Yahoo Mail hacked? What to do, step by step

If your Yahoo Mail was hacked, change your password right away from the Yahoo Account security page, or use Yahoo's Sign-in Helper at login.yahoo.com/forgot if the hacker already changed it. Then sign out devices you do not recognize, delete unknown app passwords, and check your forwarding, filters and recovery info. Yahoo says app passwords keep working after a password change, and it asks you to check the rest yourself.

Everything below comes from Yahoo's own help pages, checked on November 6, 2026.

Signs your Yahoo Mail has been hacked

Yahoo's hacked account page lists four warning signs:

You are not receiving any emails.
Your Yahoo Mail is sending spam to your contacts.
You see sign-ins from unexpected locations on your security page.
Your account info or mail settings were changed without your knowledge.

One caution about locations. Yahoo notes that an unfamiliar location can sometimes appear because your device reports the wrong location or your internet provider uses a proxy server. A strange city on its own is not proof. A strange city plus spam to your contacts is.

Step 1: Change your password, or recover the account

If you can still sign in, change the password first. From a desktop or mobile browser:

Sign in to the Yahoo Account security page.
Under "Ways of signing in," click Password.
Enter a new password.
Click Continue.

In the Yahoo Mail app, tap the profile icon, tap Manage Accounts, tap Account, tap Security, then scroll down and tap Change password. If there is no option to change your password, Yahoo says you may have Account Key on and need to disable it first.

Pick a password you have never used anywhere else. Do the change on a device you trust. Yahoo also tells you to make sure you have antivirus software installed and updated, so scan the computer before typing a new password into it.

If the hacker changed your password, use the Sign-in Helper, which Yahoo calls its password reset and account recovery tool:

Go to login.yahoo.com/forgot.
Enter your recovery email, or click Use recovery phone number.
Click Next.
Follow the instructions the Sign-in Helper gives you.

Yahoo's sign-in troubleshooting page covers this exact case: if an unauthorized party broke in and changed your password, use the Sign-in Helper, change your password, then review your settings and undo changes you did not make.

Step 2: Sign out devices you don't recognize

A new password does not show you who is still signed in. Yahoo's unusual activity page puts three lists on the security page:

Current sign-ins: devices signed in to your account.
External connections: third-party apps signed in to your account.
Recent account activity: recent changes, such as a phone number added or an email address removed.

To remove a device, find it under "Current sign-ins," click it, and click Sign out. Go through every device you do not recognize.

On the Yahoo apps, you reach the same lists through the Profile icon, Settings, Manage account privacy, Your privacy controls, then Security.

Read "Recent account activity" slowly. It is where you see what the hacker changed, such as a new phone number or a removed email.

Step 3: Delete app passwords you don't recognize

This is the step people miss. Yahoo's app password page says it plainly: "App passwords remain active even if you change your main account password. To invalidate an app password you must delete it."

An app password lets a mail app outside Yahoo read your inbox. If a hacker created one, it keeps working after your reset.

On the security page, under "External connections," click the app passwords.
Click Delete next to any app password you did not create.
Click Delete to confirm.

If you are unsure about one, delete it. Your own mail app will simply ask you to sign in again.

Step 4: Check forwarding, filters and other mail settings

Yahoo warns that hackers may change mail settings "to disrupt your inbox or get copies of your emails." Its list of settings to check is longer than most people expect:

Email filters
Auto-forwarding address
Reply-to address
Send-only address
Default sending address
Sending name
Email signature
Vacation response
Blocked addresses

Forwarding. In New Yahoo Mail on a desktop browser, click the More options icon, select Settings, click Mailboxes, then click your primary mailbox under "Mailbox list." Look under Auto-forwarding. If an address you do not know is there, remove it. Yahoo says forwarding is a Yahoo Mail Plus feature and is not available in every region, so you may not see the option at all. For what forwarding looks like across providers, see our guide to checking if your email is being forwarded.

