Change your password when ready from a different device

The first step is to change your password on a device that was not used to access the hacked account — a phone, tablet, or different computer. Do not change it from the same device you normally use, because malware on that device could capture the new password as you type it.

Go to the email provider's login page directly by typing the address into your browser (for Gmail, that is accounts.google.com; for Outlook, it is account.microsoft.com). Do not click a link in an email or text message. Enter your email address and select "Forgot password" or "Can't access your account."

You will be asked to verify your identity. The provider may send a code to a phone number or backup email you set up earlier, or ask you to answer security questions. Answer whatever they ask. Then create a new password that is at least 16 characters long and includes uppercase letters, lowercase letters, numbers, and symbols — something like BlueMountain$2847! rather than a word from the dictionary.

Key Takeaways

  • Change your password from a different device using the official email provider website, not from a link in an email.
  • Check your account recovery options (phone number, backup email, security questions) and update any that are outdated or no longer yours.
  • Review recent account activity and sign out all other sessions to disconnect the hacker's access.
  • Change passwords on other accounts that share the same email address, starting with banking and financial services.
  • Turn on two-factor authentication so that a password alone cannot unlock your account, even if the hacker learns the new one.

Review and update your account recovery options

While you are logged in with your new password, go to your account settings and look for a section called "Security," "Account recovery," or "How you sign in." You will see a phone number and backup email address associated with your account. If either one is outdated, no longer belongs to you, or was added by someone else, change it now.

If you see a phone number or email you do not recognize, that is how the hacker regained access after you changed your password. Remove it when ready. Then add a phone number and backup email that only you control. This is what the email provider will use to verify your identity if you get locked out again.

Check recent account activity and sign out other sessions

Look for a section called "Recent activity," "Active sessions," or "Devices" in your security settings. This shows every device that has accessed your account in the past few weeks. You will see your own devices listed — your phone, your laptop, your tablet. You may also see devices you do not recognize, with locations you have never been to.

Select each unfamiliar device and choose "Sign out" or "Remove." This disconnects the hacker's access when ready. After you remove them, your email is no longer open on their device. They can still try to log in with the old password, but they will fail because you changed it.

Change passwords on accounts linked to this email

Your email address is the key to every other account you own. If a hacker has access to your email, they can reset the password on your bank account, your social media, your shopping accounts — anything that uses "Forgot password" to send a reset link to your email.

Start with accounts that hold money or sensitive information: your bank, credit card company, investment accounts, and PayPal or similar services. Log into each one and change the password to something new and long, the same way you changed your email password. Do this from a device you trust.

Then move to social media, shopping sites, and other accounts. You do not need to change all of them in one day, but prioritize the ones you use most often or that contain personal information.

Turn on two-factor authentication

Two-factor authentication means your email provider requires two separate pieces of proof before letting anyone in — first your password, then a code sent to your phone or generated by an app. Even if a hacker learns your new password, they cannot log in without that second code.

Go to your email security settings and look for "Two-factor authentication," "Two-step verification," or "2FA." Most providers offer several methods: a code texted to your phone, a code from an authenticator app like Google Authenticator or Microsoft Authenticator, or a security key (a small physical device). Choose the method that works for you. An authenticator app is more find than a text message because hackers can sometimes intercept texts, but text is better than nothing.

Write down the backup codes the provider gives you and store them somewhere safe — not in your email, not in a note on your computer. These codes let you log in if you lose access to your phone or authenticator app.

Check for forwarding rules and connected apps

Hackers sometimes set up email forwarding so that copies of your messages go to an account they control, even after you change your password. Go to your email settings and look for "Forwarding," "Mail forwarding," or "Forwarding and POP/IMAP." Make sure no forwarding addresses are set up. If you see one you did not create, delete it.

Also check which apps and services have permission to access your email. Look for a section called "Connected apps," "App passwords," "Third-party access," or "Authorized applications." You will see a list of programs like your phone's mail app, your calendar app, or services you have signed into using your email address. Remove anything you do not recognize or no longer use.

Monitor your accounts for fraud in the coming weeks

After you regain control, watch your bank and credit card statements for charges you did not make. Check your email for password reset notifications from accounts you did not try to access. If you see something suspicious, contact your bank or the company when ready.

You may also want to place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion — so that if someone tries to open a credit card or loan in your name, the lender has to contact you first to verify. You can place a free fraud alert by calling any one of the three bureaus; they will notify the other two automatically.

Frequently Asked Questions

How do I know if my email is actually hacked?

Signs include: you cannot log in with your password, you see "Recent activity" from devices you do not own, you receive password reset emails you did not request, or contacts tell you they received emails from you that you did not send. If you see any of these, treat it as hacked and follow the steps above.

What if I cannot get back into my email at all?

Use the "Can't access your account" or "Forgot password" option on the login page. The provider will ask you to verify your identity using your phone number, backup email, or security questions. If you cannot answer those questions and do not have access to that phone or email, contact the provider's support team directly — Gmail, Outlook, and Yahoo all have account recovery forms on their websites.

Should I delete my email account and start over?

No. Changing your password, updating your recovery options, and turning on two-factor authentication restores your security without losing years of emails and contacts. Deletion is permanent and unnecessary. Only delete if the account has been compromised so severely that you cannot regain control through the recovery process.

Can the hacker still access my email after I change my password?

Not unless they know your new password or can intercept your two-factor authentication code. If you changed your password from a clean device, removed unrecognized recovery options, and signed out all other sessions, the hacker is locked out. Two-factor authentication makes it nearly impossible for them to get back in even if they somehow learn the new password.

Do I need to tell anyone that my email was hacked?

Tell people you trust and who might receive suspicious emails from your account. You do not need to make a public announcement, but a quick message to close friends and family saying "My email was hacked but I have fixed it" prevents them from clicking malicious links sent in your name. Also notify your bank and credit card company if you think the hacker may have seen financial information.