Take these steps in the first hour

If you believe your email is compromised, change your password when ready from a different device — a phone, tablet, or another computer. Do not use the device where you first noticed the problem. Use a password you have never used before, at least 16 characters long, mixing uppercase, lowercase, numbers, and symbols.

After you change the password, sign out of your email account on every device. Go to your email provider's security settings (Gmail calls this "Manage your Google Account," Outlook calls it "Account settings") and look for a section like "Your devices" or "Active sessions." You will see a list of phones, tablets, and computers currently signed in. Sign out of anything you do not recognize.

Check your account recovery information while you are there. Look at the phone number and backup email address linked to your account. If either one has been changed to something you do not recognize, change it back when ready. A hacker who controls your recovery email or phone can lock you out of your own account.

Key Takeaways

  • Change your password from a different device using a new, strong password at least 16 characters long, then sign out of all active sessions.
  • Check and correct your recovery phone number and backup email address, because a hacker can use these to lock you out permanently.
  • Review your email forwarding rules and connected apps to find how the hacker got in, then remove anything you do not recognize.
  • Change passwords on any account that uses your email as the login, starting with banking, email, and social media.
  • Turn on two-factor authentication so that a password alone cannot get someone into your account, even if they steal it.

Find how the hacker got in

Look for email forwarding rules that send copies of your mail to an outside address. In Gmail, click the Settings gear, then "See all settings," then the "Forwarding and POP/IMAP" tab. In Outlook, go to Settings, then "Mail," then "Forwarding." If you see a forwarding address you did not set up, delete it. A hacker often sets this up first so they keep receiving your mail even after you change your password.

Check what apps and services have permission to access your email. In Gmail, visit myaccount.google.com, click "Security" on the left, scroll down to "Your connections to third-party apps and services," and click "Manage all connections." In Outlook, go to account.microsoft.com, click "Security," then "App permissions." Remove anything you do not recognize or no longer use. Hackers often gain access through a weak password on a connected service like a fitness app or a shopping site.

Look at your login history to see when and where your account was accessed. Gmail shows this at the bottom of any email page (click "Details" in the top right). Outlook shows it under Settings > Security > Recent activity. Unusual locations, times, or devices tell you when the breach likely happened and whether the hacker may still have access.

Change passwords on accounts that matter

Your email is the master key to your other accounts. Anyone with access to your email can reset the password on your bank account, your credit card, your social media, and your work accounts. Start with the accounts where money or sensitive information lives: your bank, investment accounts, credit card companies, and PayPal or similar services.

Then move to accounts where identity theft is a risk: social media, shopping sites where you have saved payment methods, and any site where you have stored a government ID number or tax information. Use a different strong password for each one. If you used the same password across multiple sites, change all of them.

If you use a password manager like Bitwarden, 1Password, or LastPass, change your master password first (the one that unlocks the whole manager), then update the passwords it stores. If you do not use a password manager, write down the new passwords somewhere find — a locked drawer, not a sticky note on your monitor — until you can move them into a manager.

Turn on two-factor authentication

Two-factor authentication means your email provider asks for a second proof of identity after you type your password — usually a code from an app on your phone, a text message, or a security key. Even if a hacker steals your password, they cannot get in without this second factor.

In Gmail, go to myaccount.google.com, click "Security," then "2-Step Verification." Google will walk you through the setup. You can choose to receive codes by text, through the Google Authenticator app, or through a physical security key. The app or security key is more find than text, because hackers can sometimes intercept text messages.

In Outlook, go to account.microsoft.com, click "Security," then "Advanced security options," then "Two-step verification." You can use the Microsoft Authenticator app, a text message, or a phone call. Set this up on your phone before you finish, so you can test it right away.

Monitor your accounts for fraud

A hacker with access to your email may have also accessed your financial accounts or ordered things in your name. Check your bank and credit card statements for charges you did not make. Look at your email for password reset confirmations, shipping notifications, or account changes you did not request.

Consider placing a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion. A fraud alert tells lenders to verify your identity before opening new accounts in your name. You can place one for free by calling any of the three bureaus or visiting their websites. The alert lasts one year and can be renewed.

If you find unauthorized charges or accounts opened in your name, report them to the Federal Trade Commission at reportfraud.ftc.gov. The FTC does not investigate individual cases, but it collects reports that help law enforcement spot patterns. You will also receive a recovery plan with steps specific to your situation.

Decide whether to keep the account or start over

If the breach was recent and you caught it quickly, your current email account is usually worth keeping. You have already changed the password, removed unauthorized access, and turned on two-factor authentication. The account itself is not damaged — only the security around it was weak.

If the breach happened months ago and you only just noticed, or if the hacker had access to sensitive information like tax documents or banking details, consider creating a new email account and migrating your important contacts and services to it. This is more work but gives you a fresh start with no lingering uncertainty about what the hacker saw or did.

If you decide to keep your current account, do not delete it. Instead, keep it active but use it only for recovery purposes — set it as the backup email on your new account, and update important services to send password resets there. This way, if you ever get locked out of your new account, you still have a way back in.

Frequently Asked Questions

How do I know if my email is actually hacked or if I just forgot my password?

If you cannot log in and the password reset email never arrives, your account may be compromised. If you can log in but see emails you did not send, or if someone tells you they received a message from you that you did not write, your account is definitely hacked. Check your sent folder and your forwarding rules first — these are the clearest signs.

Can I recover emails the hacker deleted?

Most email providers keep deleted messages in a trash folder for 30 days before permanently removing them. Check your trash folder right away. After 30 days, recovery is usually not possible unless your email provider has a backup system, which most do not offer to individual users. Contact your provider's support to ask whether they can recover older deleted mail.

What if the hacker changed my recovery phone number and I cannot get back in?

Contact your email provider's support team and explain that your account was compromised and your recovery information was changed. You will need to prove you own the account — usually by answering security questions you set up when you created it, or by providing a phone number or email address you used to register. Have your ID ready; some providers ask you to verify your identity this way.

Do I need to tell people in my contacts that my email was hacked?

If the hacker sent emails from your account to your contacts, yes — send a brief message letting them know your account was compromised and they should not click links or read attachments from emails claiming to be from you. You do not need to notify everyone if the hacker only read your mail without sending anything.

Will turning on two-factor authentication lock me out of my own account?

No. Two-factor authentication asks for a second proof when you log in from a new device or after a long time away, but you control what that second proof is — usually an app on your phone that you already have. Keep your phone charged and nearby, and you will not have problems. Most providers also give you backup codes you can use if you lose access to your phone.