What to Do If Your Email Is Hacked: Recovery Steps and What to Check

Friends are texting you about a weird link you supposedly sent. Or you got a “your password was changed” alert you didn’t trigger. Or you simply can’t log in. Whatever tipped you off, a hacked email account is urgent, because your inbox is the master key to almost everything else: banking, shopping, social media and cloud storage all send password resets there.

Here’s what to do, in order: get back in, lock the attacker out, find the hidden changes hackers leave behind and secure every account tied to that inbox.

Signs your email has been hacked

You may be dealing with a hacked account if:

• You can’t sign in, or your password no longer works
• You get alerts about a password change or a sign-in from an unfamiliar device or location
• Friends receive messages, links or requests for money from you that you didn’t send
• Your sent folder has emails you didn’t write, or your trash has messages you didn’t delete
• Password reset emails arrive for other accounts you didn’t touch
• Emails you expect, such as bank alerts, stop arriving

The last one is easy to miss. Attackers often set up rules that quietly forward, delete or hide certain emails so you don’t notice them working.

Key takeaway: Getting your password back isn’t the finish line. Hackers often leave forwarding rules, filters and connected apps that keep giving them access after you change your password. Checking those is what actually locks them out.

Step 1: Scan your device first

Before changing your password, make sure the device you’re using isn’t compromised. If malware is logging your keystrokes, a new password goes straight to the attacker. Both the Federal Trade Commission and Microsoft recommend running a security scan first.

• On Windows, run a full scan with Microsoft Defender or your security software.
• On Mac, update macOS and remove any software you don’t recognize.
• On a phone, update the operating system and delete unfamiliar apps. Our guide on how to tell if your phone is hacked covers the warning signs.

If you’re unsure about a device, use a different, trusted device for the next steps.

Step 2: Get back into the account

If you can still sign in

Change your password immediately to a long, unique one you’ve never used anywhere else. A password manager can generate and store it.

If you’re locked out

Use only your email provider’s official recovery page. Never use a “recovery service” from a search ad or a phone number in a pop-up.

Recovery works best when you answer from a device and location you’ve used before. Give as much detail as you can, such as old passwords and when you created the account. If the attacker changed your recovery phone and email, recovery can take longer, but keep at it.

Step 3: Lock the attacker out

Once you’re back in, close every door the attacker might still have open.

1. Sign out of all other sessions. Most providers have a “sign out everywhere” option or a device list where you can remove unfamiliar devices.
2. Turn on two-factor authentication. Use an authenticator app, passkey or security key if offered, rather than text messages alone. See our guide to setting up two-factor authentication.
3. Fix recovery info. Make sure the recovery phone number and recovery email are yours. Attackers often swap these so they can take the account back later.
4. Review recent security activity. Google’s “Recent security events” and Microsoft’s recent activity page show sign-ins and changes. Mark anything you don’t recognize.
5. Remove unknown connected apps. On Google, check myaccount.google.com/permissions. Remove any app or service you don’t recognize.

Step 4: Check forwarding rules, filters and settings

This is the step most people skip, and it’s the one that matters most. Look for:

• Automatic forwarding to an address you don’t recognize. Turn it off and delete the address.
• Filters or inbox rules that forward, delete, archive or mark as read certain emails, especially ones containing words like “bank,” “invoice,” “password” or “security.” Delete any you didn’t create.
• Mail delegation that gives another account access to your inbox (Gmail).
• POP or IMAP access you don’t use, which lets other mail programs download your email.
• Automatic replies or a changed signature with links in it.
• Blocked addresses you didn’t add, which can hide messages from your bank.

Where to find these settings:

• Gmail: on a computer, open Settings (the gear icon) > See all settings. Check the Forwarding and POP/IMAP tab, the Filters and Blocked Addresses tab and, under Accounts, the “Grant access to your account” section for delegation.
• Outlook.com: open Settings > Mail and review Rules and Forwarding, plus Automatic replies.
• Other providers: look for sections named forwarding, filters, rules or connected accounts in the web version of your inbox. Mobile apps often hide these settings, so use a computer if you can.

Then look through your sent and deleted folders. The FTC suggests this to see what the attacker sent and what they may have read and deleted.

Step 5: Secure every account tied to that inbox

Anyone who controlled your email could have reset passwords elsewhere. Work through linked accounts in priority order:

1. Banking, credit cards and payment apps. Check for new payees, transfers or changed contact info.
2. Your Apple, Google or Microsoft account, if different from the hacked email.
3. Shopping accounts with saved cards, like Amazon.
4. Social media and messaging.
5. Cloud storage, which may hold tax returns, ID scans and other sensitive files.
6. Anything else that used the same password.

Search your inbox for “password reset,” “verify your email” and “new sign-in” to spot accounts the attacker may have touched. Change any password you reused, and check whether your passwords have leaked using our guide on how to check if your password was leaked.

Step 6: Warn contacts and report it

Tell friends, family and coworkers that your account was hacked, so they ignore any strange links or requests for money sent from it. A quick text or post is fine.

Then report where it makes sense:

• Identity theft: if the attacker used your information to open accounts or make purchases, report it at IdentityTheft.gov and consider a credit freeze.
• Money lost: contact your bank right away, and report the crime to the FBI’s Internet Crime Complaint Center at ic3.gov.
• A work account or business email: tell your IT team immediately. For business-specific risks, see our guide to business email compromise.

Our guide on how to report a scam lists other places to report.

Where to start right now

1. Scan the device you’re using, or switch to a trusted one.
2. Recover or change your password through your provider’s official page.
3. Sign out other sessions and turn on two-factor authentication.
4. Check recovery info, forwarding, filters and connected apps.
5. Secure your bank and other linked accounts.
6. Warn your contacts.
7. Set up a password manager and passkeys so it doesn’t happen again. Our guide to how password managers work is a good place to start.

The bottom line

Most email hacks come from 3 things: reused passwords, phishing and missing two-factor authentication. Fix those and you’ve closed the most common doors. Use a unique password, turn on two-factor authentication or a passkey, learn how to spot phishing emails and check your account’s security page every few months.

If your email is hacked, act fast and in order: clean device, recover the account, lock out the attacker, then hunt for forwarding rules, filters and connected apps they left behind. Finish by securing every account that relies on that inbox. It takes an hour or two, but it turns a scary moment into a fixed problem, and leaves your accounts stronger than before.

Sources

• FTC Consumer Advice: How to recover your hacked email or social media account — signs of hacking, recovery steps and what to check afterward
• Google Account Help: Secure a hacked or compromised Google Account — Google recovery page, security events, third-party access and Gmail settings
• Microsoft Support: How to recover a hacked or compromised Microsoft account — scanning first, password reset and checking forwarding and connected accounts
• IdentityTheft.gov — reporting and recovery plans for identity theft