Last materially reviewed: September 3, 2026
Direct Answer
Your phone or online account may have been hacked if you see logins you do not recognize, password-reset messages you did not request, unfamiliar devices, changed recovery details, outgoing messages you did not send, unauthorized transactions, new apps or profiles, or security settings you did not change.
One warning sign alone does not always prove a hack. The strongest evidence is usually a combination of unauthorized activity plus account or device changes that you cannot explain.
Primary guidance: Cybercrime Investigation and Coordinating Center and NBI Cybercrime Division guidance.
Key Takeaways
- Unknown logins, changed passwords, recovery-email changes, and unauthorized transactions are high-priority warning signs.
- Secure the email account first because it often controls password resets for everything else.
- Use a clean or trusted device if you suspect malware on your phone.
- Sign out unknown sessions and revoke access for unfamiliar apps.
- Preserve screenshots and security alerts before deleting them.
- Report financial loss, identity theft, or serious account takeover to the provider and cybercrime authorities.
Jump to a Section
- Signs your account was hacked
- Signs your phone was compromised
- What to do immediately
- If financial accounts are involved
- When to report cybercrime
Signs Your Online Account May Have Been Hacked
- Login alerts from a city, country, browser, or device you do not recognize.
- Password-reset or verification messages you did not request.
- Your password suddenly stops working.
- Your recovery email address or phone number has changed.
- Messages, posts, ads, or friend requests were sent from your account without you.
- New forwarding rules appear in your email.
- Unknown apps have access to your Google, Apple, Microsoft, Facebook, or other account.
- Your account is used to ask friends for money or send scam links.
Signs Your Phone May Be Compromised
- Unfamiliar apps, browser extensions, configuration profiles, or device-admin permissions appear.
- Battery usage or mobile-data use spikes without explanation.
- The microphone, camera, or location indicator activates unexpectedly.
- Security settings have been changed.
- Your device repeatedly redirects to suspicious websites or shows intrusive pop-ups.
- Banking or social accounts show unauthorized logins after using the phone.
Performance issues alone do not prove hacking. Old batteries, full storage, software bugs, and background apps can create similar symptoms.
Decision Snapshot
| Signal | Risk level |
|---|---|
| Unknown login alert | High — review sessions immediately |
| Password reset you did not request | Medium to high — attacker may be trying account recovery |
| Recovery details changed | Critical — secure the account now |
| Unauthorized bank transaction | Critical — contact financial provider immediately |
| Battery drain only | Low by itself — investigate other causes too |
| Unknown app with broad permissions | High — remove and investigate |
What to Do If You Think You Were Hacked
- Secure your email first. Change the password, review recovery details, and enable multi-factor authentication.
- Change compromised passwords. Use unique passwords, especially for banking, social media, cloud storage, and work accounts.
- Sign out other sessions. Remove devices and browsers you do not recognize.
- Revoke third-party access. Remove suspicious connected apps and OAuth permissions.
- Check forwarding rules. Attackers sometimes silently forward email to themselves.
- Review the device. Remove unfamiliar apps, update the operating system, and run reputable security scans where appropriate.
- Preserve evidence. Save alerts, timestamps, IP information, messages, and transaction details.
If the incident started with a suspicious link, see What to Do If You Clicked a Phishing Link.
What If a Bank or E-Wallet Account Was Hacked?
Contact the financial provider immediately using the official app, website, or verified phone number. Ask it to secure the account, review unauthorized transactions, block cards or devices where necessary, and record the incident. Save case numbers and transaction references.
Do not rely only on changing your password if an attacker has already enrolled a new device, obtained an OTP, changed recovery settings, or gained access to your email.
When Should You Report the Incident?
Report when there is financial loss, identity theft, repeated unauthorized access, extortion, malicious impersonation, serious privacy exposure, or other evidence of a cybercrime. The CICC can be reached through hotline 1326, while the PNP Anti-Cybercrime Group and NBI Cybercrime Division handle cybercrime investigations.
See Where and How to Report Cybercrime in the Philippines.
Frequently Asked Questions
How can I see where my account is logged in?
Most major services have a security or devices page showing active sessions, recent logins, and connected devices. Review it directly through the official app or website.
Does changing my password kick hackers out?
Sometimes, but not always. Also sign out other sessions, remove unknown devices, check recovery settings, revoke connected apps, and review MFA methods.
Should I reset my phone?
A reset may be appropriate if malware or unauthorized device-management software cannot be removed confidently. Back up important legitimate data first and avoid restoring suspicious apps or profiles.