How to Know If Your Computer Is Hacked: 12 Warning Signs (2026)

If you have a nagging feeling that something is wrong with your computer, that feeling is worth taking seriously — and it is also worth checking calmly, because most of the time it turns out to be something far less alarming than a hacker. This guide walks you through the twelve real warning signs that a computer has been compromised, the fake warnings that are actually scams designed to frighten retirees, and a clear ten-step cleanup you can follow without any technical background.

How do computers actually get hacked?

Understanding the how makes the warning signs make sense. In the overwhelming majority of cases involving home computers, nobody targeted you personally. Four routes account for almost everything:

• You clicked a link or attachment in an email or text that installed something in the background — a fake delivery notice, a fake invoice, a fake antivirus renewal.
• You were talked into it. Someone called claiming to be from Microsoft, Apple, your bank or your internet provider, and you allowed them to connect remotely. This is the single most common route for people over 65.
• A password leaked in a data breach somewhere else, and because it was reused, it unlocked your email — which then unlocked everything else.
• You downloaded free software from a search-result advertisement rather than the official website, and it arrived with unwanted extras attached.

Notice that only one of those four involves anything technical. Three of them are ordinary decisions made in a hurry. That is good news: the habits that prevent them are ordinary too.

The 12 warning signs your computer is hacked

1. Programs you never installed

Open your list of installed apps — on Windows, Settings, then Apps; on a Mac, the Applications folder — and sort by install date. Anything that appeared on a day you were not installing software deserves a search of its name before you touch it. Names that sound vaguely official, like 'PC Optimizer Pro' or 'Driver Update Assistant', are classic unwanted installs.

2. Your browser opens somewhere you did not choose

A hijacked browser is one of the most visible signs. Your homepage changes, your searches route through a site you have never heard of, or a new toolbar appears across the top. This is done for advertising money, but the same access can be used to capture what you type.

3. The cursor moves on its own

If the pointer glides across the screen, windows open by themselves, or text types itself while your hands are in your lap, someone has live remote control. This is the most urgent sign on the list. Unplug the internet or turn off Wi-Fi immediately, then hold the power button for ten seconds to shut the machine down.

4. Emails in your Sent folder that you did not write

Check your Sent and Deleted folders. Messages to your own contacts that you did not compose mean your email account itself is compromised — and email is the account that resets all the others. Also look in your email settings for a forwarding rule sending copies to an address you do not recognize; attackers add these so they keep reading your mail even after you change the password.

5. Friends say they got a strange message from you

A phone call from your daughter asking why you sent her a link about a discount store, or a text saying your Facebook account is messaging people, is often the very first outside signal. Believe them and check, even if everything looks fine on your end.

6. Your antivirus or updates have been switched off

Malware routinely disables the protections that would remove it. On Windows, open Windows Security and confirm that virus protection and Windows Update are both on. If a setting refuses to turn back on, or turns itself off again, treat that as a strong sign of infection.

7. Passwords suddenly stop working

A password you have typed for years that is now rejected usually means someone changed it. Do not keep retrying. Use the account's official website — typed by hand, not from an email link — to start a password reset, and check whether the account's recovery email or phone number has been changed to something unfamiliar.

8. Unexpected password-reset or verification codes

Codes arriving that you did not request mean someone already has your password and is being stopped by two-factor authentication. Never read a code out to anyone who calls you, and change that account's password straight away.

9. The computer is hot, loud and slow while idle

A fan running hard when you are only reading a page can mean hidden software is using your processor. Open Task Manager on Windows (Ctrl, Shift and Escape together) or Activity Monitor on a Mac and look at what is consuming the most processor time. A name you do not recognize sitting near the top is worth searching.

10. Files you cannot open, or a ransom message

If your documents and photos now end in strange file extensions, or a message demands payment to unlock them, that is ransomware. Do not pay. Disconnect the computer, and if you have a backup on an external drive that was not plugged in at the time, that backup is your recovery path.

