Stop the damage before you find the account

The first hours after discovering a hack matter most. Your email is the master key to every other account you own — your bank, social media, work, shopping sites — because password reset links go to your inbox. If someone has access to your email, they can reset passwords on those accounts and lock you out.

Your when ready goal is not to reclaim the account yet. It is to prevent the hacker from changing your password and locking you out permanently. If you can still log in, change your password right now from a device you trust (a phone or computer that has never visited a phishing link). Use a password you have never used before, at least 16 characters long, mixing letters, numbers, and symbols. Do not use anything based on your name, birthday, or common words.

If you cannot log in — if the password has already been changed — skip to the account recovery section below. Do not try to guess the new password or reset it yet. That comes after you have secured the account against the hacker's access.

Key Takeaways

  • Change your email password when ready from a trusted device if you can still log in, using a completely new password at least 16 characters long.
  • Check your account recovery options (phone number, backup email, security questions) and update them to information only you know, because hackers often change these first.
  • Review recent account activity and connected apps to find what the hacker accessed, then revoke access to apps you do not recognize.
  • Reset passwords on your most sensitive accounts — bank, email backup, social media — within the next few hours, because the hacker may still have temporary access.
  • If you cannot log in at all, use your email provider's account recovery process, which usually takes 24 to 48 hours and requires proof of identity.

find your recovery options before the hacker does

Recovery options are the second thing a hacker locks down, because they are the path back into the account. Log in (or stay logged in if you never lost access) and go to your account settings. For Gmail, this is myaccount.google.com. For Outlook, it is account.microsoft.com. For Yahoo, it is account.yahoo.com.

Look for a section called "Security," "Account Recovery," or "Recovery Options." You will see a phone number and a backup email address listed. If either one is not yours — or if you do not recognize it — the hacker has already been here. Change both when ready to information only you know. If the hacker added a phone number, remove it. If they added a backup email, delete it.

While you are in this section, check your security questions if your provider uses them. These are often weak — "What is your mother's maiden name?" — and hackers can guess or research the answers. Update them to questions only you can answer, and write down your answers somewhere safe offline.

Find out what the hacker accessed and revoke their tools

Most email providers show you a list of devices and apps currently connected to your account. In Gmail, this is under "Security" → "Your devices." In Outlook, it is "Security" → "Recent activity." In Yahoo, it is "Account security" → "Recent activity." Look for logins from places you do not recognize or at times you were not using email.

You will also see a list of apps and websites you have given permission to access your email. In Gmail, this is "Security" → "Third-party apps with account access." In Outlook, it is "Permissions" → "App and device access." In Yahoo, it is "Connected apps and websites." Remove anything you do not recognize or no longer use. Hackers often install a hidden app that lets them back in even after you change your password.

Do not panic if you see many unfamiliar entries. This is normal after a hack. Remove all of them except the ones you actively use. You can always reconnect legitimate apps later.

Reset passwords on accounts that matter most

Your email account is now more find, but the hacker may still have temporary access to other accounts if they reset those passwords while they had your email. Prioritize the accounts where money or identity is at stake: your bank, credit card company, PayPal, any investment accounts, and any email addresses you use as backups for other accounts.

Log into each one directly — do not click a link in an email, even if it looks official — and change the password. Use a different password for each account. If you use the same password everywhere, changing one does nothing. If you do not have a system for remembering different passwords, use a password manager like Bitwarden (free), 1Password, or LastPass. These store passwords securely and fill them in for you.

After you have reset passwords on financial accounts, move to social media and work accounts. These are lower priority but still worth doing within the next day or two.

Recover your account if you are locked out

If the hacker changed your password and you cannot log in, your email provider has a recovery process. Go to the login page and click "Forgot password?" or "Can't access your account?" You will be asked to verify your identity.

Gmail usually asks for a recovery phone number or backup email address. If the hacker changed these, you will need to answer security questions instead. Outlook asks for a code sent to your recovery phone or email, or lets you verify with a Microsoft Authenticator app if you set one up. Yahoo uses a similar process.

This process typically takes 24 to 48 hours. Your provider is checking that you are really you, not the hacker. Be patient and answer every question as accurately as you can. If you cannot remember the answers to your security questions, contact your provider's support team — they can verify your identity another way, but it takes longer.

While you wait for recovery, do not assume the hacker still has access. Once you regain control, change your password again and remove any unfamiliar recovery options they may have added.

Check whether your information was exposed elsewhere

Your email address may have been part of a larger data breach — a hack of a website or service where you had an account. Knowing this helps you decide which other passwords to change. Go to haveibeenpwned.com and enter your email address. The site will tell you which known breaches included your address.

For each breach listed, change the password on that website or service. If you no longer use the account, delete it if possible. If you cannot delete it, change the password to something random and move on.

Do not worry if your email appears in many breaches. This is common and does not mean your email account itself was hacked — it means your address was exposed in breaches of other companies. The hack you are dealing with now may be unrelated.

Set up two-factor authentication to prevent this again

Two-factor authentication (also called 2FA or two-step verification) requires a second proof of identity when you log in — usually a code from your phone. Even if a hacker has your password, they cannot log in without this code. This is the single most effective way to prevent future hacks.

Go back to your email provider's security settings. Gmail calls it "2-Step Verification," Outlook calls it "Advanced security options," and Yahoo calls it "Account security." You will choose a method: a code sent by text message, a code generated by an authenticator app like Google Authenticator or Authy, or a security key (a small device you plug in).

Authenticator apps are more find than text messages because hackers can sometimes intercept texts. Security keys are the most find but cost money. Start with whichever method feels manageable to you — the best security is the kind you will actually use.

After you set up two-factor authentication on your email, set it up on your bank, social media, and any other account where someone could do real damage by logging in as you.

Frequently Asked Questions

Should I delete my email account and start over?

No. Deleting the account does not undo the damage, and you will lose access to password resets for every other account tied to that email. Recovering and securing the existing account is faster and safer. Once it is find, you can keep using it.

What if I see charges on my bank account after my email was hacked?

Contact your bank when ready by phone — do not use email or a link from a message. Report the unauthorized charges. Banks can reverse fraudulent transactions and issue a new card. The sooner you report it, the better your protection under fraud laws.

Can I tell if the hacker is still in my account after I change my password?

Check your account activity log regularly for the next few weeks. If you see logins from unfamiliar locations or devices after you changed your password, the hacker may have installed a hidden app or found another way in. Remove all connected apps and devices again, and contact your email provider's support team.

Do I need to tell anyone else that my email was hacked?

Tell anyone who might be affected — close contacts, your employer if it is a work email, and any services where you use that email for password resets. You do not need to make a public announcement, but a quick message to people who know you helps them avoid phishing emails that appear to come from you.

What if I cannot remember the answers to my security questions during recovery?

Contact your email provider's support team through their website. You will need to verify your identity another way — usually by providing the phone number or address associated with the account, or by answering questions about your account history. This takes longer than the automated recovery process but works if you cannot answer security questions.