Stop the attacker from locking you out permanently

The first thing to do is change your password from a different device — a phone, tablet, or another computer — while you still can. Do not use the hacked computer. Open your email provider's website directly by typing the address into your browser (Gmail.com, Outlook.com, Yahoo.com) rather than clicking a link, because a hacked account sometimes redirects you to a fake login page.

Make the new password at least 16 characters long and use a mix of uppercase letters, numbers, and symbols. Avoid anything tied to your name, birthday, or other information someone could find on social media. Write it down on paper and store it somewhere safe — a locked drawer, not a sticky note on your monitor.

Once you have changed the password, sign out of the hacked email on all devices. Most email providers have a "sign out of all sessions" or "sign out everywhere" option in your account settings. This forces the attacker off, even if they know the old password.

Key Takeaways

  • Change your password when ready from a different device, using at least 16 characters with mixed uppercase, numbers, and symbols.
  • Check your account recovery options — phone number and backup email — and update them if the attacker changed them.
  • Review recent login activity and connected apps to find what the attacker accessed, then disconnect anything you do not recognize.
  • Change passwords on every other account that uses the same email address, starting with banking and financial services.
  • Turn on two-factor authentication so a password alone cannot get someone into your email again.

Reclaim your recovery options before the attacker locks you out

An attacker who has access to your email can change the phone number and backup email address linked to your account. Once they do, you cannot recover the account if they change the password again. Check these settings right now, while you still have access.

In Gmail, go to myaccount.google.com, click "Security" on the left, then look for "How you sign in to Google" and "Recovery email" and "Recovery phone." In Outlook, go to account.microsoft.com, click "Security," then "Recovery options." In Yahoo, go to account.yahoo.com, click "Account security," then "Recovery options." If any of these show a phone number or email you do not recognize, change them when ready.

If the attacker has already locked you out of these settings, you will need to use your email provider's account recovery process. This usually involves answering security questions or providing a phone number you set up when you created the account. It can take several days.

Find out what the attacker saw and did

Check your account activity to see where and when someone logged in. In Gmail, scroll to the bottom of any email page and click "Details" next to "Last account activity." In Outlook, go to account.microsoft.com, click "Security," then "Recent activity." In Yahoo, go to account.yahoo.com, click "Account security," then "Recent activity." Look for login locations and times that are not yours. If you see a city or country you have never visited, that was the attacker.

Next, check what apps and services have permission to access your email. In Gmail, go to myaccount.google.com, click "Security," then "Third-party apps with account access." In Outlook, go to account.microsoft.com, click "Apps & devices," then "App permissions." In Yahoo, go to account.yahoo.com, click "Account security," then "Connected apps & websites." Remove anything you do not recognize or no longer use. Attackers often install apps that let them stay in your account even after you change the password.

Change passwords on every account linked to your email

Your email is the master key to every other account you own. If someone has access to your email, they can reset the password on your bank account, credit card account, social media, and anywhere else that uses "forgot password" to send a reset link to your email.

Start with accounts that hold money or sensitive information: your bank, credit card company, investment accounts, PayPal, and any payment apps. Then move to social media (Facebook, Instagram, Twitter, TikTok), work email if you have one, and any shopping accounts. Use a different password for each one. If you use the same password across multiple sites, change all of them.

If you cannot remember your passwords, use a password manager like Bitwarden, 1Password, or Dashlane. These store passwords in encrypted form and fill them in for you. They cost between $3 and $5 per month, but they make it much harder for a single hacked password to compromise your whole digital life.

Turn on two-factor authentication so this does not happen again

Two-factor authentication means you need two things to log in: your password and a second proof that you are really you. The second proof is usually a code from an app on your phone, a text message, or a physical security key.

In Gmail, go to myaccount.google.com, click "Security," then "2-Step Verification." In Outlook, go to account.microsoft.com, click "Security," then "Advanced security options," then "Two-step verification." In Yahoo, go to account.yahoo.com, click "Account security," then "Two-step verification." Choose an authenticator app like Google Authenticator, Microsoft Authenticator, or Authy rather than text messages, because text messages can be intercepted.

If you set up two-factor authentication, write down the backup codes it gives you and store them in a safe place separate from your phone. If you lose your phone, these codes are the only way to get back into your account.

Monitor your accounts for fraud in the weeks ahead

An attacker with access to your email may have already used it to reset passwords on financial accounts, order things in your name, or change your address. Check your bank and credit card statements for charges you did not make. Log into your credit card and bank accounts and look at recent transactions.

You can also place a fraud alert with the three major credit bureaus — Equifax, Experian, and TransUnion — by calling one of them and asking them to notify the others. A fraud alert tells lenders to verify your identity before opening new accounts in your name. It is free and lasts one year. You can renew it if you need to.

If you find charges you did not make, call your bank or credit card company right away. Most will reverse fraudulent charges within 30 to 60 days. Keep records of everything: the date you noticed the charge, the date you reported it, and the name of the person you spoke to.

Know the difference between a hacked account and a compromised password

A hacked account means someone has logged into your email and may have read your messages, changed your settings, or used it to access other accounts. A compromised password means your password appeared in a data breach somewhere, but no one has actually logged in yet. If you only have a compromised password, you still need to change it, but you do not need to check your account activity or recovery options.

You can check whether your email address appeared in a known data breach by going to haveibeenpwned.com and typing in your email. This site is run by security researcher Troy Hunt and is free to use. If it says your email was in a breach, change that password right away, even if you have not noticed any suspicious activity.

Frequently Asked Questions

Can I recover deleted emails after my account was hacked?

Gmail and Outlook keep deleted emails in a trash folder for 30 days before permanently removing them. Check your trash folder first. If the attacker permanently deleted emails more than 30 days ago, they are gone. Your email provider cannot recover them.

What if I cannot log back into my email at all?

Use your email provider's account recovery process. Go to the login page and click "Forgot password" or "Can't sign in." You will be asked to verify your identity using a recovery phone number, backup email, or security questions you set up when you created the account. This process can take several days.

Should I delete my email account and start over?

Not usually. Changing your password, updating your recovery options, and turning on two-factor authentication are enough to find your account. Deleting it means losing access to all your old emails and any accounts that use it for recovery. Only delete it if you cannot regain control after trying the recovery process.

How do I know if the attacker is still in my account?

Check your recent activity regularly for the first few weeks. If you see new login locations or times you did not create, the attacker may still have access. This usually means they installed an app or changed a recovery option you missed. Go through the "connected apps" section again and remove anything unfamiliar.

Do I need to tell anyone else about this?

If the attacker sent emails from your account to your contacts, they may have received phishing links or malware. You can send a message to your contacts letting them know your account was hacked and asking them not to click links in emails they received from you during the time your account was compromised.