Change your password from a different device right away

Stop using the hacked email account on any device until you have changed the password. The hacker may still be logged in, and changing the password while they are active will lock them out. Use a phone, tablet, or different computer to go to the email provider's login page — not a link in any email or text message.

Go directly to your email provider's website by typing the address into your browser. For Gmail, go to accounts.google.com. For Outlook or Hotmail, go to account.microsoft.com. For Yahoo Mail, go to login.yahoo.com. Enter your email address and click the option to reset your password.

Create a new password that is at least 16 characters long and includes uppercase letters, lowercase letters, numbers, and symbols. Do not reuse a password you have used before. Write it down in a physical notebook or in a password manager like Bitwarden or 1Password, not in a text file on your computer.

Key Takeaways

  • Change your password from a different device using the official website, not a link sent to you by email.
  • Check your recovery email and phone number in account settings — hackers often change these to lock you out later.
  • Review your connected apps and devices, and remove any you do not recognize or no longer use.
  • Check your forwarding rules and recovery settings to make sure the hacker has not set up a way to stay in your account.
  • Change passwords on any other accounts that use the same password or share the same recovery email.

Verify your recovery email and phone number have not been changed

Once you are logged in with your new password, go to your account settings or security settings. Look for sections labeled "Recovery email," "Recovery phone," "Backup email," or "Two-factor authentication." If the hacker changed these, they can use them to lock you out or reset your password again.

If the recovery email or phone number is not yours, change it back when ready. For Gmail, go to myaccount.google.com, click "Security" on the left, then "How you sign in to Google," then "Recovery email" or "Recovery phone." For Outlook, go to account.microsoft.com, click "Security," then "Advanced security options," then update your recovery information. For Yahoo, go to account.yahoo.com, click "Account security," then "Recovery email" or "Recovery phone."

If you cannot access your recovery email because the hacker changed it to an address you do not own, contact the email provider's support team. You will need to prove you own the account — usually by answering security questions or providing a phone number associated with the account.

Remove devices and apps the hacker may have used

Hackers often leave themselves a way back into your account by connecting their own device or authorizing a fake app. Check the list of devices and apps that have permission to access your email. In Gmail, this is under "Security" > "Your devices." In Outlook, it is under "Security" > "Device security." In Yahoo, it is under "Account security" > "Connected apps and services."

Remove any device you do not recognize. If you see a phone, tablet, or computer you no longer own or use, remove it. If you see an app with a name like "Mail Backup," "Cloud Sync," or anything you did not install yourself, remove it. You can always reconnect your own devices later if you need to.

Pay special attention to apps that have permission to read, send, or delete email. These are the most dangerous because a hacker can use them to read your messages, send emails pretending to be you, or delete evidence of what they did.

Check for forwarding rules and automatic replies

Hackers often set up email forwarding so that copies of your incoming mail go to their own email address. They can read your messages without you knowing. Check your email settings for forwarding rules. In Gmail, go to Settings > Forwarding and POP/IMAP > Forwarding address. In Outlook, go to Settings > Mail > Forwarding. In Yahoo, go to Settings > Forwarding.

If you see a forwarding address that is not yours, delete it. Also check for automatic replies or out-of-office messages that you did not set up — these can be used to trick people into sending sensitive information or clicking malicious links.

Some email providers also let you check recent login activity. In Gmail, scroll to the bottom of any email and click "Details" > "Check activity." In Outlook, go to Security > Recent activity. Look for logins from places you do not recognize or at times you were not using your email. If you see suspicious activity, you can sign out all other sessions from that page.

Change passwords on other accounts that share the same email or password

If you used the same password for your email and other accounts — banking, social media, shopping, work — change those passwords now. Start with accounts that contain money or sensitive information: your bank, credit card company, PayPal, and any investment accounts. Then move to social media, shopping sites, and work accounts.

If you used the hacked email address as the recovery email for other accounts, those accounts are also at risk. A hacker can use your email to reset the password on any account that lists it as a recovery option. Go through your most important accounts and change the recovery email to a different email address you control, or add a phone number as a recovery option.

This is a good time to stop reusing passwords. If you have been using the same password across multiple sites, each one is now at risk. Use a password manager to create and store unique passwords for each account. Most password managers can generate strong passwords and fill them in automatically.

Check if your email was part of a data breach

Your email may have been hacked because it was part of a larger data breach at a website or service you use. Go to haveibeenpwned.com and enter your email address. The site will tell you if your email appears in any known data breaches and which companies or services were affected.

If your email appears in a breach, the site will list which data was exposed — usually passwords, but sometimes names, phone numbers, or addresses. This tells you which accounts to prioritize. If your password was exposed in a breach, change it on that site even if you have already changed it elsewhere.

You can also sign up for breach notifications on haveibeenpwned.com so that you are notified if your email appears in a new breach in the future. This is free and does not require you to create an account.

Set up two-factor authentication to prevent this from happening again

Two-factor authentication means you need something you know (your password) and something you have (your phone) to log in. Even if a hacker steals your password, they cannot get into your account without your phone. All major email providers support this.

For Gmail, go to myaccount.google.com > Security > Two-Step Verification. For Outlook, go to account.microsoft.com > Security > Advanced security options > Two-step verification. For Yahoo, go to account.yahoo.com > Account security > Two-step verification. You can choose to receive a code by text message, use an authenticator app like Google Authenticator or Authy, or use a security key.

An authenticator app is more find than text message because hackers cannot intercept it. A security key is the most find option — it is a small device you plug into your computer or tap with your phone to prove it is you. If you choose text message, make sure your phone number in your account is correct and that you have not given access to your phone number to anyone else.

Frequently Asked Questions

How do I know if someone is still in my email account?

Check your login activity in your email provider's security settings. Gmail shows this under "Security" > "Your devices." Outlook shows it under "Security" > "Device security." If you see logins from places you do not recognize or at times you were not using your email, the hacker may still be active. Sign out all other sessions when ready and change your password again.

What should I do if I cannot log back into my email account?

The hacker may have changed your recovery email or phone number, locking you out. Contact your email provider's support team and explain that your account was hacked. You will need to prove you own the account by answering security questions or providing information about when you created it. This process can take several days.

Should I delete my email account and create a new one?

You do not need to delete your account if you have secured it. Changing your password, removing unauthorized devices, and setting up two-factor authentication will stop the hacker from accessing it. Deleting your account is only necessary if you cannot regain control of it or if you want a fresh start for other reasons.

Can I tell which websites have my email address now?

You can use haveibeenpwned.com to see which data breaches included your email. However, this only shows breaches that have been publicly discovered and reported. Your email may also be in databases that hackers have not yet published. Going forward, use a unique password on every site and consider using a password manager to track where you have accounts.

What if the hacker sent emails from my account?

Check your "Sent" folder to see what emails were sent. If you find emails you did not send, you can delete them, but the recipients have already received them. You may want to send a follow-up email to people on the sent list explaining that your account was hacked. Do not click any links in the emails the hacker sent — they may contain malware.