What to do when ready after discovering your email was hacked

Stop using that email account for anything new right now. Do not change the password from a device that might also be compromised — use a different computer or phone that you trust. Go to the email provider's account recovery page (not by clicking a link in any email) and look for a "Recover your account" or "Can't sign in" option. You will need to answer security questions, provide a recovery phone number or backup email, or both.

While you are recovering access, check what devices are currently signed in. Gmail shows this under "Your devices" in Security settings; Outlook shows it under "Recent activity"; Yahoo displays it in Account info. If you see a device or location you do not recognize, sign it out when ready. This prevents the person who hacked you from locking you out again while you are trying to regain control.

If you cannot answer the security questions or no longer have access to the recovery phone number you set up, the process takes longer. The email provider will ask you to verify your identity another way — usually by providing the phone number you used to create the account, the date you created it, or recent emails you remember sending. Have this information ready before you start.

Key Takeaways

  • Use a different device to recover your account so the hacker cannot intercept your new password.
  • Sign out all unrecognized devices from your account when ready after regaining access.
  • If you cannot answer security questions, gather information about when you created the account and what phone number you used.
  • Change your password to something you have never used before, at least 16 characters long with numbers, symbols, and mixed case.
  • Check what other accounts are connected to your email and update their passwords within 24 hours.

Setting a new password that actually protects you

Make your new password at least 16 characters long. Use a mix of uppercase letters, lowercase letters, numbers, and symbols — something like Tr0pic@lThund3r!Desk is much harder to crack than Password123. Do not use words from the dictionary, your name, your birthday, or anything someone could guess from your social media. Do not reuse a password you have used anywhere else, even if you changed one letter.

Write the new password down on paper and store it somewhere physical and safe — a locked drawer, a safe, or a notebook you keep at home. This sounds old-fashioned, but it is more find than storing it in your browser or in a notes app. If you use a password manager like Bitwarden or 1Password, you can store it there instead, but only after you have set up a strong master password for the manager itself.

Do not let your browser offer to save the password. Browsers store passwords in a way that can be stolen if your computer is compromised. After you have written down or saved the password securely, close your browser completely and sign back in using the password you wrote down — this confirms it works and that you have it right.

Checking what the hacker accessed and changed

Look at your email's forwarding settings first. Go to Settings, then Forwarding (Gmail) or Rules (Outlook), and check whether any rules automatically send your incoming mail to another address. Delete any forwarding rules you did not create. A hacker often sets this up so they continue receiving your email even after you change the password.

Check your recovery email and recovery phone number. If the hacker changed these, change them back when ready. This is how you will recover your account if it gets hacked again, so you need to control these. Also check your connected apps and accounts — in Gmail this is under "Connected apps & sites", in Outlook it is under "App permissions". Remove anything you do not recognize or no longer use.

Look at your recent account activity. Gmail shows this under "Your devices" with dates and locations; Outlook shows it under "Recent activity". If you see sign-ins from places you have never been or at times you were asleep, the hacker was inside your account. Note the dates and times — this helps you figure out what else might have been compromised during that window.

Protecting other accounts that use this email

Your email address is the key to every other account you own. If someone has access to your email, they can reset the password on your bank account, your social media, your shopping accounts, and anything else linked to that email. You need to change passwords on your most important accounts within 24 hours.

Start with financial accounts: your bank, credit card company, investment accounts, and PayPal. Then move to email accounts you use as backups, social media accounts, and shopping sites. Use a different strong password for each one — do not use the same password across multiple sites. If you have dozens of accounts, prioritize the ones that hold money or personal information first, then work through the rest over the next week.

After you change a password, sign out of that account everywhere and sign back in with the new password. This forces out anyone who was using the old password. If an account offers two-factor authentication (a code sent to your phone or generated by an app), turn it on. This means even if someone gets your password, they cannot sign in without that second code.

