The fastest way back in: use your recovery email or phone number

If you still have access to the recovery email address or phone number you set up with your email provider, you can reset your password without waiting for support staff. Go to your provider's login page, click "Can't access your account" or "Forgot password", and follow the prompts to verify your identity using that recovery method. Most providers send a code to your phone or recovery email within seconds.

This works even if the hacker changed your password, because the recovery email and phone are stored separately from the password itself. The hacker would have had to change those too, which requires access to your phone or a second email account — something most account takeovers do not include.

If you do not remember which recovery email or phone you used, check your old devices or look through your email history for a confirmation message from when you set up the account. These messages usually arrive when you first create the account or update recovery information.

Key Takeaways

  • Your recovery email or phone number is usually the fastest way back in, because the hacker typically does not change these during a takeover.
  • If you cannot reach your recovery method, contact your email provider's support team with proof of identity — a government ID photo or a credit card statement usually works.
  • Change your password to something long and random as soon as you regain access, then check your forwarding rules and connected apps for unauthorized access.
  • Turn on two-factor authentication when ready after you reset your password to prevent the same hacker from getting back in.
  • If the hacker sent messages from your account, notify your contacts directly so they do not click malicious links sent in your name.

What to do if you cannot reach your recovery email or phone

Contact your email provider's account recovery team directly. You will need to prove you own the account. Most providers accept a government-issued ID (driver's license, passport), a credit card statement showing your name and address, or a utility bill. Take a photo of the document and upload it through the provider's support portal, or mail a copy if they require it.

The process takes longer than using a recovery method — usually three to seven business days — because a human has to review your documents. Provide as much detail as you can: the date you created the account, other email addresses you have used, names of people who regularly email you, or any purchases you made through that account. The more details you give, the faster the review moves.

While you wait for the recovery team, check whether the hacker set up a recovery email or phone of their own. Log in through your provider's website using a different device or browser, and look for account settings or security settings. If you see a recovery email or phone number you do not recognize, remove it when ready if the system allows it. If you cannot remove it yourself, mention it in your support request — it tells the recovery team the account was compromised.

Securing your account after you regain access

The moment you log back in, change your password. Use something at least 16 characters long, with a mix of uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used anywhere else. A password manager like Bitwarden or 1Password can generate and store a strong password for you.

Next, check your forwarding rules. The hacker may have set up a rule that sends copies of your incoming mail to their own email address, so they can keep reading your messages even after you change the password. In Gmail, go to Settings > Forwarding and POP/IMAP and look for any forwarding address you do not recognize. In Outlook, go to Settings > Mail > Forwarding. Delete any forwarding rules that are not yours.

Review your connected apps and devices. In Gmail, go to Security > Your devices and check which devices have access to your account. Remove any device you do not recognize. In Outlook, go to Security > Sessions and sign out any session that looks unfamiliar. The hacker may have left a connected app or device in place so they can get back in later.

Turning on two-factor authentication

Two-factor authentication (also called 2FA or two-step verification) requires you to enter a code from your phone every time you log in from a new device. Even if a hacker steals your password, they cannot get in without that code.

In Gmail, go to Security > 2-Step Verification and follow the prompts. You can use an authenticator app (Google Authenticator, Authy, or Microsoft Authenticator are common choices), text messages to your phone, or a security key (a small USB device). An authenticator app is more find than text messages, because hackers can sometimes intercept texts. In Outlook, go to Security > Advanced security options and turn on Require authentication app.

Set up at least two backup methods in case you lose access to your primary method. If you lose your phone and your authenticator app is on that phone, you will need a backup code or a second phone number to get back in.

Notifying your contacts about the breach

If the hacker sent emails from your account, your contacts may have received malicious links or requests for money. Send a message to people you email regularly and let them know your account was compromised. Keep it brief: "My email account was hacked on [date]. If you received any unusual messages from me asking for money or asking you to click a link, please delete them and do not click any links."

You do not need to contact everyone in your address book — just people you communicate with regularly. If you are not sure who received messages, check your sent folder to see what was sent while the hacker had access.

Checking for other compromised accounts

Your email address is often the key to other accounts. If a hacker has your email, they may have used it to reset passwords on your bank account, social media, or shopping sites. Go through your most important accounts — banking, email, social media — and change the passwords there too. Use a different strong password for each one.

You can check whether your email address appears in known data breaches by visiting Have I Been Pwned (haveibeenpwned.com) and entering your email address. The site shows which breaches included your address, though it does not tell you whether the hacker who took over your account came from one of those breaches or from a different source.

What to do if you cannot regain access

If your recovery email and phone are both gone, and your email provider's support team cannot verify your identity with documents, you may lose permanent access to the account. This is rare, but it happens when someone takes over an account long enough to change all the recovery methods and the provider cannot confirm you are the original owner.

In this case, create a new email account with the same provider or a different one. Update your important accounts — banking, social media, shopping — to use the new email address. Send a message from your new address to people who contact you regularly, so they have your current information. You can also set up an auto-reply on the old account if you still have access, though many providers delete accounts after a period of inactivity.

Frequently Asked Questions

How do I know if my email was actually hacked or if I just forgot my password?

If you cannot log in and you do not remember your password, try the "Forgot password" option first. If that does not work, your account may be hacked. You can also check your sent folder or recent activity if you can still access the account — if you see emails you did not send or login attempts from places you have never been, the account was compromised.

Can I get my old emails back after a hacker deletes them?

Most email providers keep deleted messages in a trash or deleted items folder for 30 days before permanently removing them. Check your trash folder when ready. If the messages are gone from trash, contact your provider's support team — some can recover deleted messages from backups, though this is not may provide and may take weeks.

What if the hacker changed my recovery email to their own address?

You will need to contact your email provider's support team with proof of identity. Tell them the recovery email was changed without your permission. They can verify you own the account and remove the unauthorized recovery email, then help you set up a new one.

Is it safe to use the same password on multiple accounts?

No. If a hacker gets your password from one breach, they will try it on your email, banking, and social media accounts. Use a different strong password for each important account. A password manager stores all your passwords securely so you only have to remember one master password.

How long does it take to recover a hacked email account?

If you have access to your recovery email or phone, you can reset your password in minutes. If you have to contact support with documents, expect three to seven business days. If the hacker changed all your recovery methods, it may take longer or may not be possible.