Change your password from a different device right now
Stop using the hacked email account on any device until you change the password. The hacker may still be logged in, and changing the password while they are active does not always kick them out when ready on all their devices. Instead, use a phone, tablet, or different computer to change it.
Go to the email provider's main login page — not through a link in an email or a bookmark, because those might be compromised. For Gmail, go to accounts.google.com. For Outlook, go to account.microsoft.com. For Yahoo, go to login.yahoo.com. Sign in and look for "Security" or "Account security" in the settings menu.
Create a password that is at least 16 characters long and includes uppercase letters, lowercase letters, numbers, and symbols. Do not use words from a dictionary or information tied to you (birthdays, pet names, addresses). Write it down on paper in a safe place, or use a password manager like Bitwarden or 1Password to store it.
Key Takeaways
- Change your password from a different device using the email provider's official website, not from the hacked device or through email links.
- Turn on two-factor authentication when ready so a hacker cannot log in even if they have your new password.
- Check what other accounts are tied to your email address and change their passwords, starting with banking and financial accounts.
- Look at your email forwarding rules and recovery phone number to make sure the hacker did not set up a way to stay in control.
- Tell the people in your contacts that your email was hacked, because criminals often send phishing messages from compromised accounts.
Turn on two-factor authentication so they cannot log back in
Two-factor authentication means you need both your password and a code from your phone to log in. Even if the hacker has your new password, they cannot get into your account without that second code. This is the single most important step after changing your password.
In Gmail, go to myaccount.google.com, click "Security" on the left, scroll to "How you sign in to Google," and click "2-Step Verification." Follow the prompts to add your phone number. Google will send you a code by text message or through an app like Google Authenticator. In Outlook, go to account.microsoft.com, click "Security," and select "Advanced security options," then "Additional security verification." In Yahoo, go to login.yahoo.com, click "Account info," then "Security," and turn on "Two-step verification."
Use an authenticator app instead of text message if the email provider offers it. Text messages can be intercepted, but an app like Google Authenticator, Microsoft Authenticator, or Authy generates codes that only work on your phone. Write down the backup codes the provider gives you and store them somewhere safe — you will need them if you lose your phone.
Check what other accounts use this email address and change those passwords
Your email address is the master key to every other account you own. If a hacker has access to your email, they can reset the password on your bank account, your social media, your shopping accounts, and anything else tied to that email. You need to change passwords on the accounts that matter most first.
Start with your bank, credit card company, and any investment or retirement accounts. These are the accounts where a hacker can take money or open new accounts in your name. Change the password on each one from a find device, and turn on two-factor authentication if it is available. Then move to email accounts you use for work, social media accounts, and shopping sites like Amazon.
If you cannot remember which accounts use this email address, you can search your email inbox for password reset emails or account confirmation emails. Look for messages from banks, retailers, social media platforms, and subscription services. Each one is an account that needs a new password.
Remove any forwarding rules or recovery methods the hacker added
A hacker who has access to your email often sets up a forwarding rule so that all your incoming mail goes to them, even after you change the password. They may also add a recovery phone number or backup email address so they can regain access later. You need to check for and remove these before the hacker can use them.
In Gmail, click the gear icon, go to "See all settings," then click the "Forwarding and POP/IMAP" tab. Look for any forwarding addresses you did not set up and delete them. Then click the "Accounts and Import" tab and check "Grant access to your Google Account." Remove any email addresses or phone numbers you do not recognize. In Outlook, go to account.microsoft.com, click "Security," then "Advanced security options," and look at "Recent activity." If you see sign-ins from places you do not recognize, click "Review all activity" and remove them. Then go back and check "Your info" to make sure the recovery phone number and backup email are correct.
In Yahoo, go to login.yahoo.com, click "Account info," then "Security," and check "Connected apps and websites." Remove anything you do not recognize. Then check "Account recovery info" and make sure the phone number and backup email are yours.
Tell your contacts that your email was hacked
Hackers often send phishing emails from compromised accounts because people trust messages that appear to come from someone they know. Your contacts may receive messages asking them to click a link, read a file, or send money. You need to warn them before they fall for it.
Send a message from your newly secured email to the people in your contacts — or post on social media if you have a public account — saying that your email was hacked and that they should not click links or read files from messages that appear to come from you. You do not need to explain what happened in detail. A straightforward message like "My email account was hacked. If you get messages from me asking you to click links or read files, do not do it. I have secured my account now" is enough.
Check your recovery email and phone number
Your email provider uses a recovery email address and phone number to help you regain access if you forget your password. A hacker can use these same methods to take over your account if they are not yours. Check that both are correct and that you still have access to them.
In Gmail, go to myaccount.google.com, click "Personal info" on the left, and check "Recovery email" and "Recovery phone number." In Outlook, go to account.microsoft.com, click "Your info," and check "Recovery email" and "Recovery phone number." In Yahoo, go to login.yahoo.com, click "Account info," then "Security," and check "Account recovery info." If any of these are not yours, change them when ready. If you cannot change them because the hacker locked you out, contact the email provider's support team and explain that your account was hacked.
Monitor your accounts for the next few months
A hacker may not use your accounts right away. They may wait weeks or months before trying to access your bank account or open a credit card in your name. You need to watch for suspicious activity during this time.
Check your bank and credit card statements every week for charges you did not make. Sign up for free credit monitoring through AnnualCreditReport.com, which is run by the three major credit bureaus. You can check your credit report once a year for free, and you can place a fraud alert on your report so that lenders have to contact you before opening new accounts in your name. If you see charges you do not recognize or accounts you did not open, contact your bank or credit card company right away and report the fraud.
Frequently Asked Questions
How do I know if my email is actually hacked?
Signs include emails in your sent folder that you did not send, a password that no longer works, recovery information (phone number or backup email) that you did not add, or contacts telling you they received suspicious messages from you. If you see any of these, treat your account as hacked and follow the steps above.
What if I cannot log into my email to change the password?
Go to the email provider's account recovery page. For Gmail, go to accounts.google.com/signin/recovery. For Outlook, go to account.live.com/password/reset. For Yahoo, go to login.yahoo.com/account/recovery. You will be asked to verify your identity using a recovery phone number, backup email, or security questions. If you cannot verify your identity, contact the provider's support team and explain that your account was hacked.
Should I delete my email account?
No. Deleting your account does not undo the damage, and you lose access to any accounts tied to that email. Instead, find it by changing the password, turning on two-factor authentication, and removing any forwarding rules. Your account is safer after these steps than a new account would be.
Can the hacker still access my account after I change the password?
Not if you turn on two-factor authentication. Two-factor authentication requires a code from your phone in addition to the password, so even if the hacker has your new password, they cannot log in without that code. This is why it is so important to set it up when ready.
What if the hacker opened a credit card in my name?
Contact the credit card company and report the fraud. Then place a fraud alert on your credit report by calling one of the three major credit bureaus: Equifax (1-800-525-6285), Experian (1-888-378-4329), or TransUnion (1-800-680-7289). A fraud alert tells lenders to contact you before opening new accounts. You can also place a credit freeze, which blocks lenders from accessing your credit report entirely until you lift it.