What to do if your email is hacked: the first hour

If your email is hacked, act in this order: scan your device for malware, change the password (or run account recovery if you are locked out), sign out every other session, and turn on two-factor authentication. Then remove what the intruder may have left behind: forwarding rules, filters, app access and changed recovery details.

That last step is the one people miss. A new password does not end sessions that are already open on some providers, does not delete a forwarding rule, and may not revoke an app that was granted access. An intruder who planted any of those keeps reading your mail after you think you have locked the door.

Email matters more than any other account for a simple reason the FTC spells out: someone in your inbox "could request a password reset link for any of your other accounts, get the password reset link from your inbox, change your password, and lock you out."

How do I know my email was hacked?

The FTC's list of signs is short:

You can't log in.
You get a notice that your password or username changed, and you didn't change it.
You get a notice of a sign-in from a device or place you don't recognize.
Friends or family receive emails you didn't send.

Yahoo adds two that are specific to mail: you stop receiving email, and your mail settings have changed without you. If none of these apply and the only evidence is a threatening email claiming your account was taken over, skip to the section on spoofing near the end.

Step 1: Scan the device you are about to use

It feels backwards, but it comes first. If the password was stolen by software on your computer, a new password typed on that computer is stolen too. Microsoft's recovery page is explicit: "run a full scan on your PC before you change your password." The FTC gives the same order: update your security software, run a scan, delete anything it finds, restart, then start recovery.

If you can't scan right now, use a different device you trust, such as your phone on mobile data.

Step 2: Change the password, or recover the account

If you can still sign in, change the password now. Make it long and used nowhere else.

If the password no longer works, go straight to your provider's recovery process. Do not search for a "support number". Google states that you cannot call it for sign-in help and that it does not work with any service claiming to offer account or password support. People who advertise recovery help are running a second scam on top of the first.

Provider	Where recovery starts	Worth knowing
Gmail and Google	The account recovery page linked from Google's hacked-account guide	Wrong guesses don't lock you out, and there is no limit on attempts. Recovery info you changed recently can take up to 7 days to apply
Outlook.com, Hotmail	The sign-in helper on Microsoft's hacked-account page	It asks for your address or phone number, then offers self-help or the chance to talk to an agent
Yahoo Mail	The Sign-in Helper, then Yahoo's hacked account steps	Yahoo lists a customer care route for regaining access
iCloud Mail	iforgot.apple.com, as described in Apple's compromised-account page	Account recovery includes a waiting period before you get back in

Answer recovery questions as well as you can, from a device and network you normally use if possible.

Step 3: Sign out every other session

Once you are in with a new password, end every other login so anyone still inside is pushed out.

Google: in your Google Account, open Security & sign-in, find Your devices, choose Manage all devices, and sign out of anything you don't recognize. Google also shows a Recent security events panel where you can mark activity with "No, it wasn't me".
Microsoft: sign in to Advanced security options on your account's security dashboard, scroll to Sign out everywhere and select Sign out. Microsoft says this can take up to 24 hours to reach every app and browser. The Recent activity page shows where your account was used in the last 30 days.
Yahoo: open the Account security page and review recent activity for logins from unexpected locations.
Apple: at account.apple.com, select Devices and remove any you don't recognize.

Step 4: Remove what a new password does not

Work through this list on a computer. It takes ten minutes and it is where a hack is most often still alive.

What to check	Why it matters	Where
Automatic forwarding	Copies every incoming message to the intruder	Gmail: Settings, See all settings, Forwarding and POP/IMAP. Outlook.com: Settings, Mail, Forwarding. Yahoo: mailbox settings, auto-forwarding address
Filters and rules	Can forward only bank mail, or delete security alerts before you see them	Gmail: Filters and Blocked Addresses, look for "Forward to" and "Delete it". Outlook.com: Settings, Mail, Rules. Yahoo: email filters
Send-as, reply-to, signature, auto-reply	Lets replies to your mail reach someone else	Gmail: Accounts and Import ("Send mail as") and the General tab. Outlook.com: Automatic replies. Yahoo: reply-to address, send-only address, vacation response
Delegates and linked mailboxes	Gives another account standing access	Gmail: Accounts and Import, "Grant access to your account" and "Check mail from other accounts". Outlook.com: connected accounts
App passwords	Old-style passwords for mail apps that keep working	Yahoo: delete app passwords you don't recognize. Check the same list at any provider where you created them
Third-party app access	An app that was approved with "Allow access" has its own key to your data and may keep it after a password change	Google Account: linked apps page, Remove access
Recovery phone and email	Whoever controls these can take the account back	Every provider's security page. Remove anything that isn't yours

