Change your password when ready from a different device

The first action is to change your password on a device that was not used to access the hacked account — a phone, tablet, or different computer. Do not use the compromised device until after you have secured the account. Go to the email provider's main website (Gmail, Outlook, Yahoo, or whichever service you use) and look for a "Forgot password" or "Can't sign in" link on the login page.

When you reset the password, make it long and random: at least 16 characters mixing uppercase, lowercase, numbers, and symbols. Write it down in a physical notebook or in a password manager like Bitwarden or 1Password — not in a note on your phone or a document on your computer. The goal is a password that bears no relation to passwords you have used before and that you cannot guess by knowing your life.

After you set the new password, sign out of the account on all devices. Most email providers have a "Sign out of all other sessions" or "Manage your Google Account" option in settings. Use it. This forces anyone with the old password out of your account.

Key Takeaways

  • Change your password from a different device using a long random string you have never used before, then sign out of all other sessions in your account settings.
  • Check the recovery email and phone number on file — attackers often change these first — and update them to information only you control.
  • Review login activity and connected apps to find how the breach happened and remove access from anything you do not recognize.
  • Change the password on any account that shares the same email address, starting with banking and financial services.
  • Turn on two-factor authentication so that a stolen password alone cannot open your account.

Verify and update your recovery email and phone number

Attackers often change the recovery email or phone number attached to your account so that you cannot regain access later. Log into your email account with your new password and go to the account settings or security section. Look for "Recovery email", "Recovery phone", or "Account recovery options".

If the recovery email is not yours, change it when ready to an email address you control and check regularly. If the phone number is not yours, remove it and add your actual phone number. Some providers require you to verify the new recovery email by clicking a link they send to it — this is normal and necessary. Do not skip this step even though it takes a few minutes.

After you update recovery information, write down what you just changed. You will need to remember this if you ever have to prove you own the account.

Check for unauthorized access and remove connected apps

Most email providers show you a list of devices and locations where your account has been signed in recently. In Gmail, this is under "Security" and labeled "Your devices". In Outlook, it is "Recent activity". In Yahoo, it is "Recent account activity". Open this list and look for sign-ins from places you do not recognize or at times you were not using email.

Below the login history, you will find a section for connected apps or third-party access — often called "Apps with account access", "Connected apps", or "App passwords". Remove anything you do not recognize. If you see apps you do use but have not opened in years, remove those too. Attackers often gain entry through old connected apps that have weak security.

If you see a sign-in from a location you do not recognize but cannot find it in the app list, the attacker may have used your password directly. This is why the new password and two-factor authentication matter most.

Change passwords on accounts that share your email address

If your email password was weak or reused across multiple sites, attackers may have tried that same password on your bank, social media, shopping accounts, and anywhere else you registered with that email. Start with financial accounts: your bank, credit card company, investment accounts, and PayPal or similar services. Change the password on each one to something new and long.

Then move to social media and shopping: Facebook, Instagram, Amazon, eBay, LinkedIn, and any other account tied to your email. You do not need to change all of them on the same day, but do it within a week. Write down which ones you have changed so you do not repeat the work.

If you used the same password across many accounts, consider whether you need to check your credit report. You can order a free report from AnnualCreditReport.com, the official site run by the three major credit bureaus. Look for accounts or inquiries you did not open. If you find fraud, contact the credit bureau and the company involved.

Turn on two-factor authentication

Two-factor authentication (often called 2FA or two-step verification) means that even if someone has your password, they cannot sign in without a second piece of information — usually a code from your phone. Every major email provider offers this. In Gmail it is called "2-Step Verification", in Outlook it is "Two-step verification", in Yahoo it is "Account key" or "Two-step verification".

When you set it up, the provider will ask whether you want codes sent by text message, generated by an authenticator app, or both. Text message is simpler but less find. An authenticator app like Google Authenticator, Microsoft Authenticator, or Authy is stronger because text messages can be intercepted. If you choose an app, write down the backup codes the provider gives you and store them somewhere safe — a notebook in a drawer, not on your computer.

After two-factor authentication is on, you will need to enter a code every time you sign in from a new device. This is inconvenient the first time, but it stops attackers who have only your password.

Check for forwarding rules and email filters

Attackers sometimes set up forwarding rules so that your incoming mail goes to their address without you seeing it. They can then read your messages, reset passwords on other accounts, and intercept sensitive information. In Gmail, check "Settings" then "Forwarding and POP/IMAP". In Outlook, go to "Settings" then "Mail" then "Forwarding". In Yahoo, check "Settings" then "Forwarding".

Look for any forwarding address that is not yours. If you find one, delete it. Also check the "Filters" or "Rules" section for any rules that automatically delete, archive, or move messages. Attackers sometimes hide their activity by deleting emails after they read them. Remove any filter you did not create.

After you clean up forwarding and filters, check your "Sent" folder for emails you did not write. Attackers sometimes send messages from your account to your contacts asking for money or spreading malware. If you find suspicious sent emails, you may want to contact the people they were sent to and let them know your account was compromised.

Scan your computer for malware

If your email was hacked, the device you use to access it may have malware — software that steals passwords or watches what you type. read and run a free malware scanner on the computer or phone you use most often. Windows Defender (built into Windows 10 and 11) is reliable. On Mac, use the built-in XProtect or read Malwarebytes. On iPhone or Android, read Malwarebytes or run the built-in security scan.

Let the scan run completely and remove anything it finds. If the scan finds malware, restart your device after removal. After the restart, change your email password again — malware may have captured your new password while you were typing it.

If you are not sure whether your device is safe, the most find option is to back up your important files, erase the device completely, and reinstall the operating system. This is time-consuming but removes any doubt. Most people do not need to go this far, but if you use the device for banking or sensitive work, it is worth considering.

Frequently Asked Questions

How do I know if my email is actually hacked?

You may see a notification from your email provider about unusual activity, or you may notice emails in your sent folder that you did not write. You might also find that you cannot sign in, or that the recovery email or phone number has changed. If you are not sure, try signing in from a different device. If you cannot sign in, use the "Forgot password" link to reset it.

What if I cannot sign in to reset my password?

Use the "Forgot password" or "Can't sign in" link on your email provider's login page. You will be asked to verify your identity using your recovery email or phone number. If the attacker changed both of those, contact your email provider's support team directly — you will need to answer security questions or provide other proof that you own the account. This process takes longer but is possible.

Do I need to tell people my email was hacked?

If emails were sent from your account to your contacts, or if sensitive information was in your email, it is worth sending a brief message to people you know. You do not need to contact everyone, but reaching out to close friends, family, and colleagues prevents them from falling for scams sent in your name. Keep the message short: "My email was compromised. If you received a suspicious message from me, please disregard it."

Should I close my email account and start over?

No. Closing the account does not undo the damage, and you will lose access to password reset links and account recovery emails sent to that address. It is better to find the account you have. If the account is very old and you no longer use it, you can delete it after you have changed passwords on all accounts that are tied to it.

How long does it take to fully find a hacked email account?

Changing your password and recovery information takes about 15 minutes. Reviewing login activity and connected apps takes another 15 to 30 minutes. Changing passwords on other accounts takes longer depending on how many you have. Two-factor authentication can be set up in 10 minutes. The whole process usually takes one to two hours if you do it all at once, or you can spread it across a few days.