Your email account is the key to most of your other accounts. Getting it back quickly, and closing the doors the attacker left open, matters.
TL;DR
- Scan your device for malware, then change your password and turn on multi-factor authentication.
- Check forwarding rules, filters, recovery details and connected apps, which attackers often change.
- Warn your contacts, and change the password on any other account that used the same one.
Signs that someone else is in your email account include:
- friends receiving messages you didn’t send
- sent messages you don’t recognize
- a password that suddenly doesn’t work
- alerts about logins or setting changes you didn’t make
If you see any of these, work through the steps below in order.
Step 1: Is your device clean?
Update your security software and run a full scan, as the FTC recommends, before changing passwords. If malware is logging your keystrokes, a new password could be stolen as soon as you type it.
Step 2: Can you get back in?
If you can still log in, change your password immediately to a long, unique one. If you can’t, use your provider’s account recovery process from its official website.
Then change the password on every other account where you used the same password, starting with banking, shopping and social media.
Step 3: What did the attacker change?
Attackers often set things up so they keep access even after you change the password. Check:
- Forwarding: is mail being copied to an address you don’t know?
- Filters or rules: are some messages being deleted or hidden automatically?
- Recovery email and phone number: are they still yours?
- Connected apps and devices: remove anything you don’t recognize, and sign out of all other sessions.
- Signature and reply-to address: have they been altered?
Heads up
A forwarding rule can quietly send copies of your mail, including password reset links, to an attacker for months. It’s the first setting to check.
Step 4: How do you lock it down?
Turn on multi-factor authentication, so a password alone isn’t enough to log in. Our guide to locking down your email account explains the options, from authenticator apps to passkeys.
Step 5: Who needs to know?
Tell your contacts that your account was hacked and that they should ignore odd requests sent from it, especially anything asking for money or gift cards. If you use the account for work, tell your IT team or manager. A business account that sends payment requests can be used for business email compromise.
If you think personal information such as your Social Security number was exposed, IdentityTheft.gov has a step-by-step recovery plan.
Quick answers
Q: What if I can’t log in at all?
A: Use your email provider’s official account recovery process, found through its own website or help pages. Avoid search ads and phone numbers from unofficial sites, which can be scams themselves.
Q: Should I just create a new email account?
A: Try to recover the old one first. Many other accounts send password resets to it, and an attacker who keeps it can use it to take those over.
Q: Someone asked me to read them a verification code. Is that normal?
A: No. Never share a verification code with anyone who contacts you. It’s a common trick for taking over accounts.
Email services change their settings and menus often. This guide is general information, not legal or professional security advice; check your provider’s help pages and official sources such as FTC.gov and CISA.gov.
