Change your password when ready, from a different device if possible

Stop using the hacked email account to log into anything else. If you can, use a phone, tablet, or a different computer to change the password — not the device where you first noticed the breach. Go directly to the email provider's website (Gmail, Outlook, Yahoo, or whoever hosts your account) by typing the address into your browser yourself, rather than clicking a link in an email or search result.

Create a password that is at least 16 characters long and includes uppercase letters, numbers, and symbols. Do not reuse a password you have used anywhere else. Write it down on paper and store it somewhere safe, or use a password manager like Bitwarden or 1Password if you already have one set up. Do not email it to yourself or store it in a note on your phone.

If you cannot remember your recovery email or phone number, the email provider's account recovery process will ask you to verify your identity using other information — past passwords you have used, the date you created the account, or devices you have logged in from. This can take a few days.

Key Takeaways

  • Change your password from a different device, using at least 16 characters with mixed case, numbers, and symbols.
  • Turn on two-factor authentication so that anyone logging in needs both your password and a code from your phone.
  • Check your recovery email and phone number in account settings, and update them if they have been changed without your permission.
  • Search your email's forwarding rules and connected apps to find what the hacker set up, and delete anything you do not recognize.
  • Change passwords on any account that shares the same email address, starting with banking, email, and social media.

Turn on two-factor authentication so a hacker cannot log in with just your password

Two-factor authentication (often called 2FA or two-step verification) means that logging in requires two things: your password and a second proof that you are really you. That second proof is usually a code sent to your phone via text message, or a code generated by an app like Google Authenticator or Microsoft Authenticator.

Every major email provider offers this. In Gmail, it is under Security settings. In Outlook, it is under Security & Privacy. In Yahoo, it is under Account Security. Turn it on now, before you do anything else. Write down the backup codes the system gives you — these are one-time codes you can use if you lose access to your phone — and store them on paper in a safe place, not in your email.

If the hacker has already changed your recovery phone number, you may not be able to receive the two-factor code. In that case, use the email provider's account recovery process to regain control, then set up two-factor authentication once you are back in.

Check your recovery email and phone number, and update them if they have been changed

Log into your email account and go to the account settings or security section. Look for "Recovery email" and "Recovery phone number." If either one shows an address or number that is not yours, the hacker has changed it to lock you out. Change both back to your own information right away.

While you are in account settings, look for "Connected apps" or "Third-party access." This is where you see which other services (like Spotify, Slack, or your bank's app) are allowed to read your email or send messages on your behalf. Delete anything you do not recognize. Hackers often add their own apps here to keep access even after you change your password.

Also check "Email forwarding" or "Forwarding addresses." If the hacker set up forwarding, every email you receive will be copied to their address. Delete any forwarding rule that is not yours.

Search your email for signs of what the hacker accessed or changed

Look through your recent emails for password reset confirmations, login alerts, or account change notices from banks, social media, shopping sites, or other services. These tell you which accounts the hacker tried to access. You do not need to act on all of them right now — focus first on financial accounts and email.

Check your email's trash and spam folders for deleted messages. Hackers sometimes delete emails to hide their tracks, and some of those messages might be password resets or account alerts you need to see.

If your email was used to send spam or phishing messages, you will see bounce-back emails or complaints. This usually means the hacker had access for at least a few hours. It does not mean your contacts' accounts are hacked — it means your email address was used to send them malicious links. You can send a brief message to your contacts letting them know your email was compromised and asking them not to click any links in emails from you over the past few days.

Change passwords on accounts that share the same email address, starting with the most sensitive ones

Your email address is the master key to your other accounts. Anyone who controls your email can reset the password on your bank account, your social media, your shopping sites, and anything else that uses that email to recover a forgotten password. Start with the accounts that matter most: your bank, investment accounts, credit card companies, and any other financial services.

Then move to email accounts you own but do not use as often, social media, and shopping sites. Use a different password for each one. If you have been using the same password across multiple sites, this is the moment to stop.

If you see charges on your bank or credit card statement that you did not make, contact your bank or card company when ready. They can freeze the account and dispute the charges. You do not need to wait for anything else.

Check your credit report and consider a fraud alert or credit freeze

A hacked email does not automatically mean your credit is at risk, but it is worth checking. You can view your credit report for free once a year at annualcreditreport.com (this is the official site run by the three major credit bureaus — Equifax, Experian, and TransUnion). Look for accounts you did not open or inquiries from lenders you did not contact.

If you see signs of fraud, you can place a fraud alert with the credit bureaus. This tells lenders to verify your identity before opening new accounts in your name. A fraud alert lasts one year and is free. You can also place a credit freeze, which blocks lenders from seeing your credit report at all unless you temporarily lift it. A freeze costs money in some states and is free in others, and it lasts until you remove it.

If you have not seen any fraudulent accounts or inquiries, you do not need to do this right now. But check your credit report again in a few months, just to be sure.

Watch for phishing emails pretending to be from your email provider

After a breach, scammers often send fake emails that look like they are from Gmail, Outlook, or Yahoo, asking you to "verify your account" or "confirm your identity." These are phishing emails designed to steal your new password. Do not click links in these emails.

If you get an email claiming to be from your email provider, go directly to the provider's website by typing the address yourself, then log in and check your account settings. Do not use any link from the email. Real account alerts from Gmail, Outlook, and Yahoo will also show up in your account's security log, which you can view in settings.

Be especially careful with emails asking you to read an attachment or install software to "protect your account." These are almost always scams.

Frequently Asked Questions

How do I know if my email is actually hacked or if someone just tried to log in?

If you received a login alert from your email provider but you did not try to log in, someone tried to access your account. If you see emails you did not send, forwarding rules you did not create, or your password no longer works, your account was actually compromised. Either way, change your password and turn on two-factor authentication right now.

What if I cannot log back into my email account at all?

Use your email provider's account recovery process. You will be asked to verify your identity using information like your recovery email, recovery phone number, or the date you created the account. This can take a few days. While you wait, contact your bank and other financial institutions directly by phone to let them know your email may be compromised, so they can watch for unauthorized password reset attempts.

Should I delete my email account and create a new one?

Not usually. Changing your password, turning on two-factor authentication, and removing unauthorized access is enough for most people. Deleting your account is harder to undo and may cause problems with other services that use that email. Only delete it if you cannot regain control after following the recovery process.

Can the hacker still access my account if I changed my password?

Not through your password alone, if you also turned on two-factor authentication. But if the hacker added their own recovery email, phone number, or connected apps, they might still have a way in. That is why checking those settings and removing anything unauthorized is so important.

Do I need to tell anyone that my email was hacked?

Tell your bank and credit card company if you think the hacker might have seen financial information. Tell your contacts if your email was used to send them spam or phishing messages. You do not need to notify anyone else unless you stored sensitive information in your email that could affect them.