LinkedIn Account Hacked or Email Changed: What to Do Next

A LinkedIn account hacked by someone else rarely stays quiet. You open the app and find an email address you never added, a run of messages you never wrote, or a password that worked last week and fails today. The useful first move is not to try the password again but to establish one fact: can you still sign in? That answer decides which of LinkedIn’s two documented routes you take.

What follows is that route, taken from LinkedIn’s own help pages: shut the intruder out if you still have access, file the unauthorized-access report if you do not, satisfy the identity check LinkedIn asks for, then request cleanup of what was sent in your name.

LinkedIn account hacked or restricted? Tell them apart first

Two problems look similar from the outside and need opposite responses, so spend a minute on this before filing anything.

Signs of a compromise: an email address you didn’t add, messages you didn’t send, a password that stopped working

Any one of these is enough to act on:

• An email address or phone number on the account that you never put there, or your own address quietly removed
• Sent messages or InMails in your conversation list that you did not write
• Invitations going out to people you have never heard of
• Posts, comments or reactions in your activity that are not yours
• Your password stops working, and the reset email never arrives because resets now go somewhere else
• A live session from a device, browser or place you do not recognize

How a LinkedIn restriction differs, and why this page covers compromise only

A restriction is LinkedIn acting on your account; a compromise is someone else acting through it. When LinkedIn restricts an account it normally shows a notice explaining the limit and what it wants from you, and that notice is the instruction to follow. Filing an unauthorized-access report for a restriction sends your case down the wrong queue. Everything below assumes the first case. Worth separating too: a profile that has gone invisible may simply be paused rather than stolen, and LinkedIn’s hibernate setting hides a profile by design, with a sign-in 24 hours later to bring it back.

Emails that only claim your account was hacked

A message announcing that your account has been breached, with a convenient button to “secure” it, is often the attack itself. Do not use links in that email. Open LinkedIn directly, check the sessions and the addresses on your account, and judge from what you find. The same reasoning applies across platforms, and the anatomy of a genuine alert versus a copy of one is worth reading in the context of Microsoft’s unusual sign-in activity email, which attackers imitate as well.

If you can still sign in: lock the intruder out now

LinkedIn’s report a compromised account page lists five actions for this situation, and it also asks you to submit the Report Unauthorized Account Access or Changes form, with your profile URL, even though you still have access. Do the form last. Access is the thing you can lose in the next ten minutes, so spend those minutes here.

Change your password under Sign in & security

Pick something you do not use on any other service, and change it from a device you trust. If the intruder got in through a password you reused elsewhere, a variation of that password is not a fix, and neither is leaving the old one in place on the other services that share it. Change it there too, starting with anything that can reset the mailbox behind LinkedIn.

End other sessions in Where you’re signed in

LinkedIn’s where you’re signed in page lists every active session with its location, IP address, device type, browser and last sign-in time. You can sign out of a single session, or use the option at the top of the list to end every session except the one you are using. Either action asks for your password first, which is why the password change comes first.

Check every email address and phone number listed on the account

This is the step people skip, and it is the one that undoes the rest. If an address the intruder added is still sitting there, they can request a reset and walk straight back in. Remove anything you did not add, confirm your own address is still listed and still reachable, and do the same for phone numbers.

Turn on two-factor authentication with an authenticator app or SMS

LinkedIn’s two-factor authentication page puts the setting under Me > Settings & Privacy > Sign in & security > Two-factor authentication, and offers two methods: an authenticator app, or a phone number that receives a code by SMS. The app is the sturdier of the two, with one practical catch — the codes live on that handset. Plan how they move before you replace it, since Google Authenticator’s transfer steps are their own small job.

Secure the email inbox your LinkedIn account uses

LinkedIn lists this as a step for a reason: whoever controls that inbox controls password resets, so an account is only as protected as the mailbox behind it. Change that password too, then review the devices and sessions signed in to it. For a Google mailbox, work through the Your devices list and sign out everywhere; for Outlook.com or Hotmail, the recent-activity review described in the unusual sign-in activity guide covers the same ground. While you are there, look for forwarding rules and filters you did not create.

LinkedIn account hacked and email changed: when you can’t sign in

If the password no longer works and the reset goes to an address that is not yours, the self-service path is closed and LinkedIn’s report is the whole route.

Try Forgot password with every address and number you ever added

Before you file anything, try the reset once with each address and phone number ever attached to the profile — an old work address, a university one, a personal one you abandoned. The original address is sometimes still attached, and a reset that lands in a mailbox you still own puts you back in control in a single step.

Report a compromised LinkedIn account with the unauthorized-access form

When no address works, submit the Report Unauthorized Account Access or Changes form, linked from LinkedIn’s report a compromised account page. Include your profile URL if you can get hold of it; an old LinkedIn notification email or a search result will usually have it. Gather what you have before you start: the address that used to be on the account, roughly when access was lost, and anything the intruder did that you or your contacts noticed.

