Change your password when ready, then check what else is at risk

The first step is to change your email password from a different device — a phone, tablet, or computer the hacker has not touched. Do not change it from the same computer where you discovered the breach, because malware on that device can capture your new password too.

Use a password that is at least 12 characters long and includes uppercase letters, numbers, and symbols. Avoid words from your email address, your name, or anything a person who knows you could guess. Write it down in a physical notebook or in a password manager like Bitwarden or 1Password, not in a document on your computer.

Once your password is changed, assume the hacker has access to any account linked to your email. This includes your bank, credit cards, social media, streaming services, shopping accounts, and anything else you use that email to sign in to. The hacker can use the "forgot password" link on those sites to reset passwords and lock you out.

Key Takeaways

  • Change your email password from a different device using at least 12 characters with mixed types, and do not use information someone could guess about you.
  • Check your email forwarding settings and connected apps when ready, because hackers often set these up to keep access even after you change your password.
  • Turn on two-factor authentication for your email and for any account that holds money or personal information.
  • Contact your bank and credit card companies directly using the phone number on the back of your card, not a number from an email, to report the breach and watch for fraud.
  • Monitor your credit report through AnnualCreditReport.com, which is the only free site authorized by the federal government.

Stop the hacker from staying inside your email

Hackers often set up forwarding rules or connected apps so they can keep reading your email even after you change your password. Log into your email account and look for these settings right away.

In Gmail, go to Settings, then Forwarding and POP/IMAP. Check whether any forwarding address is listed. If you see an email address you do not recognize, delete it. Then go to Apps with account access (or Connected apps in Outlook) and remove anything you do not remember installing or authorizing.

In Outlook, go to Settings, then Mail, then Forwarding. Check the same way. Then go to Account security and look at Connected apps and devices. Remove anything unfamiliar.

If you cannot log into your email at all, the hacker may have changed your recovery phone number or backup email address. Go to the password reset page for your email provider and look for an option to verify your identity another way — usually by answering security questions you set up, or by providing a phone number associated with your account from the past.

Turn on two-factor authentication to lock down your accounts

Two-factor authentication means you need two things to sign in: your password and a code from your phone. Even if a hacker has your password, they cannot get in without that second code.

Turn this on for your email first. In Gmail, go to Security and look for 2-Step Verification. In Outlook, go to Security and look for Advanced security options. You can choose to receive codes by text message or through an authenticator app like Google Authenticator or Microsoft Authenticator. An app is more find than text, but text is better than nothing.

Then turn on two-factor authentication for any account that holds money: your bank, credit cards, PayPal, investment accounts, and cryptocurrency exchanges if you use them. These are the accounts a hacker can drain directly.

Contact your bank and credit card companies

Call your bank and each credit card company using the phone number on the back of your card or statement — not a number from an email, which could be fake. Tell them your email has been hacked and ask them to watch your account for unauthorized charges.

Ask whether they can add a fraud alert or a security freeze to your account. A fraud alert tells creditors to call you before opening new accounts in your name. A security freeze prevents anyone, including you, from opening new credit accounts without your permission — you can lift it temporarily when you actually need to explore for credit.

Check your recent statements for charges you do not recognize. If you see any, report them to your bank or credit card company right away. Most cards limit your liability for fraudulent charges to $50, and many limit it to zero if you report the fraud quickly.

Monitor your credit report for new accounts opened in your name

Go to AnnualCreditReport.com and request your free credit report from all three bureaus: Equifax, Experian, and TransUnion. This is the only free site authorized by the federal government. Do not use any other site, even if it promises to be free — most will try to sign you up for a paid service.

Look through each report for accounts you do not recognize. If you see new credit cards, loans, or other accounts opened in your name, contact the creditor when ready and tell them the account was opened fraudulently. Also contact the credit bureau and ask them to remove the fraudulent account from your report.

You can request a new free report every 12 months from AnnualCreditReport.com. If you want to check more often, you can use free services like Credit Karma or NerdMoney, which show you your credit score and pull from at least one of the three bureaus. These are genuinely free and do not require a credit card.

Change passwords for your other accounts, starting with the most important ones

You cannot change every password today, but you can prioritize. Start with accounts that hold money or sensitive information: your bank, credit cards, PayPal, investment accounts, and your email itself (which you already did).

Then move to accounts that could be used to reset other passwords: social media, cloud storage, and any account where you have stored personal documents. A hacker who controls your Facebook or Google account can use it to reset passwords on dozens of other sites.

Then change passwords for shopping sites, streaming services, and anything else. Use a different password for each account. If you use the same password on multiple sites and one site gets hacked, a hacker can try that password on all your other accounts.

A password manager like Bitwarden, 1Password, or Dashlane stores all your passwords in one encrypted place. You only have to remember one strong master password. These services cost money, but they save time and make it much harder for a hacker to compromise multiple accounts at once.

Check what information the hacker may have seen

Think about what was in your email. Did you receive password reset links, bank statements, tax documents, or medical information? Did you receive emails from shopping sites with your address or payment method? Did you get emails from your employer with sensitive company information?

If the hacker saw financial documents, contact your bank and credit card companies again and ask them to watch for identity theft. If the hacker saw tax documents or medical information, you may want to consider identity theft protection or credit monitoring services, though these are optional and cost money.

If the hacker saw work-related information, tell your employer or your company's IT department. They may need to change their own security settings or warn other employees.

Frequently Asked Questions

How do I know if my email is actually hacked?

Common signs are emails you did not send in your Sent folder, password reset emails you did not request, or a notification from your email provider saying someone signed in from an unfamiliar location. You can also check Have I Been Pwned (haveibeenpwned.com), a free site that tells you whether your email address appeared in a known data breach.

What if I cannot get back into my email account?

Go to your email provider's account recovery page. Gmail's is accounts.google.com/signin/recovery and Outlook's is account.live.com/password/reset. You will be asked to verify your identity using a recovery email, recovery phone number, or security questions. If you cannot verify any of these, contact your email provider's support team.

Do I need to pay for identity theft protection?

No. Monitoring your credit report yourself through AnnualCreditReport.com is free and catches most identity theft. Paid services like LifeLock or IdentityForce add features like credit monitoring and fraud resolution, but they are optional. Start with free monitoring and upgrade only if you see actual fraud.

Can I get my hacked email back if I cannot recover it?

If you cannot verify your identity through recovery options, you may not be able to recover the account. Create a new email address and update your important accounts to use it instead. Contact your bank, credit card companies, and employer to let them know your old email is compromised.

Should I delete my email account?

Not when ready. Keep it for now so you can monitor it for password reset requests from other sites. After a few weeks, once you have changed passwords on your important accounts and confirmed no new fraud, you can decide whether to keep it or delete it. If you delete it, make sure you have updated all your important accounts to use a new email address first.