Stop the attacker from locking you out permanently

The first thing to do is change your password from a different device — a phone, tablet, or another computer — not the one you think is compromised. Use a password you have never used before, at least 16 characters long, mixing uppercase and lowercase letters, numbers, and symbols. Do this before you do anything else, because if the attacker changes your password first, you lose access to your own account and recovery becomes much harder.

If you cannot log in at all, go to the password reset page for your email provider (Gmail, Outlook, Yahoo, or whoever hosts your account). You will be asked security questions or sent a code to a backup phone number or email address. Answer honestly and completely. This step takes 10 to 30 minutes but locks the attacker out of making further changes.

Do not panic if you see unfamiliar activity in your account history. Most email providers show you a list of devices and locations that have accessed your account recently. Write down the ones you do not recognize — the date, time, and location — because you may need this information later.

Key Takeaways

  • Change your password from a different device using a new, strong password before taking any other step.
  • Check your account recovery options (backup email and phone number) and update them to numbers and addresses only you control.
  • Review what the attacker did: forwarding rules, password changes, connected apps, and recent login locations.
  • Change passwords on every other account that uses the same email address, starting with financial accounts and accounts that hold payment methods.
  • Turn on two-factor authentication so a password alone cannot get someone into your account.

find your recovery options so the attacker cannot lock you out later

Go to your account settings and look for "Recovery email" and "Recovery phone number." The attacker may have changed these to their own phone or email so they can reset your password whenever they want, even after you change it. Delete any recovery contact that is not yours. Add back a phone number you own and a backup email address you control — ideally one that is not widely used and not connected to other accounts.

For Gmail, this is under Settings > Security > How you sign in to Google. For Outlook, it is Settings > Security & Privacy > Account security. For Yahoo, it is Account Info > Account Security. The exact path varies, but every provider has this section. If you cannot find it, search "[your email provider] recovery options" and you will find the official instructions.

If the attacker added a recovery phone number that is not yours, remove it when ready. If they added a recovery email address, remove that too. You want to be the only person who can prove you own this account.

Find out what the attacker did inside your account

Check your forwarding rules. In Gmail, this is Settings > Forwarding and POP/IMAP > Forwarding address. In Outlook, it is Settings > Mail > Forwarding. An attacker often sets up a rule that silently copies every incoming email to their own address, so they can read your mail even after you change the password. Delete any forwarding address that is not yours. If you use forwarding legitimately (to send mail to another account you own), keep it, but verify the address is correct.

Look at connected apps and devices. In Gmail, go to Security > Your devices and select "Manage all devices." In Outlook, go to Security & Privacy > Device security. You will see a list of phones, tablets, and computers that have accessed your account. Remove anything you do not recognize. This is especially important because some attackers install apps that stay logged in even after you change your password.

Check your email signature and account name. An attacker sometimes changes these to impersonate you or to make it harder for you to notice the breach. If your name or signature looks wrong, change it back to what you use.

Change passwords on every account that shares this email address

Your email address is the master key to your other accounts. If someone has access to your email, they can reset the password on your bank account, your social media, your work account, or anywhere else that uses that email for password recovery. Start with the accounts that matter most: banking, investment accounts, credit card companies, and any account connected to a payment method.

Make each new password unique. Do not reuse passwords across accounts. If you struggle to remember many passwords, use a password manager like Bitwarden, 1Password, or Dashlane. These programs generate strong passwords and store them encrypted so you only have to remember one master password.

If you use the same password on multiple accounts, change all of them. An attacker who has your email password may also have tried that same password on other sites. This is called credential stuffing, and it works often enough that attackers do it automatically.

Turn on two-factor authentication to make future breaches harder

Two-factor authentication (often called 2FA or two-step verification) means you need something you know (your password) plus something you have (your phone) to log in. Even if an attacker steals your password, they cannot get into your account without also having your phone.

For Gmail, go to Security > 2-Step Verification. For Outlook, go to Security & Privacy > Advanced security options > Additional security verification. For Yahoo, go to Account Security > Generate app passwords. You will be asked to choose a method: a code sent by text message, a code generated by an app like Google Authenticator or Microsoft Authenticator, or a notification sent to your phone that you approve or deny.

Text message codes are better than nothing but not perfect — attackers can sometimes intercept them. An authenticator app is stronger because the code is generated on your phone and never sent over the network. If your email provider offers it, use the authenticator app option.

Save your backup codes in a safe place. Most providers give you a list of one-time codes you can use if you lose access to your phone. Write these down or store them in a password manager, not in a text file on your computer.

Check whether your information was sold or shared

Go to haveibeenpwned.com and search for your email address. This site tracks data breaches that have been publicly reported. If your email appears, you will see which breach exposed it and what information was included (usually just the email address and password, sometimes more). This tells you whether your breach was part of a larger attack or something targeted at you specifically.

Knowing which breach exposed you is useful because it tells you which other accounts might be at risk. If the breach included your password, that password is now public and should never be used again anywhere. If the breach included your phone number or home address, watch for spam or phishing attempts targeting that information.

Having been in a breach does not mean you did anything wrong. Breaches happen to major companies all the time. What matters is what you do after you find out.

Watch for follow-up attacks in the weeks ahead

Attackers sometimes use a hacked email account to send password reset requests to your other accounts, hoping you will not notice and will approve the reset. You might see emails saying "Someone tried to reset your password" or "Confirm your identity." Do not click these links unless you initiated the reset yourself. If you did not ask for a password reset, ignore the email or report it as phishing.

Watch your bank and credit card statements for charges you did not make. If you see fraud, contact your bank or card company when ready. Most banks have fraud protection and will reverse unauthorized charges, but you have to report them within a certain window (usually 60 days).

If the attacker used your email to sign up for accounts in your name, you may receive welcome emails from services you never joined. Delete these, but also log into those accounts and delete them if you can. If you cannot delete them, change the password to something random and move on.

Frequently Asked Questions

How do I know if my email is actually hacked or if I just forgot my password?

If you cannot log in with a password you are sure about, try the password reset option. If that works and you get back into your account, you probably just forgot the password. If you reset the password and then cannot log in again, or if you see emails you did not send or forwarding rules you did not create, your account has been compromised.

Should I delete my email account and start over?

No. Deleting the account does not help because the attacker already has your data, and you will lose access to password resets for all your other accounts. Changing the password and securing your recovery options is faster and more effective. Keep the account and use it, but monitor it closely for the next few weeks.

What if I cannot get back into my email account at all?

Contact your email provider's support team directly. For Gmail, go to accounts.google.com/signin/recovery. For Outlook, go to account.microsoft.com/security-info. For Yahoo, go to login.yahoo.com and select "I cannot access my account." You will be asked security questions or sent a code to a backup contact. This process can take a few days, but it is the only way to regain access if you are locked out.

Do I need to tell people that my email was hacked?

You do not have to, but it is kind to tell close contacts that your email was compromised. If the attacker sent emails from your account (which is common), your contacts may have received phishing messages or requests for money. A quick message saying "My email was hacked, do not click any links from me" helps them stay safe and prevents them from thinking you are a scammer.

Can the attacker get back in after I change my password?

Not unless they have your new password or can reset it using your recovery options. That is why securing your recovery email and phone number is so important. If you have done that and turned on two-factor authentication, they would need both your password and your phone to get back in, which is much harder.