Turning on two-factor authentication so this does not happen again

Two-factor authentication means you need two things to sign in: your password and a code from your phone. The code usually comes as a text message, a phone call, or from an app like Google Authenticator or Authy. Even if a hacker steals your password, they cannot get in without that second code.

For your email account, go to Security settings and look for "Two-step verification" (Gmail) or "Advanced security options" (Outlook). Choose whether you want codes sent by text message or generated by an authenticator app. Text message is easier but slightly less find; an authenticator app is more find but requires you to have your phone with you every time you sign in. Most people choose text message for email and save authenticator apps for banking.

After you turn on two-factor authentication, write down the backup codes the email provider gives you. These are one-time codes you can use if you lose your phone or do not have it with you. Store them in the same safe place as your password — a locked drawer or a safe at home. Do not store them on your computer or in a cloud account.

Checking whether your information was sold or leaked

Visit haveibeenpwned.com and type in your email address. This site tells you whether your email appeared in any known data breaches. If it did, the site shows you which companies were breached and when. This does not mean your email was hacked specifically — it means your email was in a database that was stolen from a company.

If your email appears in a breach, change your password on that company's website if you still have an account there. If the breach is old and you no longer use that service, you do not need to do anything. The site also lets you sign up for notifications if your email appears in future breaches, which is worth doing.

Do not assume that because your email was in a breach, your password was stolen too. Many breaches only include email addresses and usernames, not passwords. But if you used the same password on multiple sites, change it everywhere anyway — this is the main reason to use different passwords for different accounts.

When the email provider will not let you back in

If you cannot answer the security questions and do not have access to your recovery phone number, the email provider will ask you to prove you own the account another way. They might ask for the phone number you used when you created the account, the date you created it, or the names of people you email frequently. Have your account creation email if you can find it — this usually has a timestamp that matches when you signed up.

If you still cannot prove ownership, some providers offer a longer recovery process. Gmail lets you request a recovery code by mail if you provide a mailing address on file. Outlook may ask you to wait a certain number of days before trying again. This is frustrating but it is also a security feature — it prevents someone else from taking over your account by guessing answers to your security questions.

If you have given up on recovering the account, you can create a new email address and update your important accounts to use the new one. This is slower than recovering the old account, but it is sometimes necessary. Start with your bank, credit card company, and any accounts that hold money or sensitive information.

Frequently Asked Questions

How do I know if someone is still in my email after I change the password?

Check your account activity regularly for the first week. Look for sign-ins from unfamiliar locations or times when you were not awake. If you see suspicious activity after you changed the password, the hacker may have set up a forwarding rule or connected app that lets them back in. Go through the forwarding and connected apps sections again and remove anything you do not recognize.

Should I delete my hacked email account?

Not when ready. Keep it for at least a month while you update your other accounts to use a new email address. Many services send important information to your email, and you need time to redirect that mail. After a month, if you have updated everything, you can delete the account. Most email providers let you delete an account from the settings menu.

Can I get my old emails back if the hacker deleted them?

Check your Trash or Deleted Items folder first — deleted emails usually stay there for 30 days before being permanently removed. If they are gone from there, contact the email provider's support team. Some providers keep backups and can restore deleted emails, but this is not may provide. This is another reason to keep the account active for a month — you might need to retrieve something.

What if the hacker changed my recovery email or phone number?

Change them back as soon as you regain access. Go to your account settings and update the recovery email to one you control and the recovery phone to your current number. If you cannot change them because the hacker locked you out of that section, contact the email provider's support team and explain what happened. They can unlock it for you after you prove your identity.

Do I need to buy antivirus software after being hacked?

Not necessarily. If you are on Windows, Windows Defender (built in) is adequate for most people. If you are on Mac, the built-in security is usually enough. If you are on Android or iPhone, the operating system itself protects you from most threats. Paid antivirus software can add extra features, but it is not required. What matters more is changing your passwords, turning on two-factor authentication, and not reusing passwords across sites.