Hacked on TikTok

Your TikTok was taken. Here's the next hour.

TikTok recovery runs mostly in-app. The clean device matters more than anywhere else.

Does this look familiar

  • Logged out with "incorrect password" and reset emails aren't arriving
  • Email or phone on the account changed
  • Videos posted or deleted that you didn't touch
  • Followers reporting scam DMs from you
  • A "partnership" or "copyright" message with a link arrived recently

Do these, in order

  1. Email and carrier first

    Before touching TikTok: from a clean device, change your email password, enable app-based two-factor, sign out of all sessions, and check recovery options. Call your carrier for an account PIN and port-freeze. Full first hour.

  2. Try the reset first: Log in → Forgot password → by phone or email, from a clean device. If the attacker changed both, go to the Help Center hacked-account article and use the in-app report flow; it asks for details only the owner knows.

  3. Once in: Settings and privacy → Security and permissions → Manage devices. Remove everything you don't recognize. Then Manage app permissions and revoke third-party apps.

  4. Turn on two-step verification with an authenticator app, not SMS. Check that the email and phone on the account are yours.

  5. If you run a TikTok Business Center or Shop, check its members and remove unknown ones. Payouts and ads are the attacker's target.

  6. Message your audience, once you're back, from the account: "If you got a DM from me about a giveaway or investment, it wasn't me."

Avoid

  • Third-party "TikTok recovery" services, apps or Telegram contacts.
  • Logging back in from the compromised device until it's been checked.
  • Clicking any "verify your account" link in a message. Verification happens only inside the app settings.

After you're back in

Make sure it can't happen the same way twice.

  • Figure out how they got in. The fix depends on the door they used, and there's usually more than one.
  • Close that door specifically, then the ones next to it.
  • Assume the same people will try again. They usually do.
  • Check your passwords and email against known breaches with a free account, and run the exposure scorecard. Or let us do the whole thing.