Account Lockdown Guide

How to Get a Hacker Out of Your Account

Last updated: October 2026

It's one of the most-asked questions on Google's own results page — because changing the password so often doesn't work. The hacker isn't guessing your password. He's already inside, usually through your own device. Here's how to actually throw him out, in the order that works.

Why he's still in after you changed the password

The most common reason a "recovered" account gets stolen again: the original infection never left. Cookie stealers and malicious browser extensions copy your logged-in session, so the attacker doesn't need your new password — they're already inside, as you. That's also why some hacks survive password resets completely. The eviction has to start with the device, not the account settings.

Step 1: Clean the device (do not skip this)

1. Run a full malware/virus scan — not a quick scan — and let it finish.
2. Remove browser extensions you don't recognize, especially anything promising free currency, cheats, or "enhancements."
3. Until the scan is clean, don't log into the account from that device. If you can, do the lockdown steps below from a different, trusted device.

Step 2: Change the password from the clean device

Set a strong password you've never used anywhere else. If the hacker changed your password and you can't log in at all, you're not at the lockdown stage yet — you need the recovery path first (the platform guides linked below walk it). Lockdown is for the moment you have access again, whether that's right now or the day support hands the account back.

Step 3: Kill every other session

• Roblox: Settings → Security → "Sign Out of All Other Sessions." This is the single most important click — it ends the hacker's active sessions everywhere.
• Discord: Settings → Devices → "Log out of all known devices," and check Authorized Apps for anything you don't recognize.
• X: a password change does not automatically sign out mobile apps — revoke app access and sessions separately in Settings → Security and account access → Apps and sessions.
• Steam: deauthorize all devices from the Mobile Authenticator management page, and revoke the Steam API key (it should be empty).

Step 4: Lock the doors behind him

1. Turn on two-step verification (2SV/2FA) on the account, and store the backup codes somewhere safe and offline.
2. Roblox: set an Account PIN. The PIN locks account settings, so even someone who gets in can't change your email or security settings without it.
3. Verify the email and phone on the account are yours. A recovery email the hacker controls means every future reset goes to him. If the email isn't yours, change it now — this is the step people forget, and it's how round two starts.
4. Change the password on that email account too, and turn on its two-step verification. The email is the master key to everything.
5. Check linked accounts and connected apps. Remove anything you don't recognize.

Step 5: Sweep for damage

Walk the account like a room someone broke into: inventory and balances (Roblox items and Robux — remember the 30-day reporting window for any restoration), friends lists, messages sent in your name, purchases you didn't make, and settings changed while the hacker was in control. On other platforms, check for trades, linked accounts added, or apps authorized. Document anything missing with screenshots and dates — if you end up in a support ticket, that's your evidence.

Questions people actually ask

How do I get a hacker out of my Roblox account?

Scan your device for malware, then in Roblox go to Settings → Security and use "Sign Out of All Other Sessions." Change your password, enable 2-Step Verification, set an Account PIN, and make sure the email on the account is yours. The session sign-out is what actually removes him; the rest keeps him out.

I changed my password but the hacker is still in my account. Why?

Usually because the theft lives on your device — malware or a stolen session cookie means he doesn't need your password. Run a full scan, remove suspicious extensions, and sign out all sessions. If the device stays infected, the account won't stay yours.

He's in my account right now and changing things. What first?

If you still have access: sign out all sessions and change the password immediately — those two moves cut his access fastest. Then run the device scan and finish the lockdown. If you're fully locked out, skip to the recovery guides below; lockdown comes after recovery.

Will signing out of all sessions log me out too?

Yes — that's the point. You'll log back in fresh with your new password, and you'll be the only one inside.