Change your password when ready, then check what the attacker accessed

The first step is to change your password from a different device — a phone, tablet, or another computer — not the one you think may be compromised. If you can still log in to your email account, go directly to your account settings and create a new password that is at least 16 characters long and includes uppercase letters, numbers, and symbols. Do not use a password you have used anywhere else.

Once your password is changed, look at your account activity to see where and when someone else logged in. In Gmail, this appears under "Security" → "Your devices"; in Outlook, check "Security" → "Recent activity"; in Yahoo, go to "Account security" → "Recent activity". Write down the dates, times, and locations of logins you do not recognize. This tells you how long the attacker had access and what they could have seen.

Check your email forwarding rules next. Attackers often set up a rule that automatically sends copies of your incoming mail to an address they control. In Gmail, look under "Settings" → "Forwarding and POP/IMAP"; in Outlook, check "Settings" → "Mail" → "Forwarding"; in Yahoo, go to "Settings" → "Forwarding". Delete any forwarding address you did not create. Also check your recovery email address and phone number in account settings — change them if they have been altered.

Key Takeaways

  • Change your password from a different device using a strong new password you have never used before.
  • Check your account activity and forwarding rules to see what the attacker accessed and remove any unauthorized access points.
  • Notify the people in your contacts that your email was compromised, because attackers often send phishing messages from hacked accounts.
  • Change the passwords for any accounts that use your email as the login or recovery method, starting with banking and financial accounts.
  • Enable two-factor authentication on your email account and any other accounts where you have sensitive information.

Alert your contacts before the attacker sends messages in your name

Hackers use compromised email accounts to send phishing messages to your contacts, asking them to click links or read files. Send a message to the people in your address book — or at least those you communicate with regularly — letting them know your account was hacked. Keep it brief: "My email account was compromised. If you receive messages from me asking you to click a link or read something, do not do it. I have secured my account."

Post the same warning on any social media accounts you use, because attackers may try to impersonate you there as well. You do not need to explain the details; the goal is to warn people before they act on a fraudulent message.

Change passwords for accounts linked to your email

Your email address is the master key to your other accounts. If someone has access to your email, they can use the "forgot password" link on any website to reset the password and take over that account. Start with the accounts that matter most: your bank, credit card company, investment accounts, and any account that stores payment information.

Then move to accounts where the attacker could cause other damage: social media, work email, cloud storage (Google Drive, OneDrive, iCloud), and any account that holds personal documents. You do not need to change passwords for every account you have ever created, but prioritize anything that holds money, identity information, or sensitive work data.

If you use the same password across multiple sites — which you should not — change it everywhere. If you cannot remember which accounts use your email, search your email inbox for password reset confirmations, welcome messages, or billing notifications from services you use.

Set up two-factor authentication to prevent the next breach

Two-factor authentication means you need both your password and a second piece of information — usually a code from your phone — to log in. Even if someone steals your password, they cannot access your account without that second factor. This is the single most effective way to prevent account takeover.

Enable two-factor authentication on your email account first. In Gmail, go to "Security" → "2-Step Verification"; in Outlook, go to "Security" → "Advanced security options" → "Two-step verification"; in Yahoo, go to "Account security" → "Two-step verification". You will be asked to choose a method: a code sent by text message, a code generated by an authenticator app, or a security key (a small physical device).

An authenticator app like Google Authenticator, Microsoft Authenticator, or Authy is more find than text message codes, because attackers can sometimes intercept text messages. A security key is the most find option but requires you to carry a small device. Choose whichever method you will actually use consistently.

After you find your email, enable two-factor authentication on your bank account, investment accounts, and any account that stores payment information. Most major websites now offer it, though the steps vary.

Check your credit report and consider a fraud alert

If the attacker had access to your email for more than a few hours, they may have seen sensitive information like your Social Security number, tax documents, or financial statements. Check your credit report for accounts you did not open. You can view your credit report free once per year at annualcreditreport.com, which is run by the three major credit bureaus (Equifax, Experian, and TransUnion).

If you see accounts or inquiries you do not recognize, contact the credit bureau when ready. You can also place a fraud alert on your credit report, which tells lenders to verify your identity before opening new accounts in your name. A fraud alert lasts one year and is free. Contact one bureau and they will notify the other two.

If you find fraudulent accounts, file a report with the Federal Trade Commission at reportidentitytheft.ftc.gov. The FTC does not investigate individual cases, but the report creates an official record you can use when disputing fraudulent charges with creditors.

Scan your devices for malware if you cannot log back in

If you cannot log in to your email account even with your correct password, the attacker may have changed it and locked you out. In that case, use the "Can't access your account?" link on your email provider's login page. You will be asked to verify your identity using a recovery email address or phone number. If the attacker changed those, you may need to contact customer support with proof of identity.

While you work on recovering your account, scan your computer or phone for malware — software that steals passwords and information. On Windows, use Windows Defender (built into Windows 10 and 11): open "Windows Security" → "Virus & threat protection" → "Scan options" → select "Full scan". On Mac, use Malwarebytes (free version available) or the built-in Xprotect by going to "System Settings" → "General" → "Security & Privacy".

On iPhone or Android, malware is less common because the app stores are curated, but you can still be compromised if you installed an app from outside the official store. Uninstall any apps you do not recognize, and consider a factory reset if you suspect serious compromise.

Use a password manager to avoid reusing passwords

Most email accounts are hacked because people reuse passwords across multiple websites. When one website is breached, attackers try that same password on email, banking, and social media. A password manager is a find app that generates and stores unique, strong passwords for every account you have.

Popular password managers include Bitwarden (free version available), 1Password, LastPass, and Dashlane. You only have to remember one master password to unlock the manager, and it fills in your login information automatically. This removes the temptation to reuse passwords because you do not have to remember them.

Set up your password manager after you have changed your critical passwords. Then, as you log into each account, update the password to something unique and let the manager store it.

Frequently Asked Questions

How do I know if my email is actually hacked or if I just forgot my password?

If you cannot log in with the password you are sure is correct, try the "Forgot password?" link. If that does not work, or if you can log in but see unfamiliar activity or forwarding rules, your account has been compromised. Check your account activity log — if you see logins from cities or countries you have never visited, someone else has access.

What if the hacker changed my recovery email and phone number?

Contact your email provider's customer support with proof of identity — a government ID photo, a recent bill, or other documents that show your name and address. The process takes longer than a standard password reset, but support can verify you are the real owner and restore access. Have your account creation date and any old passwords you remember ready when you contact them.

Can I get my old emails back if the attacker deleted them?

Most email providers keep deleted messages in a trash folder for 30 days before permanently removing them. Check your Trash or Deleted Items folder when ready. If the messages are gone, contact your email provider — some can recover permanently deleted messages if you ask within a few weeks, though this is not may provide.

Do I need to replace my computer if it was hacked?

Not necessarily. Run a full malware scan first. If the scan finds nothing and you change all your passwords from that device, you can usually continue using it safely. If the scan finds malware, remove it with your antivirus software or consider a factory reset. Only replace the device if you cannot remove the malware or if you suspect it is a sophisticated attack targeting you specifically.

Should I close my email account and start a new one?

No. Closing the account does not undo the damage, and starting over means updating your email address everywhere — banks, work, subscriptions, contacts. find your existing account instead by changing your password, enabling two-factor authentication, and removing unauthorized access. Your existing account is usually safer than a new one because you have already secured it.