How to tell if your laptop is hacked

WindowsMacUpdated

To tell if your laptop is hacked, look for the signs the UK's National Cyber Security Centre lists, run a malware scan, and check your Microsoft or Apple account for sign-ins and changes you didn't make. One odd symptom on its own proves little. A scan result or account activity you don't recognise tells you much more.

Quick answer

Run a scan first: on Windows, open Windows Security > Virus & threat protection > Quick scan. Then check your account: account.live.com/Activity for a Microsoft account, or Devices at account.apple.com. Signs worth acting on include pop-ups from programs you don't recognise, apps opening by themselves, and friends getting messages you didn't send.

What are the signs that a laptop has been hacked?

The NCSC lists several signs a device may be infected. A slow laptop on its own is a weak sign, because laptops slow down for ordinary reasons. Several of these together, or one alongside unusual account activity, is a stronger reason to check.

  • The laptop runs slowly, restarts by itself, or closes or opens programs you didn't touch.
  • Pop-ups appear from programs you don't recognise, asking you to do unexpected things.
  • Contacts receive emails from you that you didn't send, such as adverts or requests for money.

The NCSC also lists signs that an online account has been taken over:

  • You can't sign in, or your security settings have changed.
  • Messages or notifications were sent from your account that you don't recognise.
  • Sign-ins came from unfamiliar locations or at odd hours.
  • Money was spent or moved without your say-so.

How do I check a Windows laptop for malware?

Windows includes Microsoft Defender Antivirus in the Windows Security app. Start with a quick scan. If it finds nothing and you're still concerned, Microsoft suggests a more thorough check, such as the offline scan, which runs before Windows loads so persistent malware has a harder time hiding.

  1. Search the Start menu for Windows Security and open it.
  2. Select Virus & threat protection, then Quick scan.
  3. For a deeper check, go back to Virus & threat protection, select Scan options under Current threats, choose Microsoft Defender Antivirus (offline scan), then Start an offline scan.
  4. Save open files first. The laptop restarts, scans and restarts again on its own.
  5. To see the results, open Windows Security and select Protection history.

The NCSC advises updating your device and programs before you scan, then following your antivirus product's advice.

How do I check a Mac?

Apple's advice centres on where your software comes from, since malware is often packaged inside apps that look harmless. Check which apps your Mac allows, which items open when you log in, and whether other computers can connect to it.

  1. Choose Apple menu > System Settings > Privacy & Security. Under Security, the "Allow applications from" setting should be App Store, or App Store and Known Developers.
  2. Go to System Settings > General > Login Items & Extensions. Under Open at Login, select anything you don't recognise and click the Remove button.
  3. Go to System Settings > General > Sharing and turn off Screen Sharing if you don't use it. When it's off, other computers on your network can't connect to your Mac.

How do I check if someone has got into my Microsoft or Apple account?

Often what feels like a hacked laptop is a hacked account. Microsoft's Recent activity page shows when and where your Microsoft account was used in the last 30 days. Apple lists the warning signs for an Apple Account, including codes and notifications you didn't ask for.

Microsoft account

  1. Go to account.live.com/Activity.
  2. Expand any entry to see its location and how the account was accessed.
  3. If something sits under Unusual activity and it wasn't you, or you're not sure, select This wasn't me. This starts a password change and an update of your security info.

Apple Account. Apple says to act if any of these happen:

  • Apple tells you about activity you don't recognise, such as a sign-in on an unknown device or a password change you didn't make.
  • You receive a two-factor authentication code you didn't request.
  • Your password no longer works.
  • Your device was locked or put in Lost Mode by someone other than you.

Apple's steps: change your Apple Account password (or reset it, if someone else already changed it), correct anything wrong at account.apple.com, select Devices there and remove any you don't recognise, and check with your email provider and mobile network that you control every address and number on the account.

What should I do if I think my laptop is hacked?

Follow the NCSC's order: fix the device, then secure the accounts. If your antivirus can't clean the laptop, the NCSC says you'll need to wipe it and reinstall everything, starting with the operating system. Restore your files from a backup made before the problem, not from the infected laptop.

  1. Update the laptop and its programs, run a scan, and follow the antivirus advice.
  2. If it can't be cleaned, wipe and reinstall, then restore from a known good backup.
  3. Check your email for forwarding rules or filters you didn't set up.
  4. Change the password on the affected account and on any account that shares it.
  5. Sign out all devices and apps from the account, and turn on two-step verification.
  6. If you've lost money, tell your bank and report it to Report Fraud at reportfraud.police.uk. In Scotland, call the police on 101.

If someone phones to say your computer is infected and asks for remote access to fix it, the NCSC says to hang up and report the call to Report Fraud.

Could it be someone with the laptop in their hands?

Sometimes the worry isn't malware at all but a person who knows your password. That kind of access leaves ordinary traces: recent files, browser history and Windows sign-in events. If you're worried about a partner or someone you live with, please don't go through their devices. In the UK, the National Domestic Abuse Helpline, run by Refuge, is on 0808 2000 247, or contact your local police.

Where Failshot fits

To be clear about the limits: Failshot does not detect hacking, malware, spyware or remote access. For those, use the scans and account checks above.

Failshot covers one thing: someone with your laptop in their hands. With it on, it photographs whoever unlocks your Mac or Windows laptop, and the camera light shows each time. It doesn't take wrong-password photos at the Windows sign-in screen. Someone who knows your password can't switch it off, because that needs Touch ID on a Mac where available, or your own Failshot PIN plus your answer. Photos stay on the laptop, with optional email alerts. It's for your own devices only, and out now for Mac, with Windows to follow.

Questions people also ask

Is a slow laptop a sign of hacking?

It can be one sign, but a weak one on its own. The NCSC lists running slowly alongside restarting by itself, programs opening or closing unexpectedly, and unfamiliar pop-ups. Run a scan and check your account activity before drawing conclusions.

How do I scan my laptop for viruses on Windows 11?

Open Windows Security, select Virus & threat protection, then Quick scan. If you're still concerned, choose Scan options and run Microsoft Defender Antivirus (offline scan), which restarts the laptop and scans before Windows loads. Results appear under Protection history.

Should I factory reset a hacked laptop?

The NCSC says that if your antivirus can't clean a PC or laptop, you'll need to wipe it and reinstall everything, starting with the operating system. Restore your data from a backup made before the infection, so you don't copy the problem back.

Someone rang to say my computer has a virus. What should I do?

The NCSC says to hang up if a caller claiming to be from a trusted company says your device is infected and asks for access to fix it. Report the call to Report Fraud. If you paid them, tell your bank or card provider too.

Where do I report being hacked in the UK?

If you've lost money, tell your bank and report it to Report Fraud at reportfraud.police.uk, which the NCSC calls the UK's reporting centre for cyber crime. If you live in Scotland, call the police on 101 instead.

Sources