The Gmail tabs are the ones Google's own security checklist tells you to review. Microsoft's recovery page names connected accounts, forwarding and automatic replies as the settings to check after a compromise. Yahoo's hacked-account page lists filters, reply-to, send-only address, vacation response and auto-forwarding. Apple adds one that is easy to overlook: ask your mobile carrier to confirm that SMS forwarding has not been set up on the phone number tied to your account.

Step 5: Add a second factor

Turn on two-factor authentication before you do anything else with the account. With it, a stolen password alone no longer opens the mailbox. Use a passkey or an authenticator app where you can. Our guide to which two-factor methods are safest ranks the options.

While you are there, save the backup codes somewhere that is not the mailbox itself, and check that the recovery email is an account you have also secured. Recovery is a design choice that differs between providers. Secria Mail, for example, asks for no phone number at sign-up, supports two-factor authentication with a standard authenticator app, and handles recovery with a 12-word recovery phrase you keep yourself.

Step 6: Find out what they did

Now look backwards.

Sent, Trash and Archive. Look for messages you didn't write, and for read-then-deleted mail. The FTC recommends checking both the sent and the deleted folders.
Password resets. Search your mailbox for "reset", "verify" and "new sign-in". Any account that sent one during the break-in needs its own password changed, starting with banks, payment apps, shopping accounts with saved cards, and cloud storage.
Reused passwords. Anywhere you used the old email password, change it. Google gives the same instruction for its accounts.
Money and identity. If tax documents, ID scans or card details were in your mail, tell your bank and watch your statements. Google's guide says to contact your bank or local authorities if you think someone is using your identity.
Your contacts. Send a short note: you were hacked, ignore links and requests for money sent from your address on those dates.

What if friends got spam from my address but nothing else is wrong?

Then your account may never have been touched. Anyone can type your address into the From line of a message, which is called spoofing, and it needs no access to your mailbox.

Check two things. First, your Sent folder and sign-in activity: if both are clean, nobody used your account. Second, ask a friend to send you the original of the message they received and paste its headers into the free Secria email header analyzer. If it shows SPF and DMARC failing, the message came from someone else's server with your address pasted on. That is annoying, but it is not a break-in, and there is nothing in your account to clean up.

Should I keep this email address?

Usually yes. Once the steps above are done, the address is as safe as the security you just added. Consider moving the accounts that matter most, such as banking and your password manager, to an address you give to nobody else. We explain that setup in a separate email for banking.

Frequently asked questions

Can I get my email back if the hacker changed the password?

Often, yes. Every major provider has a recovery process that checks your identity with a recovery phone, a recovery email or questions about the account. Google says there is no limit on recovery attempts. If the recovery details were changed too, the process takes longer, and at Apple it includes a waiting period.

Does changing my password log the hacker out?

Not reliably. Open sessions, forwarding rules, app passwords and apps with granted access can all outlive a password change. That is why signing out everywhere and reviewing the settings in step 4 are separate steps.

How did my email get hacked?

The common routes are a password reused from another site that was breached, a phishing page that collected your login, and malware on a device. Google's own help pages name phishing and malware as the usual causes of unfamiliar activity. Knowing which one applies tells you what else to fix.

Should I pay a service to recover my account?

No. Google says it does not work with any service that claims to provide account or password support, and no outside company has access to another provider's recovery system. Use only the recovery pages on the provider's own site.

The takeaway

Scan first, reset second, then sign out everything and clear out forwarding, filters and app access before you relax. And if the break-in has you thinking about where your mail lives, Secria Mail has a free plan with zero-access encryption on every message in your mailbox.