What LinkedIn does after it receives the form

LinkedIn’s wording is that once it receives the form it will verify the account is yours and then help you regain access. It publishes no turnaround time for that, so treat any figure you read elsewhere as a guess. Note the order: verification comes first, then access.

Recovery runs through these forms and the help pages linked here; LinkedIn lists no support phone number for it, so a hotline or paid recovery offer you find is not LinkedIn. The verification step is next.

LinkedIn account hacked? How to recover it by verifying your identity

When nobody can use the account’s own email or phone to prove ownership, the only proof left is you.

The government-issued ID, and sometimes a photo, LinkedIn’s verification partner asks for

LinkedIn runs the check through Persona, which it describes as its identity verification provider. Persona accepts a digital ID, or a clear and unobstructed photo of a valid, unexpired government-issued ID card, driver’s license or passport; the exact document types depend on the issuing country. Library and school ID cards are not accepted. Persona may also ask you to take a selfie so your face can be compared with the portrait on the document.

What LinkedIn says it receives from the check

With your permission, Persona passes LinkedIn the verification result, your full name, your year of birth, your city, state or province and country, the ID type and issuer, and a redacted copy of the document showing only the name and the face portrait. LinkedIn states that it does not receive your biometric data, or the numbers, expiry dates or issue dates on your ID. The full description sits on LinkedIn’s verifying your identity page.

The notarized affidavit option LinkedIn lists for Canada, the EU and the UK

Members in Canada, the European Union and the United Kingdom have one alternative to the ID and selfie route. LinkedIn provides an Affidavit of Identity to print, sign in front of a Notary Public, scan and attach to the support case. It is slower, but it exists if handing a document to a verification provider is not something you want to do.

LinkedIn compromised account cleanup: messages, invitations and posts

Getting back in is half of it. The other half is the trail left in your name, and LinkedIn’s compromised account cleanup page covers it with a separate request form. Submitting that form means you agree to LinkedIn reversing as many unauthorized activities as it can. Its own phrasing is that it “may be able to” reverse them, so read the table below as the best case rather than a promise.

Messages the intruder sent: moved to recipients’ spam or labeled with a warning

Note what this is not. LinkedIn does not reach into other people’s inboxes and delete the message. It says messages sent by the unauthorized user will either be moved to the recipients’ spam folder or be labeled with a warning. Anyone who already opened one has seen it, so assume the content is out rather than hoping it disappeared.

Invitations LinkedIn can withdraw, and the email notifications it can’t

Pending invitations can be pulled back and will vanish from the other member’s account. The notification email LinkedIn already sent about that invitation cannot be withdrawn. That mismatch is why some contacts hold an email about an invitation that no longer exists, and why a word from you is worth more than the cleanup.

Posts and comments shared during the unauthorized access

Posts and comments published during the access can be removed. Before you request that, screenshot them: once they are gone you have no record of what was published under your name, which matters if a client or an employer asks later.

Telling your connections without repeating the intruder’s links

One short post or message does the job: the dates access was lost and regained, a plain statement that anything sent between those dates was not from you, and an instruction to ignore it. Never paste, quote or screenshot the intruder’s link while explaining it — that just gives the campaign another run through a profile people now trust again.

After recovery: checks that keep the account yours

Review connections, follows and activity you didn’t make

Work through new connections, followed pages and your recent activity, and remove anything you did not choose. New connections matter more than they look: they are the audience for whatever gets sent next.

Keep the email and phone LinkedIn uses for resets current

Recovery depends on details that go stale quietly — an address at a job you left, a number you changed two phones ago. Put a reminder in the calendar once a year to open Sign in & security and read what is actually listed there.

Check the security of the email account behind LinkedIn

Repeat the inbox review from the earlier section even if you never lost LinkedIn access, and confirm the mailbox has its own second verification step. Every route back into a LinkedIn account runs through that inbox, which makes it worth more to an attacker than the LinkedIn password itself.

A note on LinkedIn accounts and PVAVRT

If you landed here while your own profile is locked, the honest answer is that nothing on this site solves that. Recovering your profile is the only route that returns your history, your connections and your name, and the steps above are the whole route.

PVAVRT does sell LinkedIn accounts, listed for marketing, automation, QA testing and account-management work. Two things need saying plainly about that page. LinkedIn’s User Agreement, effective November 3, 2025 at the time of checking, requires that you “only have one LinkedIn account”, and that it “must be in your real name”, and it bars sharing or transferring an account or any part of it. Buying one therefore breaks those terms, and LinkedIn is free to restrict any account at any time. A bought account is also never a substitute for recovering your own profile: messages to real people belong on the profile that carries your name, which is precisely what recovery gives back.

Questions about that page, or about whether a use case fits at all? Ask on Telegram @pvavrt before ordering. If the question is about getting your own profile back, LinkedIn’s help pages linked above are the right place, and they cost nothing.