • Do not assume recovery is complete until sessions, apps, recovery details, and payments are reviewed.
Step 3

Talk to your child without shutting down communication

Suggested opening
“You are not in trouble. We are going to secure the email, recover the account through the official service, and check what changed together.”
Reassure the child:

“A hacked account can happen even when someone is usually careful. What matters now is telling me everything you noticed so we can protect your other accounts too.”

Questions to ask

  • What happened just before you lost access or received the alert?
  • Did anyone ask for a login code, password, QR scan, download, or email change?
  • Did you install a game, extension, mod, or file recently?
  • Which email and phone number were connected to the account?
  • Were any purchases, messages, posts, or friend changes made?
  • Do you use the same password anywhere else?
  • Did the person contact you on another platform?
  • Is any private content or location information stored in the account?

Phrases and reactions to avoid

  • “Why were you so careless?”
  • “You are losing your device forever.”
  • “I told you this would happen.”
  • “Do not tell anyone else.”
  • “I will handle this by messaging them myself.”
Step 4

Preserve useful evidence safely

Keep records locally and submit them only through appropriate official channels. Do not upload a child’s private conversations, intimate images, or identifying evidence to TheOneSpy.

  • Login-alert emails or texts and their dates
  • Original username, user ID, profile URL, and connected email
  • Screenshots of changed profile details, posts, messages, or friends
  • Unknown device, session, IP, or location information shown by the platform
  • Email notices about password, phone, email, passkey, or two-factor changes
  • Unauthorized purchases or subscription receipts
  • Support tickets and reference numbers
  • A list of other accounts that reused the same password
Step 5

Block, report, and secure the account

SnapchatRecover and secure a compromised Snapchat account

Array

Official reporting page Official safety help
Steps last checked: July 30, 2026
TikTokSecure a hacked TikTok account

Array

Official reporting page Official safety help
Steps last checked: July 30, 2026
DiscordRecover a compromised Discord account

Array

Official reporting page Official safety help
Steps last checked: July 30, 2026
RobloxRecover and protect a hacked Roblox account

Array

Official reporting page Official safety help
Steps last checked: July 30, 2026
Step 6

Report and escalate at the right level

SituationPlatformSchoolAuthority / specialistUrgent when
Blocked login attempt; no account changesSecure the account and review sessions.Usually not applicable.Usually not required.Escalate if additional attempts, extortion, or account changes occur.
Account access lost or recovery details changedUse official account recovery and preserve notices.Notify school IT if a school account or classmates are affected.Contact the appropriate cybercrime or law-enforcement channel if fraud, stalking, threats, or exploitation occurs.Urgent when the attacker controls email, payments, location data, or private content.
Account used for threats, scams, or sexual exploitationReport the account and specific content immediately.Coordinate with school safeguarding staff when students or school systems are involved.Contact emergency services or specialist authorities for credible danger or child exploitation.Immediate action when there is physical danger, sexual material, blackmail, or exposed location.

Working with the school

If a school email, managed device, classroom account, or student group is involved, contact the school's designated IT or safeguarding lead. Provide a concise timeline, account identifiers, and support-ticket references without circulating private messages more widely than necessary.

Country and reporting note

Cybercrime, identity-theft, and child-protection reporting routes vary. Use official local services. If financial accounts are affected, contact the payment provider or financial institution promptly. For immediate danger, use local emergency services.

Step 7

Support recovery and prevent recurrence

Next 24 hours

  1. Secure the email and highest-value connected accounts.
  2. Complete official recovery steps and remove unknown sessions.
  3. Warn contacts about suspicious messages or money requests.
  4. Review payment activity and connected applications.
  5. Tell the child what has been recovered and what remains uncertain.

Next seven days

  1. Check for new login alerts and password-reset attempts.
  2. Review whether private posts, messages, or files were copied or shared.
  3. Replace reused passwords with unique passphrases.
  4. Confirm that contact and recovery information remains correct.
  5. Follow up on platform, payment, school, or authority reports.

