social media account takeovers: the most common methods

While reading the annual statistics for this article, I was genuinely amazed: (according to Surfshark’s latest survey^{Source 1}) in 2025, more than 430,000 social media accounts were breached in Romania, and 425.7 million worldwide. That means roughly 810 accounts every minute, or 14 every second, fall into the wrong hands around the world. So by the time you finish reading this paragraph, several hundred accounts will have been hacked… It is no surprise, then, that almost everyone knows at least one such case.

So let’s not drag it out: we have collected the most common account takeover methods, the motives behind them, and a few quick, easy-to-apply tips that can help you prevent a breach within minutes, or get back an account that has already been hacked.

Although these takeover attempts may seem complicated and impenetrable at first, attackers in fact mostly rely on the same tried-and-tested methods. Understanding and recognising their logic is already one of the most important steps towards protecting ourselves.

According to JAICT^{Source 2}, phishing remains one of the most common online attack methods. Its essence is simple: attackers use technical tricks to get users to hand over their password or other sensitive data themselves. A typical example is the cloned website: attackers copy the original login page or notification, whether it is a social media site or a parcel delivery company’s page.

An increasingly common method is using an already hijacked account to deceive further victims: the message seems to come from a friend or acquaintance, which makes the attacker far more credible. For example, attackers write from a hijacked Facebook account to its owner’s friends and ask, under some pretext, for the code needed to log in. A friend of mine received a message from the hijacked Facebook account of a colleague, asking for her phone number in connection with an eMAG prize draw. At first the request seemed harmless, so she sent her number, but the situation quickly turned suspicious and she deleted the message. By then, however, an SMS with the code needed to log in to Facebook had already arrived. Luckily she did not send the code back, so the takeover attempt failed, and she quickly warned her former colleague that her account had probably been hacked.

What I found particularly striking, though, was the language of the messages: flawless sentence structure, precise style, even emojis… as if (and probably indeed) artificial intelligence had written or proofread the text.

Not every account takeover requires attackers to persuade the user to give away their password. In many cases they already have such data at their disposal from earlier data breaches.

According to research from the Cryptology ePrint Archive^{Source 3}, password reuse plays a key role in a significant share of online account takeovers. Since we often use the same password on several different sites, a single leaked database can open the door to attacks on other platforms as well.

When a website is hacked, attackers often obtain users’ email addresses and passwords. These data later turn up in various leaked databases, where other attackers can reach them too: attackers who work with extensive lists and use bots (automated programs) to try the stolen email–password pairs on different sites. This method is called credential stuffing.

Since such data leaks often go unnoticed, it is worth checking whether our email address appears in known data breaches. On the Have I Been Pwned website, all you have to do is enter your email address, and the system will show whether you were affected by any earlier incident. If so, it is advisable to change the password of the affected accounts immediately, especially if you used the same password in several places.

According to ESET’s definition^{Source 4}, the term “malware” is short for “malicious software”, and is the collective name for programs designed to secretly steal data, cause damage or give attackers access. This includes viruses, worms, Trojans and spyware.

Particularly dangerous are data-stealing malware programs that collect credentials stored on the device, passwords saved in the browser or other sensitive information, and pass them on to attackers. According to Flashpoint’s survey^{Source 5}, this type of malware played a role in the fact that…

In 2024, more than 2.1 billion user credentials were stolen (this accounts for about 60% of all data ever stolen).

These programs are often distributed as Trojans, in infected attachments or fake installer files, and once the user allows them to run, they collect the data unnoticed and then hand it over to the attackers, directly facilitating account takeovers or other attacks.

To filter out these programs, it is worth scanning files received from unknown or dubious sources with an antivirus before opening them, to check whether they contain any kind of malware. Reliable, free services that need no download include VirusTotal and NordVPN’s file checker.

According to an IJISRT report^{Source 6}, public Wi-Fi networks (those not secured with a password, for example in airports or cafés) offer convenient internet access, but also carry serious security risks. When a network is not properly encrypted, the traffic passing through it can easily be “eavesdropped” by others, which can lead to the leaking of sensitive data, such as login credentials.

The dangers of public Wi-Fi include the Man-in-the-Middle attack, where the attacker inserts themselves into the data traffic and can listen in on it: if we then log in to email accounts, social media, banking systems or other websites containing personal data, the “man in the middle” sees everything. Another similar method is the creation of fake hotspots (“Evil Twin”), which run under the same name as an official network but collect data from users.

Since we live in an age of endless internet data traffic, in everyday life it is worth using our own mobile data instead of public Wi-Fi, and when travelling, a previously purchased electronic SIM card (eSIM) makes it possible not to rely on the airport’s internet network.

If we still need to connect to a public network, security experts recommend using a VPN (for example the free and trustworthy ProtonVPN), browsing HTTPS sites, and never letting the device connect to the network automatically when accessing important accounts.

Finally, we have left perhaps one of the most cunning methods for last: psychological manipulation. Christopher Hadnagy^{Source 7} defines social engineering as a process in which the attacker uses manipulation and persuasion to get their victims to reveal confidential information or to carry out malicious purposes. This method primarily exploits human trust, inattentiveness, or instinctive reactions to urgent situations.

An important difference compared with general phishing is that while phishing typically works with mass-sent messages or fake websites, social engineering is often far more personal and targeted. The attacker can pass themselves off as a customer service employee, a colleague or a technical expert who asks for help in solving an “urgent problem”. Typical scenarios are the phone call in which the caller refers to a security check, or the message in which an “IT colleague” asks for temporary access to an account.

A similar case was reported on 4 March 2026 by Székelyföld TV^{Source 8}: scammers posing as employees of ANAF, the Romanian tax authority, contacted a local councillor from Gheorgheni (Gyergyószentmiklós). According to their story, the politician had overpaid his tax the previous year, and they wanted to refund the difference, which was how they tried to trick him into giving out his bank details. In such cases the scammers build up their credible-sounding story extremely professionally, using technical jargon and often armed with background information about the victim obtained in advance.

The most effective protection in all cases is healthy scepticism: if anyone asks for a password, login code, bank details or any other sensitive data, it is worth stopping for a moment and verifying the legitimacy of the request through another, official channel.