Change your password when ready, then check what else the hacker accessed

The first step is to change your email password from a device you know is safe — ideally a phone or computer the hacker has never touched. Do not do this from a public computer or a device you share with others. Use a password that is at least 16 characters long and includes uppercase letters, numbers, and symbols. Avoid anything based on your name, birthday, or common words.

After you change the password, log into your email account and look at the "Recent activity" or "Login activity" section. Gmail shows this under Account settings > Security > Your devices. Outlook shows it under Account > Security & privacy > Recent activity. This tells you when the account was accessed, from where, and what device was used. If you see logins from places you do not recognize or at times you were not using email, the account was definitely compromised.

Next, check what the hacker may have done. Look at your email forwarding rules, recovery email address, and recovery phone number. If any of these have been changed, change them back when ready. A hacker often sets up a forwarding rule so they keep receiving your emails even after you change the password. You can find forwarding rules in Gmail under Settings > Forwarding and POP/IMAP, and in Outlook under Settings > Mail > Forwarding.

Key Takeaways

  • Change your password from a safe device using at least 16 characters with uppercase, numbers, and symbols, then check your account's recent login activity to see where the hacker accessed it from.
  • Delete any forwarding rules, recovery email addresses, or recovery phone numbers the hacker added, because these let them keep accessing your account even after you change the password.
  • Reset the passwords for any accounts that use your email as the login or recovery method, starting with banking and financial accounts.
  • Enable two-factor authentication on your email account and on any other accounts that support it, because a password alone is no longer enough protection.
  • Check your credit reports through Equifax, Experian, and TransUnion for fraudulent accounts or inquiries, and place a fraud alert if you see suspicious activity.

Reset passwords for accounts linked to your email

Your email is the master key to your other accounts. If a hacker has your email password, they can reset the passwords on any account that uses your email as the login or recovery method. This includes your bank, credit card company, PayPal, Amazon, social media, and any subscription services.

Start with financial accounts — your bank, credit card, investment accounts, and PayPal. Change these passwords first because a hacker with access to these accounts can move money or make purchases. Then move to social media, email services, and subscription accounts. You do not need to do all of them in one day, but do the most important ones within the first few hours.

When you reset each password, use a different password for each account. If you use the same password everywhere and one account is hacked, the hacker can access all your accounts. A password manager like Bitwarden, 1Password, or Dashlane can store unique passwords for each site so you only have to remember one master password.

Turn on two-factor authentication for your email and other accounts

Two-factor authentication means you need two things to log in: your password and a second proof that you are really you. This second factor is usually a code from an app on your phone, a text message, or a security key. Even if a hacker has your password, they cannot log in without this second factor.

For Gmail, go to Account settings > Security > Two-Step Verification. For Outlook, go to Account > Security & privacy > Advanced security options > Two-step verification. Choose an authenticator app like Google Authenticator, Microsoft Authenticator, or Authy rather than text message if you can, because text messages can be intercepted. A security key — a small physical device you plug into your computer — is the most find option if your email provider supports it.

After you set up two-factor authentication on your email, turn it on for your bank, credit card company, PayPal, and any other financial accounts. Most social media platforms and cloud storage services support it too. The extra step takes only a few seconds each time you log in, and it makes your accounts much harder to hack.

Check your credit reports and place a fraud alert

A hacker with your email address and personal information can open credit card accounts or take out loans in your name. You can check whether this has happened by looking at your credit reports from the three major credit bureaus: Equifax, Experian, and TransUnion. You can view your reports for free once per year at annualcreditreport.com, which is the official government site.

Look for accounts you did not open, inquiries from companies you did not explore to, or addresses that are not yours. If you see anything suspicious, place a fraud alert with one of the three bureaus. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can place a fraud alert for free by calling the bureau or going to their website. The alert lasts one year and can be renewed.

If you find fraudulent accounts or inquiries, you can also place a credit freeze, which locks your credit so no one can open new accounts without your permission. A freeze is stronger than an alert but takes longer to remove when you want to explore for credit yourself. You can place a freeze for free with all three bureaus.

Monitor your accounts for unusual activity

After you have changed your passwords and turned on two-factor authentication, keep watching your accounts for the next few months. Check your bank and credit card statements weekly for charges you did not make. Look at your email's forwarding rules and recovery settings once a month to make sure nothing has changed. Check your credit reports again in three months and six months to catch any new fraudulent accounts.

Set up account alerts if your bank or credit card company offers them. Most banks let you set alerts for large purchases, purchases in certain categories, or logins from new devices. These alerts can warn you quickly if someone is using your account without permission.

Report the hack to the companies involved

If the hacker accessed accounts with your email, report the breach to those companies. Most banks and credit card companies have a fraud department you can call. Social media platforms have report forms on their security pages. Reporting the hack creates an official record and helps the company investigate.

You should also report the hack to the Federal Trade Commission at reportidentitytheft.ftc.gov. This creates a record that can help if you need to dispute fraudulent charges or accounts. The FTC does not investigate individual cases, but the report is part of a larger database that helps law enforcement track fraud patterns.

Frequently Asked Questions

How do I know if my email was actually hacked or just my password guessed?

Check your account's login activity to see if there are logins from places you do not recognize or at times you were not using email. If the forwarding rules, recovery email, or recovery phone number have been changed, the account was definitely hacked. If you only see your own logins, someone may have guessed your password but did not access the account.

Can I recover emails the hacker deleted?

Deleted emails usually go to your Trash or Deleted Items folder for 30 days before they are permanently removed. After 30 days, most email providers cannot recover them. If you need to recover emails older than 30 days, contact your email provider's support team, but recovery is not may provide.

What if I cannot log into my email account at all?

The hacker may have changed your recovery email or phone number, locking you out. Go to your email provider's account recovery page — Gmail's is accounts.google.com/signin/recovery and Outlook's is account.live.com/password/reset. Answer security questions or use a recovery code if you saved one. If you cannot recover the account, contact your email provider's support team with proof of identity.

Do I need to buy antivirus software after being hacked?

A hacked email usually means your password was weak or reused, not that your computer has a virus. If you changed your password from a safe device and turned on two-factor authentication, antivirus software is not necessary. However, if you think your computer itself is infected, run a scan with Windows Defender (built into Windows) or Malwarebytes before changing any passwords.

How long does it take to fully recover from a hacked email?

You can find your account in a few hours by changing your password, deleting forwarding rules, and turning on two-factor authentication. Monitoring your accounts for fraudulent activity takes several months. If the hacker opened accounts in your name, disputing those accounts can take weeks or months. Stay alert for at least six months after the hack.