Three envelopes showed up in my mailbox on the same day — one from Equifax, one from Experian, one from TransUnion, each confirming a credit freeze I'd just requested. None of it had anything to do with my actual credit report. It started because someone else had logged into my social media account and locked me out of my own name.
I'm not a cybersecurity professional, just an HR manager in the Charlotte suburbs who's spent years cleaning up family fraud messes. (Quick disclosure: this site runs on affiliate links, so I earn a small commission if you sign up for a service through one of mine, at no cost to you, I only mention the ones I've actually paid for myself.) What follows isn't another click-through checklist. It's the handful of myths about social media security, account recovery, and identity theft prevention that get people hurt worse, because they assume the danger ends the moment they're logged back in.
The Myth About Changing Your Password
The first thing everyone tells you to do after a takeover is change your password. That's good advice, but it's not the fix people think it is — not if the account still routes its recovery through an email address the attacker already controls. A session hijack doesn't need your password at all; it steals the small authentication token your browser uses to stay logged in, the digital equivalent of a spare key left under the mat. That's the technical term for what happened to me — session hijacking — and it explained why a brand new, complicated password did nothing to lock the account back down.
What actually matters is the recovery email attached to the account. If an attacker still holds that inbox, resetting your social media password barely slows them down, because they can reset it right back within hours. I've written before about steps to take when your email is hacked and linked to bank accounts, and the overlap isn't a coincidence: your email is the root credential for nearly everything else, including the very account you're trying to save.
Is It Really "Just Social Media"?
People say this to me a lot, usually right after I bring up freezing credit over a hijacked Instagram or Facebook account. Sometimes it really is just an annoyance — spam links posted under your name until you reset a password. But it stops being "just social media" the second that account is tied to a payment method, a shared email, or a phone number you also use for two-factor codes elsewhere. Phone number hijacking is the meaner cousin of this same attack: swap the SIM, and a stranger can catch every recovery code you'll ever receive, no password needed at all.
My own case tipped from annoying to serious the moment I realized the account had a saved payment method attached to it, from a shop feature I'd forgotten even existed. The attacker used it before I noticed. What followed was a card dispute filed online, and having to re-upload the same transaction documentation three separate times before the bank finally accepted it — not because the fraud was in question, but because their portal kept losing the attachment. That was the moment "just social media" stopped being a real category for me.
There's No Customer Service Line to Call
This is the myth that costs people the most time. You will not find a phone number. I spent real hours hunting for one, refreshing help-center pages that circled back to the same automated form, before accepting that these platforms run recovery through algorithms and identity checks, not humans on a headset. The path back in usually runs through a liveness check — holding your phone up, turning your head in a slow circle, sometimes holding a photo ID next to your face in decent lighting. It feels invasive. It is invasive. It is also, for most people, the only door back into the house.
Alongside that, file a report at IdentityTheft.gov — it takes the FTC's own forms and turns them into a real recovery plan you can hand to a bank, a lender, or a bureau that wants proof you didn't open an account yourself. I keep the confirmation page from mine in the binder of fraud paperwork on the bookshelf in my home office, filed a few tabs over from the folder on my dad's scam.
Freeze Your Credit Even If It Feels Like Overkill
A frozen social media account doesn't automatically mean a compromised credit file, but the two live close enough together that I stopped treating them as separate problems. If someone has enough personal information to talk their way into your account, assume they have enough to try opening a line of credit somewhere else. A freeze blocks new accounts from being opened in your name at all three bureaus; a fraud alert just asks lenders to double-check before approving anything — useful, but a much lower bar than a freeze, and not a substitute for one.
Mine came back within days — three separate confirmation letters, one from each bureau, which is how I knew it had actually gone through instead of sitting in some queue. The freeze worked well enough that my own card got declined at the register at Harris Teeter on Rea Road a few days later — not fraud, just the freeze doing its job a little too well, and a reminder that lifting it temporarily is part of the process too.
A VPN Would Not Have Stopped This
Somebody always asks whether a VPN would have prevented any of this, and I understand the instinct — VPN, firewall, antivirus, they all sound like the same category of protection. A VPN encrypts the connection between your device and the internet; it hides your traffic from your Wi-Fi network or your internet provider. It does nothing to protect a session token already sitting in your browser, and it does nothing if the compromise happened through a phishing link you clicked yourself. I still run one, mostly for public Wi-Fi, but I stopped expecting it to guard my accounts a long time ago.
Rebuilding Access After the Lockout
Multi-factor authentication is supposed to be the thing that saves you, and most of the time it does — but only if the attacker doesn't also control the second factor. Codes sent by text carry the same weakness as the phone hijacking I mentioned earlier; codes generated inside an authenticator app hold up much better, since they don't depend on a phone carrier at all. The same skepticism applies to phone calls now, not just accounts — if someone calls claiming to be a bank, a bureau, or even a relative in distress, I've started hanging up and calling the number back myself, since voice cloning has made "it sounded just like them" a lot less reliable than it used to be.
A coworker of mine, Deon Corbett, was the one who actually found the IdentityTheft.gov checklist before I'd ever heard of it — he forwarded it from his desk one afternoon like it was nothing, and it turned out to be the most useful link anyone sent me all year.
Building Cyber Hygiene Habits That Actually Stick
None of this makes me a security expert. In my house, cyber hygiene mostly means a short list of boring habits repeated until they're automatic — unique passwords, an authenticator app instead of text codes, a credit freeze that stays on except for the one day a year I need it lifted, and the same instinct that makes me check a card reader for a skimmer before I swipe at the pump now applied to login links that show up in a text. It also means being honest about what a paid monitoring service actually promises: monitoring tells you something happened, restoration help walks you through fixing it, and insurance reimburses specific losses — three separate promises that get sold as one bundle. If you're trying to decide between two of the bigger names, I've spent time comparing McAfee vs LifeLock for monitoring family identity security, and the short version is that both cover the basics — the differences show up in reimbursement limits and how much cleanup work they'll do for you.
I moved my whole household over to Norton 360 with LifeLock after my year of cleanup, mainly because it bundles identity monitoring with the antivirus and VPN I was already paying for separately — and its dark web monitoring at least gives me somewhere to check instead of guessing whether my information, or my parents', is circulating somewhere it shouldn't be.
For a lighter option, McAfee+ Identity Protection covers the same basics and adds a personal data cleanup feature that requests your information be pulled off the broker sites nobody remembers signing up for. A stolen Social Security number is a heavier problem than a hijacked profile, and no monitoring subscription fixes that on its own — but knowing which kind of exposure you're actually dealing with is most of the battle.
And if you end up as the household's designated fraud fixer too, keep a neighbor's number handy: mine, Bettye Carnes, knocked on my door needing help not long ago, and left with nothing more high-tech than a handwritten list of the three bureau freeze phone numbers. Sometimes that's the whole toolkit.
If you're in the middle of this right now, the order of operations matters more than speed: lock down the recovery email first, then the account, then the credit freeze, then the FTC report, then breathe. Skip ahead and the account just changes hands again a few hours later, because the inbox is still compromised.