This morning, someone accessed my Instagram account, sent scam messages to everyone I follow, and posted scam content on my story and profile. I also noticed suspicious access involving several other accounts I had used on my computer. I've changed my passwords, deactivated my debit card, and performed a factory reset with the most thorough erase option available. I'm pretty shaken up—what else should I do, and how can I check whether malware may still be stealing my information?
4 Answers
If you think the computer was involved, disconnect it from the internet and stop using it for password changes. A factory reset may be sufficient in many cases, but the safest approach is to erase the drive and install a fresh copy of the operating system from official installation media. Then fully update it, enable built-in security protections, and avoid pirated software or untrusted downloads. Run a reputable malware scan afterward, but remember that a scan cannot prove the old installation was clean.
Take a breath and secure everything from a trusted device, such as your phone. Change every important password to a unique, long passphrase, and enable two-factor authentication—preferably with an authenticator app or security key. A password manager can help you avoid reusing passwords. Also check your email accounts for unfamiliar forwarding rules, recovery addresses, logged-in sessions, and connected apps, since attackers sometimes use email access to regain control.
Contact your bank and request a replacement card rather than relying only on deactivation, especially if the card details were saved in a browser or account. Review recent transactions, freeze or replace other affected payment methods, and watch your accounts for unauthorized activity. Don’t enter new financial information on the computer until it has been cleanly reinstalled.
Review the security pages for every account: sign out unknown sessions, remove unfamiliar devices and third-party apps, check recovery email addresses and phone numbers, and revoke active login tokens. Also warn your contacts that the Instagram posts and messages were scams. Be cautious of anyone offering private help or asking for remote access, personal information, payment, or software installation.
I had two-factor authentication enabled on some accounts, including Google, but not on Instagram and several others. I’ll review the email settings and recovery options too.