If your TikTok account has been hacked but you can still log in, change the password at once, link your own phone number and remove any device you do not recognise. Those are the three steps on TikTok's hacked account help page, and a password change signs everyone else out. If the attacker has locked you out, start from Forgot password? on the login screen and choose Recover account, or use TikTok's Report a problem form under Account access / security, then Hacked account. Once you are back in, check where your LIVE, rewards and Shop money is set to land.
This guide covers getting back in after someone else has used your account, and closing the doors they used. If TikTok banned the account rather than someone taking it over, our TikTok ban appeal guide is the right starting point. Instagram works differently and has its own Instagram account recovery checklist. If the problem is a separate account copying you, read our guide to reporting a TikTok impersonation account.
Signs of a takeover rather than a ban or a glitch
TikTok's hacked account page lists four warning signs. Any one of them is enough to act on:
- Your password or phone number has been changed.
- Your username or nickname is different from the one you set.
- Videos have disappeared, or new ones were posted without you.
- Messages you never wrote were sent from your account.
The Creator Academy account security tips add an earlier signal: the Security alerts tab in your account settings, plus email, SMS or push alerts, flag unusual activity such as a password change or a new device signing in. TikTok's account safety page also says it emails you when it finds your password in lists stolen from other services. That email is not proof of a takeover, but it is a reason to change the password today.
A ban looks different. TikTok's bans page says a banned account sees a banner when it tries to log in. And when TikTok itself detects suspicious activity, its privacy and security rules say it may ask you to confirm ownership by SMS or email code, a CAPTCHA or a login from a verified device. Complete those prompts; they are part of the protection, not a sign that you have been locked out for good.
Recovery decision table: what changed and which route to use
The right route depends on which login details the attacker replaced. Find the row closest to your situation.
| What the attacker changed | Recovery path | What TikTok may ask for |
|---|---|---|
| Only the password, while your email and phone still work | Forgot password? on the login screen, then reset by phone or email | The code sent to your phone or inbox |
| The reset fails with an unrecognised device error | Reset from a phone or computer you have used to log in before, or choose Recover account | Account details such as your registered email, phone number or earlier passwords |
| Both the email address and the phone number were swapped | Recover account, then Can't access these? and Ask friends to verify | At least two TikTok friends approving the request within a limited time, per the account safety page |
| An authenticator app was added, or you no longer have yours | Can't access the app, then your recovery code; without it, Need more help? | Identity details; the account safety page says this reset may take up to 30 days |
| The account signs in through Google, Apple or another platform | Reset the password with that provider first, then secure that account too | Whatever the provider's own recovery requires |
| Username or display name changed while you are still logged in | Change them back in Edit profile | Nothing, but usernames change once every 30 days and names once every 7 days |
| Posts or messages appeared that you never made | Secure the login first, then work through the clean-up section below | Screenshots for any later appeal |
| None of the in-app routes work | The web form: Account access / security, then Hacked account | Your username, a contact email, a description and up to 10 screenshots, per the web form |
The unrecognised device rule, the recovery request and the social login point come from TikTok's reset password page, which explains that the error appears when 2-step verification is on and you try to reset from a new device. Friend verification and the authenticator reset are on the account safety page. The username and name limits come from TikTok's pages on changing your username and changing your nickname; the username page also says a username that has been given up cannot be added to an account for a short period, so you may not be able to switch straight back; note your old handle in any support request.
What to have ready before you contact TikTok
The Login issue & account recovery branch of TikTok's web form asks for account details that prove ownership. Gather them before you open it:
- Your exact @username, plus any handle the attacker switched it from or to.
- Roughly when you signed up and in which country, since the form asks for a sign-up date and sign-up region.
- How you registered, whether by phone, email or a social login.
- The phone or computer you normally log in on.
- A contact email the attacker cannot read. Set up a fresh one if your usual inbox was also compromised.
- Screenshots of security alert emails, the changed details and anything the attacker posted.
- Any earlier passwords you remember, because the reset page says recovery may ask for them.
Enter these only in the app or on tiktok.com. TikTok's security tips say it will never ask for your password by email, and its guide to securing a TikTok Shop creator account adds that TikTok does not ask for passwords, card details or 2FA codes by DM, phone call or email. Anyone offering to recover your account for a fee is a second scam, not a shortcut.
