Suspicious logins, locked accounts, and odd device behaviour often mean someone else has access, or malware is running in the background. Cyber criminals prefer to stay invisible so they can return later.
This page helps you answer a practical question: have I been hacked? It covers common warning signs, what to do in the first hour, and when a digital investigation is warranted. It is not a full prevention encyclopedia. For ongoing habits, see how to protect yourself from scammers, hackers, and thieves. For scoped professional work, see digital investigations.
Common signs you may have been hacked
Identity and financial account misuse
Unexpected charges, new credit cards, loan inquiries you did not open, or tax notices can point to stolen identity details. Treat any financial account you did not authorize as urgent. Related reading: identity theft in Canada.
Passwords that suddenly stop working
If email, banking, cloud, or social logins fail after you were sure of the password, someone may have changed credentials or locked you out. Reset from a device and network you trust, then turn on multi-factor authentication.
Software you did not install
New browser extensions, remote-access tools, or unknown apps are a classic compromise signal. Do not ignore a program you do not remember installing, especially one that asks for camera, mic, or full-disk access.
Emails or messages sent that you did not write
Friends reporting weird messages from you, or an outbox full of mail you did not send, usually means the account was taken over or a device is infected.
Browser history and settings you did not choose
Homepage changes, new toolbars, redirecting searches, or history entries you did not visit can indicate adware, malware, or remote control.
Sudden slowdowns or loss of control
A sharp drop in speed, fans running hard at idle, programs that will not open, or a machine that restarts itself can be malware or cryptomining, not just old hardware.
Login alerts from strange places or devices
Provider alerts for new locations, unknown phones, or impossible travel times are high-confidence signals. Review active sessions and revoke anything you do not recognize.
What to do in the first hour
- Disconnect the suspect device from Wi-Fi if you fear active remote access.
- From a clean phone or computer, change the email password that recovers all other accounts.
- Reset banking and primary social passwords. Enable app-based multi-factor authentication where available.
- Revoke unknown sessions, apps, and sign-in-with-Google/Apple permissions.
- Call your bank or card issuer if money moved or cards were used.
- Screenshot emails, SMS alerts, URLs, and wallet addresses before chats disappear.
- In Canada, report fraud to the Canadian Anti-Fraud Centre when money or identity theft is involved, and to police when warranted.
Do not pay a cold caller who claims they can unlock your computer for a gift-card fee. That is often a second-wave scam.
Hacked account versus infected device versus social engineering
- Account takeover: someone has your password or session. Password reset and session revoke often stop it.
- Malware on a device: the machine itself is compromised. Cleaning or rebuilding the device, then resetting passwords from a clean device, is required.
- Social engineering: you approved a login, code, or transfer under pressure. There may be no malware at all. See online fraud and money scams.
Naming the problem correctly decides the next step. Treating every scare as malware wastes time when the real issue is a reused password or a convincing caller.
When a digital investigation helps
Many incidents close with password resets, bank freezes, and antivirus cleanup. Consider professional help when:
- Money left the account and you need a dated evidence trail for counsel, insurers, or police.
- Someone is impersonating you across platforms or opening accounts in your name.
- A business mailbox, payroll, or vendor account was used in a compromise.
- You need court-usable documentation rather than screenshots alone.
That work sits under digital investigation services. It is different from recovery operators who demand more fees to unlock funds.
FAQ: have I been hacked?
Is antivirus enough to know for sure?
No. Antivirus helps with some malware. It will not stop you from approving a fake payment or sharing a one-time code with a convincing caller.
Can public Wi-Fi alone mean I was hacked?
Not always, but it raises risk. Avoid banking on open networks, or use a trusted VPN, and watch for new login alerts afterward.
Should I wipe my phone immediately?
If you still need evidence for a bank or police file, capture screenshots and account alerts first. Then reset after you have secured the recovery email from another device.
How is this different from your protection guide?
That page focuses on habits that reduce risk. This page focuses on recognizing compromise and the first response steps.
Need help after a suspected hack in Ontario?
Investigation Hotline supports individuals and businesses across Toronto and Ontario with digital evidence and fraud-related inquiries when documentation and next steps are unclear. Call (416) 205-9114 or use the contact page for a confidential discussion.
To learn more, contact Investigation Hotline at