Filters. Yahoo allows up to 500 filters that can send new mail to a folder or to the trash. A hidden filter that trashes replies from your bank is a common way to keep you in the dark. On a desktop browser:

Click the More icon on the left, below your mail folders, and select Settings.
Click Filters.
Select any filter you did not create.
Click the Delete icon.

Reply-to and blocked addresses. A changed reply-to address sends replies to the hacker instead of you. A blocked address can silence someone who is trying to warn you. Yahoo's advice is to revert any mail settings that were changed.

Step 5: Fix your recovery email and phone

If the hacker added their own recovery email or phone, they can reset your password again later. Yahoo's recovery methods page gives these steps:

Sign in to the Yahoo Account security page.
Click Phone numbers or Additional emails.
Click the Trash icon next to the one you want to delete.
Click Remove email or Remove phone.

Yahoo's account security page adds another route: if someone else added an email or phone to your account, you can also remove it through the link in the verification email Yahoo sent when it was first added.

Then make sure your own recovery email and phone are current. If your recovery email is at another provider, Yahoo says to review that account's security too. A hacked recovery inbox can reset your Yahoo password.

Step 6: Turn on two-step verification

Yahoo's two-step verification page says it adds a code at sign-in from a new device or browser. To turn it on, go to the security page, click 2-step verification under "Ways of signing in," and choose a method: a push notification to a Yahoo app, your phone number, or an authenticator app. Yahoo says the authenticator option needs at least 2 recovery methods on your account.

If you can't get back in

Yahoo may lock an account after too many failed sign-in attempts. It unlocks automatically after 12 hours, or you can regain access sooner with the Sign-in Helper.

The hard case is when the hacker changed your recovery phone and email. Yahoo's own words: if you cannot use the Sign-in Helper because your recovery info is wrong or inaccessible, "you may not be able to regain access to your account again." Our guide to recovering an email account without your phone number covers what is still worth trying.

For human help, Yahoo's support page says to go to Yahoo Help Central, choose the product, and click Contact Us where available. Yahoo notes it does not have a contact option for every issue, and that any support site you use should have a web address ending in yahoo.com. Yahoo also states it never asks for your password in emails or phone calls.

Tell your contacts and check your other accounts

If spam went out from your address, send a short note from a clean device: your account was hacked, ignore messages from the last few days, do not click links or send money. Our post on what someone can do with your email address explains why scammers want the people in your address book.

Then go through every account that shared the old password, starting with banking, shopping and anything that uses this Yahoo address for password resets. Change each one. To see whether the address showed up in a known leak, read has my email been in a data breach. If it started with a link you clicked, follow what to do if you clicked a phishing link too.

If the address is burned

Sometimes an address keeps getting hit long after you lock it down. Starting fresh is an option. Secria Mail sign-up is a name, the address you want and a password, with no phone number and no card. You can give each site its own alias, so if one leaks you can see which site it was and stop it by deleting the alias. You can also import your old mail. See Secria Mail or create an account.

Frequently asked questions

What do I do first if my Yahoo Mail is hacked?

Change your password from the Yahoo Account security page, or use the Sign-in Helper at login.yahoo.com/forgot if you are locked out. Then sign out unknown devices and delete unknown app passwords, since both survive a password change.

Does changing my Yahoo password log the hacker out?

Do not count on it. Yahoo says app passwords stay active after you change your main password, so delete any you do not recognize. Also sign out unknown devices under "Current sign-ins."

My Yahoo account was hacked and the phone number was changed. What now?

Try the Sign-in Helper with your recovery email instead. If you get back in, remove the hacker's number under Phone numbers. If you still have the verification email Yahoo sent when that number was added, its link can also remove it.

Can Yahoo customer service recover a hacked account?

Yahoo offers a Contact Us option for some products and issues, not all. Its own recovery path is the Sign-in Helper. Only use support sites whose address ends in yahoo.com.

How did my Yahoo Mail get hacked?

Usually a reused password from another site's leak, or a phishing page. Our guide to whether someone can hack your email covers the common routes, and what to do if your email is hacked has the first-hour checklist for any provider.