Post-recovery lockdown checklist
Work through this as soon as you are back in, ideally on a device you trust. Every menu path below starts from Profile, then the menu button, then Settings and privacy.
- Set a new password you use nowhere else. TikTok says changing it logs the account out on every other device.
- Open Security & permissions, then Security checkup, and clear each task until it shows a green checkmark.
- Under Account, then Account Information, confirm the phone number and email are yours. TikTok's email and phone number page recommends keeping both, so one can rescue you if the other is lost.
- Turn on 2-step verification and pick at least two methods, as the account safety page asks. The Shop security guide suggests an authenticator app over SMS because it is harder to intercept.
- Add a passkey if your phone supports one, so there is no password to steal.
- Open Manage devices, delete anything you do not recognise, then change the password once more.
- Open Apps and services permissions and remove access for any app you did not connect yourself, as TikTok's third-party apps page describes.
- Read the Security alerts tab for anything that happened while you were locked out.
- Change the password on the email account linked to TikTok and turn on its own 2-step verification, because an attacker who still controls your inbox can reset TikTok again.
- Run Account check in TikTok Studio to see whether anything the attacker did has restricted posting, comments, profile edits or messages.
Re-securing LIVE gifts, rewards and TikTok Shop payouts
Takeovers of creator accounts are often about money. The TikTok Shop security guide, written for US creators, says intruders frequently try to swap the bank details on file for their own, and treats any change to payout settings you did not make as a warning sign. Check these before you go back to posting:
- Open the wallet where you manage your payment method and confirm the payout method and tax details are yours. TikTok's tax information page says that is also where tax forms are updated.
- Look through your withdrawal history for transfers you did not request.
- In TikTok Shop, audit the Payment and Withdrawal settings and look for a secondary payout method nobody told you about.
- Never pass on the code TikTok sends when a bank account is added or changed. The Shop guide says that code is what blocks an intruder, and that scammers posing as Financial Support ask for it.
- If a manager or agency helps run your Shop, give them access through User Management rather than your owner login, and revoke it when the work ends.
- Report any withdrawal you do not recognise through the in-app Help Center, which the Shop guide names as the official support route.
Our guide to withdrawing money from TikTok explains where each type of earning lands and how payout methods are set up, and our TikTok Shop commission guide covers when Shop commission settles.
Cleaning up what the attacker posted
Lock the login down before touching content, then deal with what was left behind:
- Screenshot every post, comment and message the attacker sent, with dates, before you change anything.
- If a post is actively harming people, such as a fake giveaway or a scam link, TikTok's post privacy settings let you switch it to Only you while you gather evidence. The bans page notes that deleting violative content does not remove the violation.
- Open Inbox, then System notifications, then Account updates, and appeal any removal tied to the takeover window, explaining that the account was compromised at the time.
- Post a short notice or Story saying the account was compromised, which dates it covers and that you never ask for money or logins by message.
- Contact brand partners and your manager directly through a channel you already trust if the attacker messaged them.
How takeovers of creator accounts usually start
The Shop security guide says most account takeovers do not involve breaking into TikTok at all. They rely on phishing: fake emails or messages that trick you into typing your password or a verification code into the wrong place. The lures TikTok's security tips name are worth knowing by sight:
- Sites promising free likes, fans, crowns or coins, which exist to collect logins.
- Links sent in private messages that lead somewhere other than they claim.
- Emails that dangle a verified badge as bait.
- Messages from a supposed TikTok Support agent or brand manager offering a large deal, a pattern our guide to fake brand deal scams covers in detail.
- Shared owner logins, which the Shop guide warns let a third party move payouts to their own bank.
The account safety page adds that passwords leak through reuse, breaches at other services, malware and insecure networks, which is why a unique password matters even when TikTok itself has not been breached.
Limitations of this guide
This guide draws on TikTok's Help Center, its Creator Academy security article, the US TikTok Shop creator security guide and TikTok's web report form as they read on 1 October 2026. Recovery screens vary with app version, region and how the account was first registered, and the Shop guidance is written for US accounts. Apart from the up to 30 days it gives for resetting an authentication method, TikTok does not publish how long recovery requests take, and no checklist can restore an account TikTok cannot verify as yours. If money has been taken or someone is threatening you, contact your bank and the police; in Australia the eSafety Commissioner points people to ReportCyber for online crime, and a qualified professional can advise if contracts or income are affected.