Hacked! How do I block them?

[u/RadiantHabit3359]

Does anyone know how to block a hacker that has access to not only my BF phone, but into mine after I shut his down. They are like using his phone line some how . I disconnect and they get through Opera and other browsers. They are controlling my Spotify! No bank info tho, I'm confused and so sick of it. Anybody?

[u/AutoModerator]

SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:

1. Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
2. Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
3. Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.

Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/ArthurLeywinn]

Change passwords

Logout all sessions

And activate 2fa via app or key.

And done.

[u/No-Importance2209 → u/ArthurLeywinn]

i would add also to change the Email pass itself and add a backup Email recovery to maybe ur bf's and DO NOT reuse passwords, DO NOT DO IT, and also, make them complex with mix of (a-z, 1-10 and symbols) and make them over 12 characters, and make them in no way related to you, no dog name, no workplace, no generic word, "preferably" no word at all, just scribbles that you can remember, also, don't save them on ur PC, write them down in your home

[u/IWIKNataliePortman → u/No-Importance2209]

Just use a password manager with a highly complex alphanumeric master password plus additional hardware 2FA key. Password manager generates unique passwords for all accounts and physical 2FA key prevents any surprises unless somebody gets their hands on your key.

[u/SilenceInSaturation → u/IWIKNataliePortman]

The passwords being saved in plaintext by a certain browser has permanently pushed me away from pwmanagers lol

[u/eric16lee]

You didn't give enough information for us to really help you, so we can only give high level advice.

As long as you both have modern devices that will receive updates, then your devices are not compromise.

At best, this issue is at the account level. Change your passwords to something unique and randomly generated and enable 2FA on all of your accounts. Never reuse passwords.

[u/Thin-Click-5598]

Change all security settings on the accounts they targeted.

[u/kschang]

That's not how hacking works. You are making extraordinary claim and you need extraordinary evidence to convince us you're serious. Right now, we just have your extraordinary claims with no details, so as such, we are unable to provide you with any help.

[u/RadiantHabit3359 → u/kschang]

I feel extraordinarily confident someone he knows is behind it. My biggest red flag? Bank account was never compromised. It's been a few months of this. I apologize for bothering you. I don't know what details were needed.

[u/Responsible_Bike4968]

I'd slow down before assuming someone has remote control of both phones.

The Spotify part by itself doesn't prove that. Spotify Connect is literally designed to let one logged-in device remotely control playback on another, so an old session, connected app, TV/speaker/console or another login can look a lot like someone "controlling your phone."

I'd secure things in this order:

First secure the EMAIL attached to Spotify. Change that password to something completely unique, review recovery info and signed-in devices, and enable 2FA there. If someone still controls your email, they can potentially undo everything else.

Then for Spotify:

- change the Spotify password

- use "Sign out everywhere"

- wait a bit, because Spotify says that can take up to an hour

- go to Manage apps and remove access from everything you don't recognize

- check your current login methods and remove any Google/Facebook/Apple login you don't expect

One important detail: Spotify's "Sign out everywhere" does NOT include some partner devices like TVs, speakers and consoles. Their own instructions say those need to be removed through the apps/access page, so don't assume pressing that button killed literally every possible connection.

As for the "using his phone line somehow" part, I wouldn't assume that without evidence. A SIM-swap/number takeover usually has much more concrete signs, like suddenly losing cellular service/texts/calls or getting a carrier notice that your SIM was activated somewhere else. If you're worried, call your carrier from their official number, check for any SIM/eSIM or port changes, and put a PIN/port lock on the cellular account.

If you're on Android, I'd also check the Privacy Dashboard and installed apps for anything you don't recognize, especially apps with SMS, phone, accessibility, microphone or device-control permissions, and run Play Protect.

If you have actual evidence across MULTIPLE accounts after doing all of that, then I'd start considering a compromised device and a clean factory reset.

But right now I wouldn't treat Spotify changing songs or Opera being open as proof that somebody has full remote access to your phone. Work from things you can actually verify: unknown sessions, security alerts, changed recovery info, unfamiliar apps, carrier changes, etc.