Next 30 days

  1. Review account security settings together.
  2. Audit unused accounts and connected apps.
  3. Update the family rule for codes, links, downloads, and support impersonation.
  4. Consider a password manager and phishing-resistant sign-in methods.
  5. Document the recovery steps for future incidents.

Warning signs requiring closer attention

  • Attacker controls the child’s email or phone number
  • Unauthorized payments, virtual-item transfers, or subscriptions
  • Threats, blackmail, sexual content, stalking, or impersonation
  • Unknown data export or download request
  • Repeated login attempts after password changes
  • Child is afraid to explain how access was lost

Prevention checklist

  • Use a unique password for every important account.
  • Enable a passkey or two-factor authentication where available.
  • Keep email recovery details current and private.
  • Review active devices and connected apps regularly.
  • Teach that support staff do not need passwords or one-time codes.
  • Avoid unofficial mods, cracked software, browser extensions, and “free currency” links.
  • Keep devices and security software updated.
  • Store recovery codes securely with a parent or guardian.

When professional help may be needed

Seek urgent help when a compromised account is used for credible threats, child exploitation, stalking, exposed location, or significant fraud. Seek technical or platform support when recovery details have been changed or the account remains inaccessible.

Look for changed passwords, recovery details, usernames, posts, friends, messages, purchases, or login alerts. A compromised email account may also expose password resets for other services.

What this situation may involve

Look for changed passwords, recovery details, usernames, posts, friends, messages, purchases, or login alerts. A compromised email account may also expose password resets for other services.

Core response principles

  • Keep the child communicating and avoid automatic blame.
  • Check immediate physical, emotional, account, and financial safety.
  • Preserve the minimum useful evidence without spreading sensitive material.
  • Use official platform, school, payment, and authority channels.
  • Apply proportionate temporary restrictions with a review date.
  • Escalate credible danger, exploitation, stalking, or fraud promptly.

Protect privacy while seeking help

Do not upload a child’s private conversations, intimate images, account credentials, home address, school details, payment information, or identifying evidence to TheOneSpy. Keep information locally and submit it only through appropriate official channels.

Frequently asked questions

Should I take the device away immediately?

Secure the account or situation first. A short supervised pause may be useful, but indefinite punishment can reduce future disclosure. Explain what is temporary, why it is needed, and when the family will review it.

Should I contact the other person directly?

Usually not during the first response. Direct confrontation can increase pressure, trigger retaliation, or destroy evidence. Use official platform, school, payment-provider, or authority channels that match the situation.

How much evidence should I save?

Preserve the minimum information needed to explain what happened: identifiers, dates, links, relevant messages, receipts, and report numbers. Do not create unnecessary copies of intimate, illegal, or highly sensitive material.

How should I talk to my child afterward?

Use brief, non-judgmental check-ins. Tell the child what actions were taken, what remains uncertain, and when the family will review the plan. Recovery includes rebuilding normal routines and age-appropriate independence.

Editorial scope

This Playbook provides general educational guidance for parents and guardians. It cannot determine intent, guarantee refunds or account recovery, diagnose risk, or replace emergency services, law enforcement, child-protection professionals, legal advice, financial advice, medical care, or mental-health care. Platform interfaces and policies change; verify the official links before acting.

Sources and references

  1. How To Recover Your Hacked Email or Social Media Account Federal Trade Commission
  2. My account is compromised Snapchat Support
  3. My account has been hacked TikTok Support
  4. My Discord Account was Hacked or Compromised Discord Support
  5. My account was hacked - What do I do? Roblox Support
Explore: Account SecurityDigital ParentingMessaging AppsOnline PrivacySocial Media SafetyConversation HelpDevice SetupIncident ResponsePreventionPrivacyAges 13–15Ages 16–17Ages 6–8Ages 9–12
Continue reading

Related Digital Safety Lab resources