11. New accounts, charges or credit activity

Small unfamiliar charges on a card — often just a dollar or two as a test — frequently precede a large one. Review statements line by line, and check your credit report free at AnnualCreditReport.com for accounts opened in your name.

12. Security alerts about sign-ins from other places

Genuine alerts from Google, Microsoft or your bank about a sign-in from an unfamiliar city or device should be acted on — but always by typing the company's address into your browser yourself. A large share of 'unusual sign-in' emails are phishing, so never use the link inside the message.

The fake signs: warnings that are scams, not hacks

Some of the most frightening things you can see on a screen are not evidence of a hack at all. They are advertisements engineered to make retirees pick up the phone. Learn these and you remove the single biggest financial risk in this whole subject.

• A full-screen pop-up with a siren, a countdown, or a phone number for 'Microsoft Support'. Real security software never shows a phone number.
• A page claiming your computer is infected with a specific number of viruses. Web pages cannot scan your computer.
• An email saying your Norton, McAfee or Geek Squad subscription auto-renewed for several hundred dollars, with a number to call for a refund. The 'refund' call is where the money is taken.
• A caller who says they detected a problem on your computer. No legitimate company monitors your home computer and calls you about it.
• Any request to install remote-access software such as AnyDesk, TeamViewer or UltraViewer so someone can 'help you'.

What to do right now: the 10-step cleanup

1. Disconnect from the internet. Turn off Wi-Fi or unplug the cable. This cuts any live remote session immediately.
2. From a different device such as your phone, change your email password and turn on two-factor authentication. Email is the master key.
3. Check your email settings for forwarding rules or recovery addresses you do not recognize, and delete them.
4. Change your online-banking password, then call the number on the back of your card and ask them to review recent activity.
5. Back on the computer, run a full scan with Microsoft Defender on Windows, or your existing antivirus on a Mac. Let it finish completely.
6. Uninstall programs you do not recognize, and remove unfamiliar browser extensions in Chrome, Edge or Safari.
7. Reset your browser settings to defaults to undo a hijacked homepage or search engine.
8. Install every pending operating system update and restart. Many compromises rely on holes that updates have already closed.
9. Change passwords on your remaining important accounts — Medicare, Social Security, Amazon, and any account sharing an old reused password. A password manager makes this far easier.
10. Watch statements and credit for 90 days, and consider a free credit freeze with Equifax, Experian and TransUnion so no one can open accounts in your name.

If the cursor was moving on its own, if a stranger had remote access, or if ransomware locked your files, the safest ending is a full reset of the computer — Windows offers 'Reset this PC', and Macs can be erased and reinstalled. Ask a trusted local repair shop or a family member, not a phone number from a pop-up.

How to avoid getting hacked in the first place

Seven habits prevent the overwhelming majority of home computer compromises, and none of them cost money:

• Turn on automatic updates for Windows or macOS, your browser, and your phone.
• Turn on two-factor authentication for email and banking first, then everything else.
• Use a password manager so every account has a different long password you never have to remember.
• Never install software from a search advertisement — go to the company's official website directly.
• Never allow remote access to anyone who contacted you, no matter who they claim to be.
• Keep one backup on an external drive that stays unplugged between backups, so ransomware cannot reach it.
• Agree a family safe word so a panicked call claiming to be a grandchild can be verified in seconds.

When to get help, and who to tell

Report fraud to the FTC at ReportFraud.ftc.gov, and report online crime to the FBI's Internet Crime Complaint Center at IC3.gov. If money moved, tell your bank the same day — speed matters more than anything else for recovery. If you are helping a parent, do it without blame; shame is the reason most of these losses are never reported.

And if you are ever unsure whether a message, a link or a phone number is genuine, you do not have to guess. Safe Retire Watch offers free AI tools that give you a plain-English verdict in seconds — paste a suspicious message into the scam checker, a link into the link checker, or a number into the phone checker before you act.