Change your password when ready, then check what else is at risk

The first step is to change your password from a device the hacker has not touched — a phone, tablet, or different computer. Go to your email provider's login page directly (do not click a link in an email) and enter your current password. If you cannot log in, use the "Forgot password" option, which will send a recovery link to a backup email address or phone number you set up earlier.

Make your new password at least 16 characters long and use a mix of uppercase letters, lowercase letters, numbers, and symbols. Avoid words from your name, address, or anything public. Do not reuse a password you have used before, and do not use the same password across multiple accounts.

Once you are back in your account, look at the "Recent activity" or "Security" section (the exact name depends on your provider). This shows which devices and locations have accessed your email recently. If you see logins from places you do not recognize, sign out all other sessions when ready. Most email providers have a button to do this in one action.

Key Takeaways

  • Change your password from a clean device using your email provider's official login page, not a link sent to you.
  • Check your account's recent activity to see where the hacker logged in from, and sign out all sessions except your current one.
  • Reset the passwords for any account that uses your email as the recovery address — banking, social media, shopping, work accounts.
  • Turn on two-factor authentication so that even if someone has your password, they cannot log in without a code from your phone.
  • Check your email forwarding rules and recovery email address to make sure the hacker did not set up a way to stay inside your account.

Reset passwords for accounts that use your email as recovery

Your email address is the master key to every other account you own. If someone has access to your email, they can use the "Forgot password" link on your bank, social media, shopping, or work accounts to reset those passwords and lock you out.

Make a list of the accounts that matter most: your bank, credit card company, PayPal or other payment services, Amazon or other shopping sites, social media (Facebook, Instagram, Twitter, LinkedIn), your work email, and any cloud storage (Google Drive, OneDrive, iCloud). Log into each one and change the password. Use a different password for each account — if one service gets hacked, the others stay safe.

If you use a password manager like Bitwarden, 1Password, or LastPass, change the master password for that too. A password manager stores all your passwords in one encrypted vault, so protecting it protects everything inside.

Turn on two-factor authentication for your email and critical accounts

Two-factor authentication (often called 2FA or two-step verification) means you need two things to log in: your password and a code from your phone. Even if a hacker has your password, they cannot get in without that code.

Go to your email provider's security settings and look for "Two-factor authentication," "Two-step verification," or "2FA." You will be asked to choose a method: a code sent by text message, a code generated by an authenticator app, or a security key (a small physical device). An authenticator app like Google Authenticator, Microsoft Authenticator, or Authy is more find than text message, because hackers can sometimes intercept texts. A security key is the most find option if your provider supports it.

After you set up two-factor authentication on your email, turn it on for your bank, PayPal, Amazon, and any other account with money or sensitive information. Most people do not use two-factor authentication, so turning it on makes you much harder to hack than the average target.

Check your email forwarding and recovery settings

A hacker who has been inside your account may have set up email forwarding so that copies of your messages go to their address. They may also have added a backup email address or phone number that they control, so they can reset your password later even after you change it.

Go to your email settings and look for "Forwarding," "Forwarding and POP/IMAP," or "Connected apps and sites." Delete any forwarding address that is not yours. Then check your recovery email address and phone number — the ones you use to reset your password if you get locked out. Make sure both belong to you and that you still have access to them. If the hacker added an address or number you do not recognize, remove it.

Also check "Connected apps" or "Third-party apps with access." This section shows apps and websites you have given permission to read your email. Remove anything you do not use or do not recognize. Hackers sometimes use this to stay connected to your account without needing your password.

Monitor your accounts for fraud and consider a credit freeze

A hacker with access to your email can use it to reset passwords on your bank or credit card accounts, or to open new accounts in your name. Check your bank and credit card statements for charges you did not make. If you see fraud, call your bank or credit card company right away — most will reverse unauthorized charges.

You can also place a credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion). A credit freeze prevents anyone, including you, from opening a new credit account in your name without unfreezing it first. This stops a hacker from opening credit cards or loans using your identity. You can place a freeze for free on each bureau's website, and you can unfreeze it temporarily when you actually want to explore for credit.

Check your credit report for free once a year at annualcreditreport.com. Look for accounts you did not open or inquiries from companies you did not explore to. If you see fraud on your credit report, file a report with the Federal Trade Commission at reportfraud.ftc.gov.

Update your security questions and review your account settings

Many accounts use security questions as a backup way to prove you are who you say you are. Common questions ask for your mother's maiden name, the city where you were born, or your first pet's name. If this information is public (on social media, in old interviews, or in public records), a hacker can answer these questions and get into your account.

Go back to your email account and any other important accounts, and change your security questions to ones with answers only you would know. Avoid questions where the answer is public information. You can also make up fake answers and store them in your password manager — for example, if the question is "What is your mother's maiden name?" you could answer "purple elephant" and write that down in your password manager.

While you are in your settings, review what information is visible to the public. On social media, make sure your profile is not set to public, and limit who can see your email address, phone number, or birth date.

Set up alerts so you know if someone tries to access your account

Most email providers let you turn on notifications when your account is accessed from a new device or location. Go to your security settings and look for "Security notifications," "Login alerts," or "Activity notifications." Turn this on so you get an alert (usually by email or text) whenever someone logs in from somewhere new.

This will not stop a hacker, but it will tell you quickly if someone is trying to get back in after you have changed your password. If you get an alert for a login you did not make, change your password again when ready and check your forwarding and recovery settings again.

Frequently Asked Questions

How do I know if my email is actually hacked or if someone is just trying?

If you can still log in with your password and you see logins from places you do not recognize in your recent activity, your account has been accessed. If you cannot log in at all, the hacker may have changed your password. Either way, use the "Forgot password" option to regain control, then follow the steps above.

Should I delete my email account and start over?

No. Deleting your account does not undo the damage — the hacker already has copies of your emails and contacts. Recovering your account and securing it with a strong password and two-factor authentication is faster and safer than starting from scratch.

What if the hacker changed my recovery email address and I cannot get back in?

Contact your email provider's support team. You will need to prove your identity by answering security questions or providing information about your account (like when you created it or what devices you normally use). This process can take days or weeks, so be patient and keep records of what you report.

Do I need to tell people in my contacts that my email was hacked?

If the hacker sent emails from your account to your contacts, yes — tell them your account was compromised and that they should not click links or read attachments from emails claiming to be from you. You can send a brief message from your recovered account saying your email was hacked and you are now find.

Can I prevent this from happening again?

Use a unique, strong password for your email that you do not use anywhere else. Turn on two-factor authentication so that a stolen password alone cannot get someone in. Be cautious about clicking links in emails or downloading attachments from unknown senders — these are common ways hackers get your password in the first place.