What to Do When Your Email Account Gets Hacked

Maybe a friend texted to ask why you sent them a strange link. Maybe your password suddenly stopped working, or you noticed sent messages you never wrote. However you found out, a hacked email account deserves fast, careful action, because your inbox is the reset button for most of your other accounts.

Work through these steps in order. Most people can finish the essential ones in under an hour.

Signs your email has been compromised

• Contacts receive messages or links you did not send.
• Your password no longer works, or your recovery phone or email has changed.
• You see password reset emails for other accounts that you did not request.
• Messages are missing, or new emails seem to skip your inbox.
• Your account's security page lists sign-ins from places or devices you do not recognize.

Step 1: Use a device you trust

If you suspect malware on your computer, do the recovery from a different device, such as your phone or another computer you know is clean. Changing a password on an infected machine can hand the new password straight to the attacker.

Step 2: Regain access through the official recovery page

If you can still sign in, skip to Step 3. If you cannot, go directly to your email provider's website or app and choose the account recovery option. Type the address yourself rather than clicking a link from an email, since fake "recover your account" pages are a common follow-up scam. The recovery process may ask for an old password, a recovery phone number or details about how you use the account. Answer as completely as you can.

Step 3: Change the password and sign out everywhere

Create a new, unique password that you have never used anywhere else. A password manager makes this painless. Then find the option to sign out of all other sessions or devices, which kicks the intruder out of any place they are still logged in.

Step 4: Lock the door with two-factor authentication

Turn on two-factor authentication right away, and check the recovery email and phone number. Attackers often add their own so they can get back in later. Remove anything that is not yours. Our guide to two-factor authentication methods explains which options hold up best.

Step 5: Check the settings intruders like to change

This is the step most people skip, and it is where attackers hide. Open your email settings and look at each of these:

• Forwarding: an attacker may forward a copy of every message to their own address.
• Filters or rules: look for rules that delete, archive or mark as read messages containing words like "invoice," "password," "bank" or "security."
• Automatic replies and signature: check that nothing has been added.
• Connected apps and app passwords: remove any third-party app or app-specific password you do not recognize.
• Delegates or shared access: make sure nobody else has been granted access to your mailbox.

Also look in your trash and sent folders for messages the intruder may have sent or deleted.

Step 6: Warn your contacts

Send a short note to your contacts, or post where people will see it, explaining that your account was compromised and that they should ignore recent unusual messages. If the attacker sent requests for money or gift cards, say so plainly so nobody acts on them.

Step 7: Secure the accounts linked to this email

Because your email can reset other passwords, assume the attacker may have tried. Change passwords for banking, shopping, social media and any account that uses this address, starting with financial accounts. Look for password reset emails you did not request, since they show which services were targeted.

Step 8: If this is a business account

A hacked business mailbox carries extra risk. Attackers sometimes read conversations for weeks, then send convincing invoices or "updated bank details" to customers or vendors.

• Check sent mail for anything involving payments or banking changes.
• Call key customers and vendors to tell them not to act on recent payment changes without verbal confirmation.
• Tell your bank if any money may have moved.
• Talk with an attorney if customer information could have been exposed, since notification rules may apply.
• In the United States, you can report the incident to the FBI's Internet Crime Complaint Center.

If you cannot get back in

If recovery fails, keep trying the provider's official process, since some requests take time to review. Meanwhile, create a new address, move your important accounts to it, and tell contacts about the change. Then follow the steps in our small business cybersecurity checklist so the new account starts strong.

Frequently asked questions

How did someone get into my email?

Common causes include a password reused from a site that was breached, a phishing page that collected your login, or malware on a device. Unique passwords and two-factor authentication block most of these.

Should I delete the hacked email account?

Usually not. Deleting it can make the address available to someone else and cuts you off from accounts that still use it. Recover and secure it, then move important accounts if you want a fresh start.

Do I need to scan my computer?

If you clicked a suspicious link or download, yes. Run a full scan with your operating system's built-in security tool and update everything before signing back in on that device.