Sharklio Account Hacked? A Publisher Incident Checklist

What to do if your Sharklio account was hacked

If someone else got into your Sharklio publisher account, act in this order: change your password (or set one if you use Google or Discord), revoke all trusted devices and log out other sessions, then check your payout method and account email for changes you did not make. After that, replace your app keys, check each app’s postback settings, contact the team, and secure the mailbox your codes go to. The first three steps take about five minutes on the Account page.

This page is the incident checklist. For the everyday settings that stop it from happening, see Secure your Sharklio account.

Signs someone else used your account

Open Account in the sidebar and click Activity in the row of section links at the top. The Recent security activity card lists logins and changes to your account from the last 180 days, each with a date, time and a partly hidden IP address. Notifications under the bell icon and a few emails add the rest.

Changes to an app’s Postback URL, currency settings or design, and new apps, do not create a security notification. You have to check those by hand (step 6).

Steps 1 and 2: lock the account

1. Change your password, or set one

On the Account page, find the Sign-in & security card and click Change password in the Password row. Changing it logs out your other devices, and the browser you are using stays logged in. Use a new password you use nowhere else.

If you signed up with Google or Discord, the row shows Set a password instead. Click it and confirm with the code we email you. While you are in this card, look at the Google account and Discord account rows and click Unlink next to any account that is not yours. If your Google or Discord account itself was hacked, recover that account with its provider before you rely on it again. The exact clicks are in How to change or set your password and Log in with Google or Discord.

2. Revoke trusted devices and end other sessions

Changing your password does not remove trusted devices, which skip the email code for a year. Do these in order:

1. In the Trusted devices card, click Revoke all and confirm. Every device, including yours, will need an email code at its next login.
2. In the Login verification row of Sign-in & security, turn the switch on if it is off. From then on, a new device needs a code from your email even if someone knows your password.
3. In the Sessions card, click Log out everywhere. It ends every session, including yours, so log back in afterwards.

Then read Recent security activity again from the top. The card ends with a short reminder: “Not you? Log out everywhere and change your password.” Login verification, trusted devices and sessions shows each card in detail.

Steps 3 and 4: protect your payouts and your email

3. Check the payout method

Click Payout method in the section links on the Account page. The card shows the method, the full address or account it pays to, and the date it was Saved. Compare the address character by character with your own records.

A new or changed payout method is only saved after someone enters a 6-digit code sent to your account email. That gives you two cases:

• You got a code you did not ask for. The email “is your code to confirm your Sharklio payout method” shows the payout method and address someone tried to save. Do not enter or share the code: the payout method stays the same until someone enters it. Treat it as proof that someone was logged in.
• A change was saved. Recent security activity shows Payout method changed, and the account email got “Your Sharklio payout method was changed”. That email says: “If you did not make this change, contact partners@sharklio.com right away so we can stop the next payout.” Do that now, then click Change payout method, enter your own details and confirm with the code.

If a saved change happened, the code went to your account email, so check step 4 and step 8 next. Open Payments in the sidebar to see your statements and their status.

4. Check the account email

In the Profile information card, the Email address row shows your address with a Verified badge. Make sure it is yours.

• If you sign in only with Google or Discord and got “is your code to change your Sharklio email” without asking for it, someone started a change. Do not share the code: your email address stays the same until someone enters it.
• If the address is not yours but you can still log in, click Change email, enter your own address and confirm it with the code sent there, as How to change your username or email explains.
• If you are locked out because the email was changed, your old address got “Your Sharklio email address was changed” with a Contact support button. Use it from that old address (step 7).

While you are in Profile information, glance at Name and address too. Someone who was logged in could read what you saved there, including any Tax ID or VAT number.

Steps 5 and 6: secure your apps and integration

5. Replace the keys of every app

Anyone logged in could click Show and copy your keys. Replace all three for every app: go to Apps, click Manage, open the Integration tab, and under 2. Keys and security use Replace your keys:

• New link hash salt, so nobody can build valid offerwall links for your users.
• New postback secret key, so nobody can sign fake postbacks to your server.
• New API key, so nobody can call the Offers API or the Reporting API as you.

The old key stops working right away and cannot be brought back, so have your server update ready first. Also check that Link security still requires the hash; if you see a Hash check is off badge, click Require the hash. How to rotate your keys and link salt walks through each click, and How to keep your app secret safe covers where the keys should live.

6. Check postback URLs and app settings

These changes do not show up as alerts, so open each app and read every tab:

• Postback: the Postback URL must point to your own server. A changed host means your credit and reversal postbacks went somewhere else.
• Currency: Currency name, Conversion rate, Split to user (%), Reward rounding and any bonus you did not plan.
• General and Design: the app name and anything on the wall your users see.
• The Apps list: any app you did not create.

Then open Reports and Postbacks in the sidebar. Each row shows the URL the postback was sent to, so you can see when postbacks started going to a host you do not know. Once your URL is fixed, failed postbacks can be sent again, as How to resend a failed postback explains. Your server should also check every postback’s hash, which Postback security covers.

Step 7: contact Sharklio support

Tell the team as soon as you suspect access you did not allow. The Sharklio Terms (section 5) ask you to tell us promptly at support@sharklio.com. You have three ways in:

• Chat: in the dashboard, click Chat with us under Need help? at the bottom of the sidebar. Replies come from Sharklio Support.
• Email: support@sharklio.com, or partners@sharklio.com, the address under Need help? in the sidebar and in the payout change email.
• Contact form: if you cannot log in, use the contact page, choose A publisher, then the topic Account and login. Write from the email address that was on your account.

Include your username, the account email, your App IDs, what changed, and the dates and times from Recent security activity. Never put your password or a login code in a message.

Step 8: secure the email account itself

Your mailbox receives every Sharklio code, and the FTC notes that a hacked email account can be used to reset the passwords of your other accounts. The FTC’s guide to recovering a hacked email account lists the core steps: update and run your security software, follow your provider’s recovery steps, change the password, sign out of all devices, turn on two-factor authentication, check that the recovery email and phone are yours, and delete forwarding rules you did not set up.

• Gmail: Google’s page Secure a hacked or compromised Google Account says to review recent security events and devices, turn on 2-Step Verification, fix any unfamiliar recovery phone or email, and remove labels, filters or forwarding rules you did not set up. Locked out? Google’s tips to complete account recovery steps advise using a device and place you usually sign in from and answering every question.
• Outlook and Hotmail: Microsoft’s How to recover a hacked or compromised Microsoft account says to run a full antivirus scan before you change your password, then check connected accounts, forwarding and automatic replies.

If you are in the US and fear your personal details are being misused beyond Sharklio, the FTC says to report identity theft at IdentityTheft.gov, where you get a free personal recovery plan. Many takeovers start with a fake login page, so read How to spot phishing emails before you sign in anywhere from an email link. Provider guidance checked on October 29, 2026.

What Sharklio can and cannot do

Responsibility matters here too. The Terms (section 5) make you responsible for keeping your credentials confidential and for all activity under your account, and section 7 makes you responsible for a correct payout address. That is why the speed of steps 3 and 7 matters most.

Frequently asked questions